Let's consider two Encryption keys:
KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be decrypted using KEK.
Based on the above concept, my doubts are:
Do we need to send the Encrypted DEK to the HSM for decrypting it or Do we need to decrypt the KEK and retrieve it from HSM ?
I just want to know the key encryption and decryption process flow, while using HSM.
Also provide any helpful links.