In storage encryption, the private key used to encrypt the symmetric bulk MEK is the Key Encryption Key (KEK). Which option best describes its role?

In storage encryption, the private key used to encrypt the symmetric bulk MEK is the Key Encryption Key (KEK). Which option best describes its role?

• A. Media Encryption Key (MEK)
• B. Initialization Vector (IV)
• C. Public Key Infrastructure (PKI)
• D. Key Encryption Key (KEK)

Answer: (D)

Key concept: key wrapping in envelope encryption. In storage encryption, data is encrypted with a data encryption key (the MEK). To protect that MEK itself, a Key Encryption Key (KEK) is used to wrap or encrypt the MEK. The KEK stays protected somewhere secure, and only by using the KEK can you unwrap the MEK to decrypt the data. This separation lets you rotate or manage the MEK without touching the actual data, and it adds an extra layer of security because compromising the MEK alone isn’t enough—you also need access to the KEK to unwrap it. The MEK is the key that directly encrypts the data, so it isn’t the wrapping key itself. The Initialization Vector is a parameter used with the encryption algorithm, not a key management function. PKI is about managing certificates and public/private keys in a broader framework, not the act of wrapping the data key. The KEK is the wrapping key, whose role is to protect the MEK by encryption.

Key concept: key wrapping in envelope encryption. In storage encryption, data is encrypted with a data encryption key (the MEK). To protect that MEK itself, a Key Encryption Key (KEK) is used to wrap or encrypt the MEK. The KEK stays protected somewhere secure, and only by using the KEK can you unwrap the MEK to decrypt the data. This separation lets you rotate or manage the MEK without touching the actual data, and it adds an extra layer of security because compromising the MEK alone isn’t enough—you also need access to the KEK to unwrap it.

The MEK is the key that directly encrypts the data, so it isn’t the wrapping key itself. The Initialization Vector is a parameter used with the encryption algorithm, not a key management function. PKI is about managing certificates and public/private keys in a broader framework, not the act of wrapping the data key. The KEK is the wrapping key, whose role is to protect the MEK by encryption.