An architect explains that large data sets are encrypted locally with data encryption keys, and each data key is then encrypted by a key-encryption key that never leaves the key management service. What is the main reason for this envelope encryption design?
Select an answer to reveal the explanation.
Short Explanation
Picture a letter in a locked box, and the box key sealed in an envelope that only the bank vault can open. You do the heavy encrypting locally and only send the tiny envelope to the vault. The trap is thinking the vault holds your data; it only ever holds the master key.
Full Explanation
Envelope encryption uses two tiers of keys. A data encryption key encrypts the data itself, usually with a fast symmetric algorithm, close to where the data lives. That data key is then encrypted, or wrapped, by a key-encryption key that is generated and kept inside a key management service or HSM and never exported. The wrapped data key is stored alongside the ciphertext. This design avoids sending large volumes of data to the key service, which would be slow and constrained by request size, while keeping the most valuable key protected in hardened infrastructure with centralized access control and logging. Access control on the key service remains essential; authorized principals can ask it to unwrap data keys, and that permission is exactly what must be restricted. The key service does not store the protected data sets; it holds the master keys and performs cryptographic operations on small payloads. Envelope encryption does not replace symmetric data encryption with asymmetric encryption; bulk data is normally encrypted symmetrically, and asymmetric algorithms are slower for large objects. Exam caveat: envelope encryption also enables efficient key rotation, because only data keys need re-wrapping. Operational check: review who can call the unwrap or decrypt operation on each master key.