Envelope Encryption
Envelope encryption protects data with a per-object data key and wraps that key with a long-lived master key held in a KMS or HSM, limiting exposure and simplifying rotation.
Definition
Envelope encryption is a two-layer scheme in which a data encryption key encrypts the payload and a key encryption key, held in a key management service or hardware security module, encrypts the data key so it can be stored alongside the ciphertext.
Context and scope
Use it for data at rest in databases, object storage, and backups, especially when per-tenant or per-object keys are required and the payload is larger than a KMS can encrypt directly.
Common misconceptions
- Envelope encryption stores the data key in plaintext next to the data; the data key is stored wrapped
- The KMS sees every payload; it only wraps and unwraps keys
- Rotating the master key requires re-encrypting all data; only the wrapped keys need rewrapping
Anti-patterns
- Reusing one data key for every object in a bucket
- Caching unwrapped data keys indefinitely in application memory
- Storing the wrapped key without recording which key version wrapped it
Related concepts
Related examples
Authoritative source
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html
Two layers, two jobs
Data keys are cheap to create and can be unique per object, tenant, or field. Master keys are expensive to protect and rarely leave the KMS or HSM. Envelope encryption uses each where it fits: the data key does bulk encryption locally, and the master key protects the data key without touching the payload.
How it works
The application asks the KMS to generate a data key. The response contains plaintext key material and the same key encrypted under the master key. The application encrypts the payload with the plaintext key, discards it from memory, and stores the ciphertext together with the wrapped key, an initialization vector, an authentication tag, and the master key identifier.
To decrypt, the application reads the wrapped key, calls the KMS to unwrap it, and decrypts locally. Rotating the master key only requires rewrapping the stored data keys, not re-encrypting terabytes of payload. Rotating a data key means re-encrypting that object.
When to use it
Use envelope encryption whenever data at rest needs per-object keys, cross-region portability, or cryptographic separation between tenants. It is the standard approach for object storage, database field encryption, and backup systems. For small secrets that fit within KMS payload limits, direct encryption can be simpler.
Trade-offs
The KMS becomes a critical dependency on the read path, so cache unwrapped data keys briefly and plan for KMS outages. Key material in process memory can leak through core dumps, so lock memory where possible. More layers mean more metadata to mismanage: a missing key ID makes ciphertext undecryptable even with the right master key.
Example and misconceptions
A SaaS stores each tenant’s documents under a unique data key, wrapped by a regional master key. A regulator asks for crypto-shredding of one tenant: deleting that tenant’s wrapped keys renders the ciphertext unreadable without touching other tenants.
The common misconception is that the KMS encrypts the documents. It encrypts small keys; the application does the bulk work, which is why the pattern scales.
Related concepts: Encryption at Rest, Key Management, and Key Rotation.