Key management and envelope encryption
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
manage keys without ever handling the master key.
Planned topics
- A key management service (KMS) holds master keys; they never leave it.
- Envelope encryption: a data key encrypts the data; the KMS master key encrypts the data key; store the encrypted data key beside the data.
- Benefits: rotate the master key cheaply, audit every decrypt, restrict who may use which key.
- Store a key ID or version with each ciphertext so old data stays readable during rotation.
Draft outline details
Demonstration
flow: generate data key → encrypt phone with AES-GCM → store ciphertext + encrypted data key + key ID; to read, ask KMS to decrypt the data key.
Check your understanding
Why encrypt the data key instead of the data directly with the master key?
Show answer
Master keys stay in the KMS and rotate cheaply; bulk data is encrypted locally.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.