CyberGlossary

Cryptography

Master Key

Also known as: Root key, Master encryption key (MEK)

Definition

A high-value long-term key from which other cryptographic keys are derived or which directly encrypts other keys.

A master key is a long-lived cryptographic key whose primary role is to generate, protect, or wrap other keys rather than to encrypt user data directly. Common patterns include using a master key as a Key Encryption Key (KEK) that wraps short-lived Data Encryption Keys (DEKs) in envelope encryption schemes (AWS KMS, GCP KMS, Azure Key Vault), as the seed for a hierarchical KDF (HKDF "master secret", BIP32 wallet master keys), or as the database master key in TDE-style systems. Because compromising the master key compromises everything it protects, master keys are stored in HSMs, TPMs, or secure enclaves, used only for short cryptographic operations, rotated according to documented cryptoperiods, and access is restricted by strict authentication and audit policies.

Examples

  • An AWS KMS customer master key (CMK) wraps data keys used by S3 server-side encryption.
  • A BIP32 hierarchical-deterministic wallet derives all account keys from a single master seed.

Related terms