Background & Motivation

Terms

• Data Encryption Key (DEK) - the encryption key used to encrypt data.
• Key Encryption Key (KEK) - the encryption key used to encrypt a DEK.
• Wrap / Unwrap - the process of using a KEK to encrypt / decrypt a DEK.

The local KMS provider wraps DEKs in _kms_start and unwraps DEKs in _decrypt_with_local_kms

The KMIP KMS provider will need to perform the same functions with a KEK obtained from a KMIP server.

Scope

Move the key wrap and unwrap functions to a common place for to be used by the KMIP KMS provider in MONGOCRYPT-333.