Separating data-encryption keys from the keys protecting them can simplify lifecycle management. This is commonly called envelope encryption.
Evaluation approach
Document where data keys originate, how they are wrapped and when they can be unwrapped. Separate client and server responsibilities.
Application example
A suitable design may rotate wrapping protection without encrypting a large document again.
Limits and considerations
A key hierarchy does not correct improper authorization. Authorize every requested decryption.
Handling unwrapping failure
Do not fall back to plaintext when a key cannot be recovered. Classify errors and reauthenticate where appropriate. Understand recovery before migration to avoid data loss.
Checks and decisions
- Map the hierarchy
- Restrict unwrapping
- Test migration
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.