key wrapping
also: key encryption, KEK (Key Encryption Key)
Key wrapping is a cryptographic technique that encrypts an encryption key (called a key encryption key or KEK) using another key, protecting the key from disclosure while allowing secure storage and transmission.
Key wrapping is the process of encrypting a sensitive cryptographic key with another key (the key encryption key or KEK) to protect it from unauthorized access. The wrapped key can be safely stored in databases, configuration files, or transmitted over networks without exposing the underlying key material.
The wrapped key is typically stored alongside metadata about the wrapping algorithm and key identifier. When the wrapped key is needed, it must be unwrapped (decrypted) using the KEK. This separation allows organizations to protect keys at rest while maintaining the ability to use them when needed.
A practical example: a database encryption key might be wrapped with a master key stored in a hardware security module (HSM). The wrapped database key can be safely backed up or replicated to other servers, but cannot be used without access to the master key in the HSM.