HSM Key Custody: Envelope Encryption & Rotation

Traffic Controls

Encryption request rate 1.5 /s

Key rotation interval 15 s

Unauthorized attempt rate 8 /min

Simulation speed 1.0×

Live Status

KEK version

Objects encrypted

Breaches blocked

Next rotation

15.0s

Audit Log

How it works

A Hardware Security Module (HSM) holds one long-lived master key — the Key-Encryption Key (KEK) — inside a tamper-resistant hardware boundary. The KEK itself never leaves that boundary in raw form; nothing outside can ever read it. Every object is protected by envelope encryption:

DEK      = random(256 bits)                 // fresh per object
ciphertext   = AES-GCM(DEK, plaintext)
wrapped_DEK  = AES-KeyWrap(KEK, DEK)          // computed INSIDE the HSM
store(ciphertext, wrapped_DEK, kek_version)   // raw DEK is zeroized

Only ciphertext and wrapped_DEK ever leave the boundary — never the raw DEK, and never the KEK. To decrypt later, the wrapped_DEK is sent back into the HSM, unwrapped internally, and the raw DEK exists only transiently in hardware memory.

Key rotation: on a schedule (or on demand), the HSM generates a new KEK version. Existing wrapped_DEKs are not re-encrypted all at once — they are lazily re-wrapped the next time each object is touched, while the previous KEK version is retained only long enough to unwrap old data, then destroyed ("crypto-shredding"). This bounds the blast radius of any single compromised key version.

Boundary enforcement: any attempt to extract the raw KEK — a malicious API call, a compromised host, physical probing — is rejected by the hardware itself and logged. This is the core guarantee behind AWS KMS, Google Cloud KMS, HashiCorp Vault's HSM backend and PKCS#11 devices: the key is used, never released.

Encryption request rate — how often new objects arrive needing a fresh DEK wrapped by the current KEK.
Key rotation interval — how often the HSM mints a new KEK version and lazily re-wraps a sample of stored keys.
Unauthorized attempt rate — simulated extraction attempts against the hardware boundary; every one is blocked and logged, since the KEK never leaves the module.

HSM boundary / KEK core Wrapped DEK → storage Blocked extraction attempt

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.