Envelope Encryption: Securing User Data with Layered Protection

Introduction

Data protection is a critical aspect of any authentication system. Ensuring user data remains encrypted and secure is essential to maintaining trust and compliance. In our system, we use Envelope Encryption, a layered encryption method that enhances security while maintaining efficiency. This blog explores how Envelope Encryption works, its key components, and how we implement it in our authentication server.

What is Envelope Encryption?

Envelope Encryption is a technique where data is encrypted using a Data Encryption Key (DEK), and then the DEK itself is encrypted using a Key Encryption Key (KEK). This approach provides an additional layer of security, ensuring that even if DEKs are exposed, they cannot be used without access to the KEK.

Key Terminology:

• DEK (Data Encryption Key): A unique key used to encrypt user data.
• KEK (Key Encryption Key): A separate key used to encrypt the DEK.

Encryption Workflow

Below is a step-by-step breakdown of how we implement Envelope Encryption in our authentication system:

Step 1: Assigning a Unique DEK

Each user is assigned a unique Data Encryption Key (DEK) when they sign up. This ensures that even if one user's data is compromised, other users' data remains secure.

Step 2: Encrypting User Data

All sensitive user data, including session details and password reset requests, are encrypted using the user's DEK with the AESGcm256 encryption algorithm. The encrypted data is then stored in the database.

Step 3: Generating a KEK

The authentication server has its own Key Encryption Key (KEK), which is unique to the server. This KEK is responsible for encrypting the DEKs.

How KEK is Generated and Used Internally

1. Key Generation: The KEK is generated using a cryptographically secure random number generator (CSPRNG) to ensure strong encryption.
2. Storage: The KEK is never stored in plaintext. Instead, it is either:
3. Access Control:
4. KEK Rotation:

Step 4: Encrypting the DEK with KEK

Once the KEK is generated, we use it to encrypt the DEK using the AESGcm256 algorithm. The encrypted DEK is then securely stored in the database. This ensures that even if the database is compromised, the actual DEKs remain protected.

Step 5: Decrypting Data Securely

When user data needs to be accessed:

1. The encrypted DEK is retrieved from the database.
2. The KEK is securely fetched from the Key Management System (KMS) or HSM.
3. The DEK is decrypted using the KEK.
4. The decrypted DEK is then used to decrypt user data.

This process ensures that KEKs are never unnecessarily exposed and remain in a highly controlled environment.

Step 6: Additional Security Measures

For added security, we recommend storing the KEK in a Key Management System (KMS) such as:

• Google Cloud KMS
• AWS KMS
• Azure Key Vault

These services provide an extra layer of protection by securing KEKs in a dedicated hardware security module (HSM) and enforcing strict access control policies.

Diagram Representation

Below is a visual representation of how Envelope Encryption secures user data:

Why Envelope Encryption?

🔐 Enhanced Security

Even if the DEK is exposed, it remains useless without the KEK.

📈 Scalability

Since each user has a unique DEK, large-scale systems can securely manage multiple encryption keys.

✅ Compliance

Aligns with industry standards such as GDPR, HIPAA, and PCI DSS.

⚡ Performance

Encrypting data with DEKs ensures faster encryption and decryption compared to using KEKs directly.

Conclusion

Envelope Encryption is a powerful method for protecting user data by layering encryption and securing encryption keys. By encrypting DEKs with KEKs, we ensure that sensitive user data remains protected even if some components of the system are compromised. This strategy enhances security, scalability, and compliance with modern data protection regulations.

Feedback & Contributions

If you have any feedback or suggestions, feel free to raise an issue or start a discussion in our repository. Your input is valuable in making our security measures even more robust!

🔐 Stay secure and keep encrypting! 🚀