VEYRNOX · Learn · KEK (Key Encryption Key)
KEK (Key Encryption Key)
A KEK — Key Encryption Key — is a cryptographic key used to encrypt other keys rather than user data directly. KEKs are the standard way to protect a master secret without exposing it to the operating system.
How it works
The KEK is generated in hardware (Secure Enclave, StrongBox, TPM) and is never released to app memory. Sensitive keys — the wallet seed, Shamir shards, private material for signing — are stored on disk in ciphertext, encrypted under the KEK using an authenticated cipher such as AES-256-GCM. When the app needs to use a wrapped key, it passes the ciphertext to the hardware, which unwraps under biometric or PIN gating and returns the plaintext to a memory region cleared immediately after use. The KEK itself lives in hardware for the device lifetime.
Why it matters
Separating the encryption key from the data being encrypted means a memory dump or disk snapshot cannot recover the sensitive material without the hardware. It also allows fast key rotation — rewrapping data under a new KEK is far cheaper than re-encrypting every ciphertext with a new user-derived key.
Related concepts
- iOS Secure Enclave — The Secure Enclave is a dedicated security coprocessor in Apple silicon (A7 and later, all M-series) that generates and stores cryptographic keys in hardware.
- Android StrongBox — StrongBox is a tamper-resistant hardware element on modern Android devices that backs the Android Keystore.
- AES-256-GCM — AES-256-GCM is Advanced Encryption Standard with a 256-bit key in Galois/Counter Mode.
- Argon2id — Argon2id is a memory-hard password-hashing function and the winner of the 2015 Password Hashing Competition.
Frequently asked questions
Is the KEK the same as the wallet seed?
No. The KEK encrypts the seed and other keys; it never represents on-chain identity itself.
What happens if the KEK is lost?
The wrapped data becomes unrecoverable without the KEK. Veyrnox provides Shamir shard recovery for exactly this scenario.
Is KEK/DEK separation an industry standard?
Yes. Envelope encryption with a KEK protecting per-record DEKs is standard practice in AWS KMS, GCP KMS, HSMs, and mobile wallet design.
In Veyrnox
Every Veyrnox vault is protected by a Secure Enclave–bound KEK. Shamir shards on the personal cloud are KEK-encrypted before upload, so a compromised cloud account cannot reveal shard content. See no seed phrase wallet for the full architecture.