Security & governance
Envelope encryption
Envelope encryption is a technique in which data is encrypted with one key, called a data key, and that data key is in turn encrypted with a second key, called a key encryption key or master key. The encrypted data key is stored alongside the data, like a letter sealed in an envelope with its own locked key attached.
How does envelope encryption work?
To write, the system obtains a fresh data key, encrypts the object with it, encrypts the data key with the master key and stores the ciphertext together with the wrapped data key. The plaintext data key is then discarded from memory. To read, the system sends the wrapped data key to the key management service, receives the plaintext data key back and decrypts the object locally.
| Key | Protects | Where it is kept | How many |
|---|---|---|---|
| Data key | One object, part or volume | Stored wrapped, next to the data | Very many |
| Key encryption key | Data keys | Inside the key management service | Few |
| Root key | Key encryption keys | Hardware security module | One or a handful |
Why not encrypt everything with one key?
A single key applied directly to all data has three problems. Bulk data would have to be sent to the key service for every operation, or the master key would have to be distributed to every storage node, widening its exposure. A compromise of that key would expose everything at once. And replacing it would mean decrypting and re-encrypting every byte. Envelope encryption keeps the master key in one protected place and limits what any single data key can reveal.
How does it make key rotation practical?
Rotating the master key requires re-wrapping only the small data keys, not the data they protect. At petabyte scale that is the difference between a metadata operation and rereading the entire store. Systems commonly keep earlier master key versions available to unwrap old data keys while using the newest version for new writes, and re-wrap in the background. Key rotation in object storage describes how this plays out operationally.
Where is envelope encryption used?
It underlies server-side encryption at rest in object storage, including the S3 options in which keys are managed by the storage service, by a key management service or supplied by the client. It is also used by backup software, databases and file systems. The hierarchy is what allows customer-controlled models such as bring your own key: the customer controls the master key, and the provider's systems handle only wrapped data keys.
Frequently asked questions
Is the data key stored in plaintext anywhere?
Only in memory while an object is being encrypted or decrypted. On disk it is stored in wrapped form.
Does envelope encryption slow down storage?
The bulk encryption is done locally with fast symmetric ciphers. The key service is called only to unwrap data keys, and results are often cached briefly.
What is lost if a data key is compromised?
Only the object or objects that data key protects, not the rest of the store.
Related terms
- Key management service (KMS): holds the master key.
- Encryption at rest: what envelope encryption implements.
- Bring your own key (BYOK): customer control of the master key.
- Hold your own key (HYOK): master keys kept outside the provider.
- Object metadata: where the wrapped data key reference travels with the object.