Lion Cipher Lab
Envelope encryption for free: run your own KMS with Vault's transit engine
- Cloud Security
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Almost every serious system you will ever touch encrypts its data with envelope encryption, and almost nobody can explain it. S3, EBS, RDS, BigQuery, Azure Storage, Kubernetes secrets-at-rest, backup tools, disk encryption — all of them generate a throwaway key for the data and then encrypt that key with a key they never let out of a vault. If you cannot draw that two-layer picture, cloud encryption questions in interviews go badly and, worse, you will design something that either leaks keys or falls over under load. The reason this is normally hard to learn is money: a cloud KMS key costs a…
What you'll learn
- what a KMS is and what 'encryption as a service' means
- running Vault's transit secrets engine in Docker
- reading a versioned ciphertext (the vault:v1: prefix)
- envelope encryption end to end: DEK, KEK, wrapping, unwrapping
- generating a data key and encrypting a real file with openssl
- key rotation, rewrap, and min_decryption_version
- crypto-shredding as the honest way to delete backed-up data
- mapping the model onto AWS KMS, Google Cloud KMS and Azure Key Vault
- knowing when a KMS is the wrong answer
Steps in this lab
- What a KMS is, and why we are faking one on your laptop
- Start a Vault dev server in Docker (and understand what you just accepted)
- Enable transit, make a key, and encrypt something small
- Hit the wall on purpose: try to push a big file through the KMS
- Envelope encryption, done properly — the vocabulary and then the deed
- Get it back: unwrap the data key and decrypt the file
- Rotate, rewrap, retire — the part almost no tutorial teaches
- Translate it: the same six moves in AWS, Google Cloud and Azure
- Why this, not that — when a KMS is the wrong answer
- Clean up, and what you should be able to draw now