How the primitives come together in production

Every cloud KMS — AWS KMS, GCP Cloud KMS, Azure Key Vault, HashiCorp Vault — uses the same pattern to encrypt data without ever moving your master key. Here's why, and how it actually works.

Envelope encryption covers wrapping a key with your own KMS. This is about the broader problem: getting a key from one system, person, or organization to another — without it ever existing in the clear outside a trust boundary.

Wrapping and unwrapping keys, covered so far, all happens somewhere. PKCS#11 is the standard interface that lets an application talk to that somewhere — an HSM, a smart card, a USB token — without caring which vendor built it.

Every major cloud encrypts your data by default. The real question is who controls the key: the provider, you inside the provider's KMS, a key you generated and imported, or a key that never leaves your own HSM. Here's what each option protects against, and what it costs.

The X.509 module covers what's inside one certificate and how a chain verifies. This is the other half: how an organization actually runs the CA hierarchy that issues, automates, and eventually retires millions of them.

Every operating system update, driver, mobile app, and container image you install is checked against a digital signature first. Here's what that signature actually binds, why timestamps and revocation dates matter more than the algorithm, and why signing keys now have to live in hardware.

Malware that runs before the operating system can hide from everything that runs after it. Secure boot makes each boot stage verify the next, starting from a key the attacker can't change. Here's how UEFI Secure Boot, measured boot, and anti-rollback fit together, and where they have failed.

"Just use OAuth" conflates three different standards solving three different problems. Here's what each one actually does, how they relate to the JWTs you already know, and where passkeys fit in.

Before a PIN can be translated or a CVV checked, someone has to get the first key into the HSM. How custodians, XOR'd components and key check values do that under dual control, and how one master key then protects every other key in a payment system.

How a card PIN is packaged, encrypted at the point of entry, and re-encrypted hop by hop across acquirer, network, and issuer — without ever existing in the clear outside a hardware security module.

How the card verification value printed on the back of a card is generated, why the magstripe and card-not-present versions deliberately don't match, and why PCI DSS treats storing it as an absolute rule, not a guideline.

How a chip card and an issuer's host cryptographically prove to each other that they're both genuine, transaction by transaction — using a key that exists nowhere outside that one card and a cryptogram that's never reused.

Card-not-present purchases can't rely on a physical chip proving anything — so 3-D Secure authenticates the cardholder instead, and tokenization makes sure the real card number is never the thing worth stealing in the first place.

How millions of PIN pads each encrypt every transaction under a different key, while the acquirer's HSM holds just one Base Derivation Key, and why the industry is moving from TDES DUKPT to AES DUKPT.

Encrypting a card number with AES-GCM breaks every schema and system that expects 16 digits. Format-preserving encryption turns it into another 16 digits instead. Here's how vaultless tokenization works, where it fits next to a token vault, and what it quietly gives up.