← Back to the reading view
Slides · 7 slides
Envelope encryption: how a KMS actually protects your data
The same use case told visually, ready to present. Speaker notes carry the full explanation.
Key Management
Envelope encryption
How every cloud KMS encrypts your data without the master key ever leaving its HSM
Envelope encryption: how a KMS actually protects your data · Classical Crypto Today1 / 7
The problem
Why not just send the data to the KMS?
Envelope encryption: how a KMS actually protects your data · Classical Crypto Today2 / 7
Encrypt
Envelope encryption, end to end
Envelope encryption: how a KMS actually protects your data · Classical Crypto Today3 / 7
Decrypt
Nothing readable until the last step
A stolen bucket holds ciphertext and wrapped keys: nothing usable without a live KMS call
Envelope encryption: how a KMS actually protects your data · Classical Crypto Today4 / 7
Cost · size
A wrapped key is as big as the RSA modulus
Envelope encryption: how a KMS actually protects your data · Classical Crypto Today5 / 7
Cost · latency
One KMS call per object adds up
Envelope encryption: how a KMS actually protects your data · Classical Crypto Today6 / 7
The payoff
Rotate the master key without touching stored data
Rotation is a KMS setting, not a data migration
Envelope encryption: how a KMS actually protects your data · Classical Crypto Today7 / 7
1 / 7
Keys: ← → move, F full screen, G all slides, N notes