Key call per record vs envelope encryption
A key service call for each record hits the rate cap of the service. Envelope encryption asks for a data key once, keeps it in memory for a short time and seals many records with it. At 8,000 records/s against a cap of 2,000 calls/s, one call per record fails 84 percent. Data keys give p99 32.5 ms.
Envelope keys · < 1 key service calls/s · limit 10,000/s
Case 1
3,000 records/s are sealed and 5,000/s are opened. The key service allows 2,000 requests/s and is 8 ms away. Errors must stay below 0.1 percent and p99 below 60 ms.
| Measure | Goal | One key service call per record | Cached data keys |
|---|---|---|---|
| Error rate (*) | under 0.1% | 84.4% Fail | 0% Pass |
| p99 latency (Open) | under 60 ms | 10.1 s Fail | 33 ms Pass |
| p99 latency (Seal) | under 60 ms | 10.1 s Fail | 26 ms Pass |
| Monthly cost | 20 USD/mo | 24 USD/mo | |
| Error rate | 84.4% | 0% |