Encryption

A retrospective on column-level encryption of sensitive data in a running service. Envelope encryption, DEK granularity decisions, the WHERE clause constraint that led to HMAC, and the migration automation Skill that spread the work across the org.

How the CMK/DEK two-tier key structure in envelope encryption limits key leak impact and simplifies key rotation.

TLS builds a secure channel over an untrusted network by providing confidentiality, integrity, and authentication. A walkthrough of symmetric/asymmetric hybrid encryption, the TLS 1.2 handshake, the certificate and PKI trust model, and what TLS 1.3 improved.