In storage encryption, the private key used to encrypt the symmetric bulk MEK (Media Encryption Key) is called what?

In storage encryption, the private key used to encrypt the symmetric bulk MEK (Media Encryption Key) is called what?

• A. Public Key Infrastructure (PKI)
• B. Initialization Vector (IV)
• C. Opal
• D. Key Encryption Key (KEK)

Answer: (D)

In storage encryption, a two-tier key setup is used: the data is encrypted with a symmetric key (the Media Encryption Key), and that bulk MEK is itself protected by another key called a Key Encryption Key. The KEK wraps or encrypts the MEK so that the actual data keys aren’t exposed if the storage is accessed. In many implementations, the KEK is managed with a public/private key pair—typically the public key wraps (encrypts) the KEK, and the private key unwraps (decrypts) to recover the MEK when needed. So the key used to protect the symmetric bulk MEK is the Key Encryption Key. The other terms don’t describe this wrapping role: PKI is a framework for keys and certificates, an initialization vector is just a cipher parameter, and Opal is a self-encrypting drive standard.

In storage encryption, a two-tier key setup is used: the data is encrypted with a symmetric key (the Media Encryption Key), and that bulk MEK is itself protected by another key called a Key Encryption Key. The KEK wraps or encrypts the MEK so that the actual data keys aren’t exposed if the storage is accessed. In many implementations, the KEK is managed with a public/private key pair—typically the public key wraps (encrypts) the KEK, and the private key unwraps (decrypts) to recover the MEK when needed. So the key used to protect the symmetric bulk MEK is the Key Encryption Key. The other terms don’t describe this wrapping role: PKI is a framework for keys and certificates, an initialization vector is just a cipher parameter, and Opal is a self-encrypting drive standard.