CompTIA SecurityX (CAS-005)Security EngineeringEasy
A security architect is designing a new cloud-native application that will process highly sensitive customer data. The application uses microservices, and each microservice needs to encrypt data at rest before storing it in a database. Due to performance requirements and the need for frequent key rotation, the architect wants to avoid directly encrypting large data blocks with a master key. Instead, a unique, ephemeral key should be used for each data block, with the master key only used to protect these ephemeral keys. Which cryptographic technique BEST describes this approach?
- AHomomorphic Encryption
- BQuantum Key Distribution (QKD)
- CEnvelope Encryption
- DKey Derivation Function (KDF)
Show answer & explanationAnswer & explanation
Correct answer: C. Envelope Encryption
Envelope encryption is a cryptographic technique where a data encryption key (DEK) is used to encrypt the actual data, and then the DEK itself is encrypted by a master key (Key Encryption Key or KEK). This approach is ideal for managing large amounts of data with frequent key rotation and performance considerations, as the master key is used less frequently.
Why the other options are wrong
- A. Homomorphic encryption allows computations on encrypted data without decrypting it, which is not the primary goal here.
- B. Quantum Key Distribution is a method for securely exchanging cryptographic keys using quantum mechanics, not for encrypting data at rest.
- D. A Key Derivation Function generates cryptographic keys from a secret, which is a component of key management but not the overall strategy described.
Envelope Encryption
A cryptographic method where a data encryption key (DEK) encrypts the data, and a separate key encryption key (KEK) encrypts the DEK. This allows for efficient key rotation and protection of the master key.
- Uses two layers of encryption.
- DEK for data, KEK for DEK.
- Improves performance and key management.
Memory trick: An ENVELOPE holds the letter, and a key holds the envelope.