Lesson 3.6: Envelope encryption and key rotation
Encrypting large amounts of data directly with one master key makes that key hard to rotate: every byte would have to be re-encrypted. Envelope encryption, used by every cloud KMS, separates the jobs: a fresh data encryption key (DEK) encrypts the data, and a key encryption key (KEK) only encrypts the small DEK. Rotating the KEK means re-wrapping a few bytes. In the lab you run Northwind's nightly backup, restore from it, rotate the KEK without touching the encrypted data, prove the backup still decrypts, and record the old key's new state.
17 min
You will learn to
- Explain envelope encryption (DEK and KEK)
- Run and restore an envelope-encrypted backup
- Rotate a KEK by re-wrapping
- Verify integrity after rotation
- Manage key states (active, decrypt-only, destroyed)
Key terms
- DEK / KEK
- Data encryption key (encrypts data) / key encryption key (encrypts DEKs).
- Envelope encryption
- Encrypting data with a DEK and storing the DEK wrapped by a KEK next to it.
- Key rotation
- Replacing a key with a new one on a schedule or after suspected compromise.
- Cryptoperiod
- The time a key may be used; NIST SP 800-57 separates use for protecting and for processing.
- KMS / HSM
- A key management service / hardware that keeps KEKs and performs wrap and unwrap without exposing them.
← HMAC and message authentication · All lessons · A poisoned GitHub Action and leaked CI secrets →