envelope encryption

term

cloudcryptography

Encrypting data with a data key, then encrypting that key with a master key - bulk work done locally, the crown jewel guarded centrally.

How clouds encrypt petabytes with keys that never leave the KMS: one API call per envelope, not per byte.