16

This article is intended to be a simplified explanation sans drill-down for people wanting to understand these concepts/terms.

What are DEK, KEK and MEK/Master key?

  • Totally confusing - isn't the DEK the same as the MEK? Surely only 2 keys are required, the AES256 key on the drive and the key held externally to encrypt the DEK/MEK? – user103144 Mar 2 '16 at 11:43
7

Secure Storage

DEK: Data Encryption Key
KEK: Key Encryption Key

Master Key: Generally will describe one of the two above keys. Depending on the scheme in which it is implemented.

This type of encryption scheme is often used for secure storage. Microsoft Windows is known to use this type of encryption scheme to protect user credentials and other types of data that are secured for a user.

Microsoft generates a Key Encryption Key using the user's password. This KEK is then used to encrypt what they call the Master Key. The Master Key is really a Data Encryption Key. It will be used to encrypt any data that is put in the user's protected storage.

Key management for Full Disk Encryption will also work the same way. The FDE software will randomly generate a DEK, then use the user's password/keyfile/smart card to create a KEK in order to encrypt the DEK. This mechanism allows the user to change their password without having to decrypt and re-encrypt the entire volume. Instead, the DEK is just re-encrypted with the new KEK.

Secure Protocols

Master keys as you hear them used in SSL/TLS or SSH are different. Generally speaking the shared secret with be mixed with a secure algorithm so that both parties can generate a Master Key. The Master Key is then used to generate the Encryption Keys, Integrity Keys, and Initialization Vectors for both sides of communication. Here is how those keys are derived for SSL/TLS.

2

This article is intended to be a simplified explanation sans drill-down for people wanting to understand the concept terms.

The terms are used in symmetric key cryptography.

DEK - Data Encryption Key The key used to encrypt the data

e.g. Key: 1234 with AES 128 as encryption algorithem - 1234 is the DEK

KEK - Key Encryption Key

e.g. Encrypt (from DEK above) 1234 with 9999; 9999 is the KEK

Master Key or MEK - Master Encryption Key

This key is used to encrypt/decrypt DEK and KEK in transit; usually used for KEK not for DEK.

  • So you encrypt DEK with KEK which was encrypted under MEK? Personally, I've never seen this constuction (you've got a sample reference mentioning all threee acronyms?). The usual procedure is to agree on a shared secret (using DH), derive a key from this and use this for bulk encryption. – SEJPM Jul 14 '15 at 12:37
  • you use MEK agree on MEK then use it to distribute KEK. – Erez Jul 15 '15 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.