Envelope Encryption

ELI5 — The Vibe Check

Envelope Encryption is a two-key system: you encrypt your data with a 'data key,' then encrypt that data key with a 'master key.' Like putting a letter in an envelope, then putting that envelope in a safe. The master key stays locked in KMS while you work with the data key locally for speed.

Real Talk

Envelope encryption uses a two-tier key hierarchy: a data encryption key (DEK) encrypts the data, and a key encryption key (KEK/master key) encrypts the DEK. The encrypted DEK is stored alongside the data. Decryption requires the KEK to unwrap the DEK, limiting KMS operations and improving performance.

When You'll Hear This

"Envelope encryption lets us encrypt locally with the DEK while the master key never leaves KMS." / "Each record gets its own data key, all wrapped by the same master key."