# Encryption at Rest     

+ Envelope encryption
  + **Master Key:** The key to encrypt data keys
    + Management of master key can use `AWS KMS` or other external ways 
  + **Data Keys:** Each `SST` file is encrypted by its own data key which is generated by `TiKV` and stored in a dictionary file which is encrypted by the master key 
+ Configuration example:

```
~!@[security.encryption]@!~
data-encryption-method = "aes128-ctr"
data-key-rotation-period = "168h" # 7 days
...

~!@[security.encryption.master-key]@!~
type = "kms"
key-id = "0987dcba-09fe-87dc-65ba-ab0987654321"
region = "us-west-2"
endpoint = "https://kms.us-west-2.amazonaws.com"
```


------------------------------------------------------------