Technology Encyclopedia Home >How to implement envelope encryption?

How to implement envelope encryption?

Created on 2025-07-08 14:12:33
92

Envelope encryption is a technique that combines symmetric and asymmetric encryption to securely encrypt data. Here's how it works:

  1. Generate a Data Encryption Key (DEK): A symmetric key (e.g., AES-256) is generated to encrypt the actual data.
  2. Encrypt the Data with the DEK: The plaintext data is encrypted using the DEK.
  3. Encrypt the DEK with a Key Encryption Key (KEK): The DEK is encrypted using an asymmetric key pair (e.g., RSA or ECC). The KEK is typically stored in a secure key management system.
  4. Store or Transmit the Encrypted Data and Encrypted DEK: The encrypted data and the encrypted DEK are stored or transmitted together.

Example:

  • A file is encrypted using AES-256 (DEK).
  • The AES key is then encrypted using an RSA public key (KEK).
  • The encrypted file and the encrypted AES key are stored in a database.

When decrypting:

  1. The RSA private key decrypts the encrypted DEK.
  2. The decrypted DEK is used to decrypt the data.

For secure key management, Tencent Cloud Key Management Service (KMS) can be used to store and manage the KEK, ensuring compliance and security. Tencent Cloud also provides Tencent Cloud COS (Cloud Object Storage) with built-in envelope encryption support, simplifying secure data storage.