This article is intended to be a simplified explanation sans drill-down for people wanting to understand these concepts/terms.
What are DEK, KEK and MEK/Master key?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
DEK: Data Encryption Key
KEK: Key Encryption Key
Master Key: Generally will describe one of the two above keys. Depending on the scheme in which it is implemented.
This type of encryption scheme is often used for secure storage. Microsoft Windows is known to use this type of encryption scheme to protect user credentials and other types of data that are secured for a user.
Microsoft generates a Key Encryption Key using the user's password. This KEK is then used to encrypt what they call the Master Key. The Master Key is really a Data Encryption Key. It will be used to encrypt any data that is put in the user's protected storage.
Key management for Full Disk Encryption will also work the same way. The FDE software will randomly generate a DEK, then use the user's password/keyfile/smart card to create a KEK in order to encrypt the DEK. This mechanism allows the user to change their password without having to decrypt and re-encrypt the entire volume. Instead, the DEK is just re-encrypted with the new KEK.
Master keys as you hear them used in SSL/TLS or SSH are different. Generally speaking the shared secret with be mixed with a secure algorithm so that both parties can generate a Master Key. The Master Key is then used to generate the Encryption Keys, Integrity Keys, and Initialization Vectors for both sides of communication. Here is how those keys are derived for SSL/TLS.
This article is intended to be a simplified explanation sans drill-down for people wanting to understand the concept terms.
The terms are used in symmetric key cryptography.
DEK - Data Encryption Key The key used to encrypt the data
e.g. Key: 1234 with AES 128 as encryption algorithem - 1234 is the DEK
KEK - Key Encryption Key
e.g. Encrypt (from DEK above) 1234 with 9999; 9999 is the KEK
Master Key or MEK - Master Encryption Key
This key is used to encrypt/decrypt DEK and KEK in transit; usually used for KEK not for DEK.