Technical dictionary
Envelope encryption
Data encrypted with a DEK; DEK wrapped by a KEK in KMS/HSM—common cloud pattern.
Definition
Envelope encryption uses a data encryption key for bulk data and wraps that key with a key encryption key stored in KMS or HSM.
Symmetric DEKs at AES-256-class strength are relatively robust vs Shor; wrapping and access policies still need review, especially if public-key wraps are used.