I'm reading up on the AWS Encryption SDK (JavaScript flavor but this is the same for Python and Java, and my question is really on the underlying security principles, which are language agnostic). On that page there is a paragraph under "Step 1: Construct the keyring" that explains several concepts that are eluding me for some reason (maybe I am simple, as my wife often points out):
"When encrypting with an AWS KMS keyring, you must specify a generator key, that is, an AWS KMS key that is used to generate the plaintext data key and encrypt it. You can also specify zero or more additional keys that encrypt the same plaintext data key. The keyring returns the plaintext data key and one encrypted copy of that data key for each AWS KMS key in the keyring, including the generator key. To decrypt the data, you need to decrypt any one of the encrypted data keys."
First and foremost, I'm not understanding what they mean by plaintext data key. They use it freely in that document without defining it anywhere (as far as I can tell). Is that the same as the plaintext that we need to encrypt? Either way, what is the advantage of a generator key that generates encryption keys and all these optional additional keys? What is to be gained here beyond just having a single symmetric key, doesn't it convolute key management? I am sure there are very good and sound reasons for all these generated, duplicated keys, but I'm not just seeing it.
So to wrap all this up into a single, answerable question: can someone please help me understand all the concepts in that paragraph, and understand why AWS is using all of these different keys and copies, and what I'm supposed to with all of them? Thanks in advance for any-and-all help. Super double dog bonus points for anyone whose willing to explain it to me like I'm 5.
