How the primitives come together in production

Every cloud KMS — AWS KMS, GCP Cloud KMS, Azure Key Vault, HashiCorp Vault — uses the same pattern to encrypt data without ever moving your master key. Here's why, and how it actually works.

Envelope encryption covers wrapping a key with your own KMS. This is about the broader problem: getting a key from one system, person, or organization to another — without it ever existing in the clear outside a trust boundary.

Wrapping and unwrapping keys, covered so far, all happens somewhere. PKCS#11 is the standard interface that lets an application talk to that somewhere — an HSM, a smart card, a USB token — without caring which vendor built it.

The X.509 module covers what's inside one certificate and how a chain verifies. This is the other half: how an organization actually runs the CA hierarchy that issues, automates, and eventually retires millions of them.

"Just use OAuth" conflates three different standards solving three different problems. Here's what each one actually does, how they relate to the JWTs you already know, and where passkeys fit in.

How a card PIN is packaged, encrypted at the point of entry, and re-encrypted hop by hop across acquirer, network, and issuer — without ever existing in the clear outside a hardware security module.

How the card verification value printed on the back of a card is generated, why the magstripe and card-not-present versions deliberately don't match, and why PCI DSS treats storing it as an absolute rule, not a guideline.

How a chip card and an issuer's host cryptographically prove to each other that they're both genuine, transaction by transaction — using a key that exists nowhere outside that one card and a cryptogram that's never reused.

Card-not-present purchases can't rely on a physical chip proving anything — so 3-D Secure authenticates the cardholder instead, and tokenization makes sure the real card number is never the thing worth stealing in the first place.