Applied Cryptography
Let DEK be a data encryption key and KEK a key encryption key. Which of the following correctly describes envelope encryption, as used in cloud storage and elsewhere?
- AThe data are encrypted with a DEK, the DEK is encrypted with a KEK inside the key management service, and it is stored together with the data
- BAll the data are sent to the key management service to be encrypted directly with a single key inside the key management service
- CThe key used to encrypt the data is stored unencrypted in the same place as the ciphertext so that it is easy to retrieve
Show answer and explanation
Answer: A. The data are encrypted with a DEK, the DEK is encrypted with a KEK inside the key management service, and it is stored together with the data
In envelope encryption a DEK is created for each piece of data and the data are encrypted with symmetric-key encryption; the DEK is encrypted (wrapped) with a KEK inside a KMS or HSM and stored next to the encrypted data. Large data need not be sent to the key management service, and the KEK never leaves the device, so the keys that need the strictest protection can be kept to a few. When the KEK is rotated, only the small DEKs need to be re-encrypted, not all of the data. To read the data, the wrapped DEK is decrypted by the KMS and the data are decrypted locally.
- A. Correct. It is a two-layer scheme in which the key that wraps the data is wrapped again with another key.
- B. Sending all the data would increase the traffic and the processing load. Only the small DEKs are sent to the key management service.
- C. Placing the encryption key in plaintext next to the data would give anyone who steals the data the key as well.