My customer wants my organisation to evolve their system such that keys currently used to protect the confidentiality of other keys during transport are also used to protect data confidentiality in the same message. I suspect this might be a bad idea, but is that generally true in all cases, and if so why?
The KEKs are protecting keys being sent to the recipient in the present message. It is a layered key model; it doesn't matter what the transmitted keys are used for. The same message is sent to multiple recipients, but only a subset are permitted to access the keys it contains. My organisation is requested to use the same KEK to protect certain data in the message as well. As for the keys, only a subset of recipients are permitted to access that data. The point of the question is whether the protection of the data should be a separate concern from the protection of the keys.
More formally (as requested):
- A posts message M to a public place where it can be retrieved by recipients B, C and D.
- Message M contains sub-messages Mb, Mc and Md intended only for the corresponding recipient, B, C or D respectively.
- Key Encryption Keys Kb, Kc and Kd have previously been issued to B, C and D via an offline medium.
- Each sub-message Mn contains an encrypted key intended for recipient N, K'n, protected by the KEK previously issued: E(K'n, Kn).
- Each sub-message Mn also contains plain text data, Di, intended for recipient I but currently readable to the other recipients. Under this evolution, this will be replaced with E(Dn, Kn).
So: A --> B, C, D: M
M = E(K'b,Kb) + E(K'c,Kc) + E(K'd,Kd) + Db + Dc + Dd
and after the evolution:
M = E(K'b,Kb) + E(K'c,Kc) + E(K'd,Kd) + E(Db, Kb) + E(Dc, Kc) + E(Dd, Kd)