Google is advertising the use of Envelope Encryption in their products with their KMS. By the description, it sounds very much like Hybrid Encryption. But since I could not find any reference to Hybrid Encryption, I wonder if there might be a difference in the idea behind it.

Source: https://cloud.google.com/kms/docs/envelope-encryption

  • 3
    $\begingroup$ The spirit is similar but usually people only use the term hybrid encryption if asymmetric and symmetric cryptography is involved whereas in this case only symmetric cryptography is involved. $\endgroup$ – SEJPM Dec 10 '19 at 9:36

Hybrid encryption refers to an implementation of a public-key encryption interface by the composition of a public-key primitive to encapsulate a symmetric key that's used with a symmetric algorithm to encrypt the actual messages. The motivation is that public-key primitives don't perform nearly as well as symmetric ones, so this hybrid encryption optimizes performance by minimizing the use of the former.

In the sense that the Google cloud (and AWS) use the term envelope encryption, there's a difference both in the mechanics and the motivation:

  • Envelope encryption doesn't require the use of public key cryptography; normally instead it uses symmetric Key Encryption Keys (KEKs, also often labeled "master keys") to encrypt also symmetric Data Encryption Keys (DEKs).
  • The motivation is not performance like it is with hybrid encryption, but rather key management. Google and AWS promote envelope encryption in connection with their Key Management System services (KMS) that generate and managed master keys internally, and are designed not to allow export of said keys, but rather to require clients to submit messages to the service for decryption/encryption. The intended use of this is that the KMS manages your KEKs, and the clients ask it to encrypt and decrypt DEKs with it. And the point of this is to avoid an architecture where you deploy a copy of the same symmetric master key to lots of hosts in your network, increasing the risk that this key will be exposed by a compromise of one of the servers.

So there is a similarity in that short-term symmetric data keys are getting encapsulated with some sort of long-term key, but what sort of long-term key is assumed is different, and the goal of the constructions isn't the same.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.