This answer seems to suggest that the KEK (Key Encrypting Key) can be used to securely encrypt data. Why have a DEK (Data Encryption Key) at all?

  • 3
    KEK allows you to change keys without re-encrypting the data.
    – defalt
    Jan 4, 2023 at 16:58
  • Welcome to the community. I would recommend adding your use case and some background for a more clear and focused answer. Jan 4, 2023 at 19:18

2 Answers 2


You need the two. You create a random symmetric key (the DEK), encrypt all data with it. You create a keypair (the KEK) and use it to encrypt the DEK. You store both the data and the encrypted DEK together.

When you try to decrypt something, you first use the KEK to decrypt the encrypted DEK, and use the DEK to decrypt the data.

Two main reasons:

  • The DEK is a symmetric key: that means encryption and decryption will be way faster than using an asymmetric key.

  • The DEK never changes: you don't want to re-encrypt every single file, so you don't change the DEK.

  • You may want to change the KEK: if your KEK expires, got compromised, or you transfer ownership of the data to someone, you can re-encrypt the DEK with another key.

That's how Full Disk Encryption works. Imagine changing the password of the FDE and having to decrypt and re-encrypt the entire disk...

  • What system uses a keypair for KEK? I thought that was also a symmetric key. (The indirection provided by the two separate keys is still important because of your second and third bullets.)
    – Ben Voigt
    Jan 6, 2023 at 22:22
  • @BenVoigt: Within full-disk encryption, I remember PGP 8.x used to have "PGPdisk" FDE which used your PGP keypair as the KEK; for file-level encryption, Windows' EFS uses a per-user X.509 RSA certificate (usually self-signed). Both allow granting access to multiple users.
    – grawity
    Jan 8, 2023 at 9:27

A KEK enables separation of duties.

Managing sensitive data, such as customer credit cards or bank balances, is not a trivial task. It starts with people who own the sensitive data wanting to encrypt their data, and only to decrypt it when there's a business need to do so. The data owners want to govern exactly who can access their data; who can encrypt new information, and who can decrypt old information. They want a log of the users so that if something goes awry they can identify who had access and when. And they want the people and systems who manage those keys to not have access to their sensitive data.

Separation of duties is an assignment of roles such that no one person has unfettered access to the protected data. If someone wants to steal the data, they have to collude with other people to make it happen. So the data owner assigns one person (or team) the tasks of handling the sensitive data, and a different person (or team) handles the keys.

A key custodian is a person who holds the keys on behalf of the key owners. They use a KEK to encrypt and decrypt DEKs that belong to the key owners. A key owner then grants access to their DEK to a key user, who is someone authorized by the key owner to use the key to do their day job.

This is not quite as simple as keeping the keys locked in a safe.

KEKs are usually stored inside a Hardware Security Module (HSM), which is a tamper-sensitive dedicated cryptographic computer module that will erase the KEK if it detects an attack. An HSM is designed to keep the KEK internally secured, never exporting it from the secure environment. To use it, you authenticate to it, pass in an encrypted DEK, and it returns the unencrypted DEK.

(A YubiKey is an example of a small personal HSM that protects your passwords instead of DEKs. So-called "enterprise grade" HSMs are usually expensive rack mounted devices that are locked in special cages inside corporate data centers.)

This arrangement allows the key custodian to manage the database of encrypted keys, where all users are authenticated, all access is logged, and everything that the administrator uses to manage the keys is only handling encrypted DEKs. The HSM is often initialized by a different set of people with various roles such as the Hardware Owner, Security Officer, and/or Crypto Officer, all of whom have to gather around a PIN Entry Device to unlock it during an elaborate ceremony. The custodian who manages the database is then a Crypto User, and is granted permission to access the KEK after they've unlocked it.

All this together is called a Key Management system, and they are commonly used by banks, financial institutions, and large corporations. The key custodians then operate the key management system on behalf of the key owners.

The key user first authenticates to the key management system using something much less elaborate than the PIN Entry Device, such as their corporate credentials. They then have access to certain keys in the key manager, and can use them only to encrypt or decrypt data, or to sign documents, depending on the rights the key owner grants them. Optionally the key owner might grant someone permission to export a copy of their DEK so they can do the cryptography remotely, but this risks exposure of the DEKs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .