On this page
Envelope encryption is the practice of encrypting data with one key, called a data key, and then encrypting that data key with a second key, so that access can be granted or changed by handling the small wrapped key rather than re-encrypting all the data.
How it works
- Data encryption key (DEK). A random symmetric key that encrypts the actual content. It can be large in number: one per file, per record or per version.
- Key encryption key (KEK). A key that encrypts, or wraps, the DEK. The wrapped DEK is stored next to the ciphertext.
To read the data, a client first unwraps the DEK with the KEK and then decrypts the content. Google Cloud KMS documentation uses this pattern so that the central key service only ever handles small keys, while bulk data is encrypted locally.
Why it is useful
- Cheap sharing. To give a second person access, wrap the same DEK with their key. The data stays as it is.
- Cheap removal. To remove someone, stop giving them the wrapped key and, for real protection of future data, switch to a new DEK.
- Separation of duties. The service that stores ciphertext does not need to hold any key that opens it.
How Crunu uses it
In Crunu, every environment, such as payments-api / production, has its own environment key. That key encrypts the environment's files with AES-256-GCM. It is then sealed separately to the public key of every recipient: each member with access, each machine and each service token, plus the organization recovery key for shared environments. Sealing uses X25519 in a sealed-box construction, so only the matching private key can open it.
The list of recipients is itself a signed document. A server cannot add its own key to the list without the signature failing on every client.
Two consequences follow:
- Granting access means sealing one more copy of the environment key, done on the admin's device.
- Removing a key holder is followed by rotation: a new environment key is created and sealed to the remaining recipients, so new versions are unreadable to the removed party.
Machines can also receive Selected files, a sealed copy of only certain files, instead of the full environment key. That copy can be revoked without rotating the key. See roles and how encryption works.
Sources
- Google Cloud KMS: Envelope encryption, checked October 27, 2026.
From the blog
Security
Audit logs you can verify: how hash chains work
An audit log is only evidence if nobody can quietly edit it. How hash chains make tampering visible, what they miss, and how to check an export yourself.
Security
Why a vault vendor can’t reset your password
With a password and a Secret Key, nobody at the vendor can open your account, or reset it. How the Emergency Kit works, and what to do when something is lost.