What is envelope encryption?

Envelope encryption consists in encrypting with multiple layers of keys, a main cryptographic key (MCK) and a data key. It is a common security method in hybrid cryptosystems, within a cloud environment, and the foundation of all Key Management Services (KMS).

In the current version, a default MCK is created per account for OUTSCALE Object Storage (OOS), and managed by 3DS OUTSCALE. In a later version, you will be able to create and manage your own MCKs.

MCKs are created inside a security module where they are stored and never leave. This ensures the integrity of the MCKs and your data.

Data keys are created by generating a random string and encrypting it with a MCK. Data keys can then be used to encrypt your objects.

When you activate encryption on a bucket, OOS requests the generation of a data key by the default MCK of your account per new object uploaded.

For more information on bucket encryption and how to use it, see Using Bucket Encryption.