Mental model#
Encryption in transit protects data between endpoints; encryption at rest protects stored media or objects. Neither substitutes for authorization, integrity-aware protocols, key isolation, field minimization, or application-layer controls while data is in use.
Mechanism and state flow#
- Classify the data, threat, lifetime, and locations where plaintext must exist.
- Use an authenticated transport protocol for each untrusted hop.
- Encrypt storage with keys separated from the ciphertext and identities constrained to needed operations.
- For especially sensitive fields, consider application-layer encryption with explicit search and rotation limits.
- Version algorithms and keys, rotate through a tested migration, and audit decrypt operations.
Concrete example#
Encrypt customer exports without making every service a decryptor
The export worker writes an encrypted object using a scoped key operation. The download service authorizes the user and returns short-lived access; analytics jobs cannot decrypt the export merely because they can list object metadata.
Architecture consequence: Separate storage access from key use and design the plaintext boundary around the smallest necessary worker set.
Scaling and operational trade-offs#
| Option | Choose when | Cost or limit |
|---|---|---|
| Storage-layer encryption | Protect disks, snapshots, and object media with broad compatibility. | The storage service or host can still see plaintext during authorized use. |
| Application-field encryption | A sensitive field must remain opaque to shared storage operators. | Search, indexing, rotation, and application key access become harder. |
| One shared key | Avoid for mixed tenants and data classes. | One compromise has a large blast radius and rotation is disruptive. |
Failure diagnosis#
- Failure
- Ciphertext and its only decryption key are backed up together without recovery testing.
- Impact
- A compromise exposes both, or key loss makes the backup permanently unreadable.
- Detection
- Recovery exercises cannot restore with independently controlled key material.
- Mitigation
- Separate key controls, protect recovery material, version envelopes, and test restore plus rotation.
- Trade-off
- Independent key recovery adds governance and emergency-access procedures.
Checklist exercise#
Work the scenario before revealing your answer
- Mark plaintext, ciphertext, key, and identity at each system boundary.
- Compare at-rest, transport, and application-layer encryption for one sensitive field.
- Design rotation so old and new data remain readable during migration without an all-powerful permanent key.
Use these prompts to extend the design. The useful answer is a reasoned change, not a memorized sentence.
- Which threat does this encryption address?
- Where is plaintext still visible?
- Who can invoke decrypt and how is that audited?
- How do backup restore and key rotation interact?
Related practice problems
Use the manifest-backed prompts below to apply this lesson in a complete design.
Sources reviewed 2026-09-04. Product-specific controls and threat assumptions still require current verification.