Symmetric encryption and the envelope pattern

Symmetric encryption uses one key to both encrypt and decrypt. It is fast and well understood. The hard part was never the algorithm; it is what you do with the key.

The naive design encrypts every secret with one master key. That fails in three ways: rotating the master means re-encrypting everything, the master must be in memory constantly, and one compromise exposes the entire store.

Envelope encryption solves this with two layers:

• A data encryption key (DEK): a fresh symmetric key generated per secret, used to encrypt just that value.
• A key encryption key (KEK): a long-lived key that encrypts (wraps) each DEK.
• Only the wrapped DEK is stored next to the ciphertext. The KEK never touches the data.

# Conceptually, writing a secret:
DEK        = random_key()
ciphertext = AES_GCM(DEK, plaintext)
wrapped    = AES_GCM(KEK, DEK)
store(ciphertext, wrapped)      # the DEK is never stored in the clear

# Reading it back:
DEK        = AES_GCM_decrypt(KEK, wrapped)
plaintext  = AES_GCM_decrypt(DEK, ciphertext)

The payoff is operational, and it is significant:

• Rotating the KEK means re-wrapping small DEKs, not re-encrypting terabytes of data.
• The KEK can live somewhere the application cannot reach: the next lesson's HSM.
• A leaked DEK exposes exactly one secret, because every secret has its own.
• Deleting a wrapped DEK makes its ciphertext permanently unreadable: cryptographic erasure without touching the data.