Cryptography
Cryptography protects data with keys, so that only a holder of the right key can read or change it. A key service allows a limited number of calls, 10,000 per second for one part here. Envelope encryption seals each record with a local data key and asks the key service only to wrap that key.
See it on the board
The same traffic runs on two boards. The simulator measured both when this page was built.
| Measure | Goal | Each record calls the key service | Data keys kept in a local cache for 5 min |
|---|---|---|---|
| Error rate (*) | under 0.1% | 84.4% Fail | 0% Pass |
| p99 latency (Open) | under 60 ms | 10.1 s Fail | 33 ms Pass |
| p99 latency (Seal) | under 60 ms | 10.1 s Fail | 26 ms Pass |
| Monthly cost | 20 USD/mo | 24 USD/mo | |
| Error rate | 84.4% | 0% |
Key numbers
| Number | Value |
|---|---|
| Calls per second, one key service | 10,000 ops/s |
| Round trip to a key service in one zone | 0.5 ms |
| Read from a local in-process cache, median | 0.1 ms |
| Time a local cache keeps an entry, default | 60 s |
Envelope keys · < 1 key service calls/s · limit 10,000/s
How it works
Encryption at rest keeps stored data unreadable without the key. Encryption in transit, such as TLS, protects data on the network. Signatures and message codes prove that data did not change and show who made it.
The keys are more important than the algorithm. Keep master keys in a key service or a hardware module that never releases them. Rotate keys on a schedule and log each use, so that a leak has a limited reach.
A call to the key service for each record is slow and meets a rate limit. Envelope encryption solves this. The service makes a data key, encrypts the record with it in its own memory, and stores the data key only in wrapped form, encrypted by the master key. To read, it asks the key service to unwrap the data key once, and keeps the plain data key in a cache for a short time. The key service now gets one call for each data key, not one for each record.
The cache is a trade-off. A longer cache time means fewer calls, but a revoked key works longer. Keep plain data keys only in memory, never on disk.
In the levels you cache data keys locally so that the key service stays below its limit.