We are building a system, where the messages between services is encrypted with Data Encryption Key (DEK).

The DEK is attached to the message, but encrypted with another key, Key Encryption Key (KEK). This way it's easy to rotate DEK's or even generate new one for every message, where as KEK's are rotated considerably less frequently. KEK's are distributed between the participating systems in advance. KEK's may be also rotated, which requires each service to re-encrypt all stored DEK's with the new KEK.

Is there a name for this scheme? I'm trying to search for more information and concrete examples about the approach, but there seems to be very limited amount of information available. Where I can find more information about this scheme?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.