Envelope encryption

Data is encrypted with a data key, and the data key is encrypted with a master key kept in a KMS. Rotating the master key does not require re-encrypting all the data.

Where it shows up in real systems

  • Key management service

    Envelope encryption keeps a master key in the KMS and encrypts data with short-lived data keys, so you do not call the KMS for every record.

    In production: AWS KMS, Azure Key Vault HSM, Google Cloud KMS

See it break, then fix it

Build an architecture, send it a day of traffic and outages, and learn why it holds or fails. Free to start.

Open the learning path Open the sandbox