CompTIA SecurityX (CAS-005)Security EngineeringHard
A security architect is designing a new microservices platform that will host highly sensitive customer data. To protect data at rest, the architect wants to implement a multi-layered encryption strategy where data is encrypted with a unique data encryption key (DEK), and the DEK itself is encrypted with a key encryption key (KEK). The KEKs are then managed by a centralized key management system (KMS). This approach ensures that compromise of a single DEK does not expose large datasets and simplifies key rotation. What is this cryptographic practice called?
- AQuantum Key Distribution
- BFormat-Preserving Encryption
- CEnvelope Encryption
- DHomomorphic Encryption
Show answer & explanationAnswer & explanation
Correct answer: C. Envelope Encryption
Envelope encryption is a cryptographic practice where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a key encryption key (KEK). This creates a hierarchy of keys, allowing for efficient key rotation and management while providing strong data-at-rest protection. Compromise of a DEK only affects a small portion of data, and KEKs can be managed by a KMS.
Why the other options are wrong
- A. Quantum Key Distribution (QKD) is a method for securely exchanging cryptographic keys using principles of quantum mechanics, not a method for multi-layered data-at-rest encryption.
- B. Format-preserving encryption encrypts data while maintaining its original format, which is a different concern than multi-layered key management.
- D. Homomorphic encryption allows computations on encrypted data without decrypting it, which is not the multi-layered key management described.
Envelope Encryption
A cryptographic technique where data is encrypted with a data encryption key (DEK), and the DEK itself is encrypted with a key encryption key (KEK), forming a key hierarchy.
- Uses a DEK for actual data encryption
- Uses a KEK to encrypt the DEK
- KEKs are typically managed by a KMS for enhanced security and rotation
Memory trick: Envelope: Key in a key, like a letter in an envelope.