envelope encryption
also: digital envelope, key wrapping, hybrid encryption
A two-layer encryption scheme where data is encrypted with a symmetric key, and that key is itself encrypted with an asymmetric public key. This combines the speed of symmetric encryption with the key-distribution benefits of public-key cryptography.
Envelope encryption solves a practical problem: symmetric encryption (like AES) is fast but requires securely sharing a secret key, while asymmetric encryption (like RSA) handles key distribution easily but is too slow for large data.
The process works in two steps: First, encrypt your data with a randomly generated symmetric key (the "data encryption key"). Second, encrypt that symmetric key with someone's public key (the "key encryption key"). The recipient decrypts the symmetric key using their private key, then uses it to decrypt the actual data.
Example: You want to send a large file to a colleague. Generate a random AES key, encrypt the file with it, then encrypt the AES key with your colleague's public RSA key. Send both the encrypted file and encrypted key. They use their private RSA key to recover the AES key, then decrypt the file—all without ever exchanging the AES key over the network.