Key Management

Protect Encryption Keys with Envelope Encryption

Encrypting sensitive data is only useful if the keys are protected as carefully as the data itself. A common mistake is to focus on the encryption algorithm while treating key storage as a secondary detail. If an attacker can obtain both the ciphertext and the key that decrypts it, the encryption no longer provides the intended protection. Envelope encryption addresses this operational problem by using different keys for different jobs. A data encryption key encrypts the data, while a separate key-encryption key protects the data key. This separation makes it possible to encrypt many pieces of data without storing their plaintext data keys beside them.