--- title: Cryptography and Key Management Explained | Lattix description: How encryption, key custody, envelope encryption, and integrity proofs make data protection portable. Reference guidance on crypto agility and FIPS 140-3. source: "https://lattix.io/blog/topics/cryptography/" content-type: text/markdown --- # Cryptography and Key Management Explained | Lattix [Blog](https://lattix.io/blog/) [Topics](https://lattix.io/blog/topics/) Cryptography and Key Management Topic # Cryptography and Key Management Key custody, envelope encryption, algorithm agility, and integrity: the cryptographic machinery that makes protection travel with the data object. 6posts Cryptography in a data-centric architecture is the use of encryption, key management, and digital signatures to make protection travel with the data object itself. Encryption controls who can read a payload, signatures and hashes prove it has not changed, and key custody determines who can revoke access after distribution. Together they turn policy into cryptographic enforcement rather than a setting on a server. Key custody is where designs break. Envelope encryption wraps each object's data encryption key under a key encryption key, which is correct, but many deployments then hand both the ciphertext and the wrapping key to the same operator, returning control to whoever runs the storage. Algorithm agility is the second gap: an architecture that hardcodes a cipher into stored formats cannot rotate without rewriting every object. Posts under this hub cover who should hold keys and why, envelope encryption hierarchies, integrity through Merkle-tree lineage, confidential computing as a complement to object-level encryption, and the cryptographic expectations written into sector rules such as PCI DSS 4.0.1 and the proposed HIPAA Security Rule update. ## Frequently asked questions ### Who should hold the encryption keys in a data-centric architecture? The data owner should hold the key encryption keys, and the party storing or processing ciphertext should not. Separating custody from storage means a compromised platform yields unreadable bytes. In practice that means customer-held key encryption keys, per-object data encryption keys wrapped under them, and a key service that stays fail-closed when it cannot reach the policy decision point (PDP). ### What is envelope encryption? Envelope encryption encrypts each data object with its own data encryption key, then encrypts that key under a longer-lived key encryption key held in a hardware security module or key service. Rotating the outer key rewraps small keys instead of re-encrypting terabytes, and revoking access means refusing to unwrap, which works even for copies already distributed. ### What is crypto agility? Crypto agility is the property that lets a system change algorithms, parameters, or key sizes without redesigning it. It requires algorithm identifiers carried in metadata rather than assumed, an inventory of where cryptography runs, negotiated rather than hardcoded cipher suites, and key hierarchies that support rewrapping. Systems built this way absorb the post-quantum transition as a configuration change. ### What does FIPS 140-3 validation cover? FIPS 140-3 specifies security requirements for cryptographic modules: approved algorithms, key management, physical protection, self-tests, and operator roles. Validation applies to the module and its declared boundary, not to the product around it, so a validated library inside an unvalidated workflow proves little. Check the certificate's boundary and version before treating it as evidence. ## Reading on cryptography and key management [![Lattix branded cover for the NIST round three additional post-quantum signature schemes analysis. /28 section number, IBM Plex Mono on dark grid background, the May 14 2026 round-three date, nine advancing schemes with HAWK struck out after its July 29 2026 withdrawal, and a lineage strip showing signature agility at the policy enforcement point highlighted in surgical yellow.](https://lattix.io/images/blog/nist-round-3-additional-pqc-signatures-lineage-agility-cover.svg) NIST's Round-Three Signature Field Lost HAWK. Lineage Needs the Agility. August 21, 2026 NIST advanced nine signature candidates to round three on May 14, 2026. One, HAWK, was withdrawn on July 29 after a key-recovery attack. The signature track is the data provenance problem, and agility is now demonstrated rather than theoretical. Read More →](https://lattix.io/blog/nist-round-3-additional-pqc-signatures-lineage-agility/) [![Lattix branded cover for PCI DSS 4.0.1 Requires Cryptographic Agility. /27 section number, March 2025 binding date, twelve future-dated requirements statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the PCI requirement in a control flow strip.](https://lattix.io/images/blog/pci-dss-4-0-1-cryptographic-agility-cardholder-data-cover.svg) PCI DSS 4.0.1 Requires Cryptographic Agility. Cardholder Data Architectures Have to Move. June 11, 2026 PCI DSS 4.0.1 effective April 2024 introduced future-dated cryptographic requirements that bite in 2025 and 2026. Cardholder Data Environments tightly coupling crypto to application code cannot migrate inside the PCI assessment window. Data-centric encryption is the architectural path. Read More →](https://lattix.io/blog/pci-dss-4-0-1-cryptographic-agility-cardholder-data/) [![Lattix branded cover for NIST IR 8547 Sets the PQC Migration Floor. /26 section number, 2027 binding window date, federal civilian migration cohort statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the migration milestone in a timeline strip.](https://lattix.io/images/blog/nist-ir-8547-pqc-migration-mid-2026-status-cover.svg) NIST IR 8547 Sets the PQC Migration Floor. The Calendar Bites in 2027. June 9, 2026 NIST IR 8547 establishes the federal post-quantum migration timeline. Mid-2026 progress data shows the schedule is tighter than most program offices have modeled. FIPS 140-3 module validation backlog compounds the risk. Cryptographic agility patterns are the schedule mitigation. Read More →](https://lattix.io/blog/nist-ir-8547-pqc-migration-mid-2026-status/) [![Lattix branded cover for The HIPAA Security Rule NPRM Demands Cryptographic Safeguards the Current Rule Only Implies. /21 section number, December 2024 NPRM date and 4,700 comments statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the encryption requirement node in a safeguard map strip.](https://lattix.io/images/blog/hipaa-security-rule-nprm-cryptographic-safeguards-cover.svg) The HIPAA Security Rule NPRM Demands Cryptographic Safeguards the Current Rule Only Implies May 15, 2026 HHS issued the first major HIPAA Security Rule update since 2003 in December 2024. OCR targets May 2026 for the final rule, with 4,700 comments under review. The NPRM raises the bar on encryption, MFA, inventory, and audit. The architecture window is shorter. Read More →](https://lattix.io/blog/hipaa-security-rule-nprm-cryptographic-safeguards/) [![Lattix branded cover for Confidential Computing and Data-Centric Zero Trust. /07 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/confidential-computing-meets-data-centric-security-cover.svg) Confidential Computing and Data-Centric Zero Trust: Composable Protection May 8, 2026 Trusted execution environments protect data in use. Zero trust data fabrics protect it at rest and in transit. Together, they create architectural closure across all three states. Read More →](https://lattix.io/blog/confidential-computing-meets-data-centric-security/) [![Lattix branded cover for key management in data-centric security. /13 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/key-management-data-centric-security-cover.svg) Key Management in Data-Centric Security: Who Holds the Keys May 8, 2026 A wrapped data object is only as secure as the policy authority that releases the key. Key management is where data-centric security becomes operational reality. Read More →](https://lattix.io/blog/key-management-data-centric-security/) ## Related topics - [Zero Trust Architecture](https://lattix.io/blog/topics/zero-trust/) - [Data Security](https://lattix.io/blog/topics/data-security/) - [Zero Trust Data Format](https://lattix.io/blog/topics/ztdf/) - [Access Control](https://lattix.io/blog/topics/access-control/) - [AI Security](https://lattix.io/blog/topics/ai-security/) - [Post-Quantum Cryptography](https://lattix.io/blog/topics/post-quantum-cryptography/) [All topics →](https://lattix.io/blog/topics/)