Layer 3 · Go deeper · 9 min
Go deeper
Size it, build it, then make the calls an interviewer will push you on.
Back of the envelope
Size it up
Tap through each step of the arithmetic.
How many KMS calls a second for 12,000 encrypted reads?
How long to re-wrap 200 million DEKs after a KEK rotation?
How fast does a stolen index key reverse a 12-digit ID index?
Build-up · 7 steps
Envelope encryption, write and read
A health-claims platform stores one claim PDF, then reads it back. Follow which keys cross the wire.
Step 1 of 7
Ask for a data key
The claims service calls GenerateDataKey on the tenant’s KEK, with the tenant and object ID as encryption context.
4 interview moments
You’re the candidate
The interviewer pushes on the hard parts. Pick an approach and see how it holds up.
Deep dive 1 of 4
Interviewer
“Your health-records database has TDE on. Security asks whether a stolen database password exposes diagnoses.”
Your move. Pick an approach:
Deep dive 2 of 4
Interviewer
“An attacker with database write access copies your encrypted PAN into their own row. What stops the app showing it to them?”
Your move. Pick an approach:
Deep dive 3 of 4
Interviewer
“An insurer leaves and asks for deletion, including from 35 daily snapshots and a data-lake export.”
Your move. Pick an approach:
Deep dive 4 of 4
Interviewer
“Support staff must look customers up by an Aadhaar-like ID that’s now encrypted with randomised AEAD.”
Your move. Pick an approach: