Documentation / Platform glossary / MEK / Master Key
A master encryption key sits above the wrapping layer, protecting or deriving the keys that wrap data keys. It adds an administrative boundary between the keys used in daily operations and the trust material at the top of the hierarchy.
Vendor terminology varies, but the role is consistent: an MEK does not encrypt content and usually does not wrap data keys directly. It protects or derives key encryption keys, one tier below the root of trust in a four-tier chain — root, MEK, KEK, DEK.
Two mechanisms are used. Protection means the MEK encrypts KEKs, so obtaining a KEK requires MEK access. Derivation means KEKs are computed from the MEK plus a context value such as a tenant identifier, so the KEKs need not be stored at all and can be regenerated deterministically.
The tier's purpose is separation of authority, not additional cryptographic strength. Wrapping keys are used constantly and touched by automated systems; the MEK is used rarely and administered under tighter control. Collapsing the two means every routine unwrap runs against the same key an administrator would use to rekey the hierarchy.
Whether the tier is warranted depends on the environment. Some architectures deliberately collapse MEK and KEK into one layer, which is a defensible simplification at small scale. Distinct tiers become worthwhile when different parties or automation levels need different authority, or when an auditor needs to see that routine and privileged key operations are separated.
The trade-off is real: each tier is another thing to manage, back up, and rotate. Tiers that exist without a corresponding authority boundary add operational surface and no security.
Security reviews ask how many key tiers exist and who can act at each. A named MEK layer demonstrates that privileged key administration is separated from routine encryption rather than sharing one credential.
The more useful question than tier count is which principals hold authority at each tier, since a hierarchy where one identity can act at every level provides fewer boundaries than the diagram suggests.
QueryTek separates routine key-wrapping authority from privileged key administration so that everyday encryption operations do not require apex key access. Tier counts, key identifiers, and administrative procedures are not published.
