At the west end of the customs pier stands a row of warehouses, and old Mai keeps them.

Thirty years ago, when he first took the job, the warehouse had exactly one lock. A fine lock — brass, six bolts, and he carried the key against his skin, even in his sleep. Every crate in the port sat behind that one door.

The trouble came in the seventh year. One night the key was lifted from the coat he had hung on the wall. The thief had only that one night — but for that one night, what he could open was the entire warehouse.

Old Mai changed his method after that.

These days, when you hand him a crate, he doesn’t take your money first. In front of you he lifts a brand-new lock off the wall — one per crate, two hundred crates and two hundred locks, no two of them alike. He snaps it shut, and the key is in his hand: a small thing, bright as a new coin.

Then comes the part that puzzles strangers. He doesn’t give you the key. He doesn’t hang it on his belt, and he doesn’t drop it in a drawer. He slides it into a small brass tube, screws the cap down, and carries the tube — only the tube; the crate stays where it is — across the yard to the thick round iron door at the far end.

Behind that door sits the sealkeeper. There is one of her in the whole port, and she never comes out. She takes the tube through the window slot and presses a great seal into the cap. The die for that seal lives in a cabinet at her feet and has never once left the room: no copy, no rubbing, and nobody has ever seen what it looks like — old Mai included. The sealed tube comes back out through the slot.

Old Mai ties the sealed tube to the crate’s handle with hemp twine. Right there on the crate, hanging in plain sight, where anyone can see it.

A new hand asked on his first morning: if the key hangs on the crate, what is the lock even for?

Old Mai told him to try. The boy couldn’t unscrew the tube — the cap was sealed shut. He pried at it with a knife; the tube split, and the key inside snapped with it. He turned to the lock on the crate — six bolts — and was still at it when the sun came up.

When goods are collected, old Mai unties the tube, walks the thirty paces, and hands it through the slot. The sealkeeper checks the seal, opens the tube, passes the key back out. He opens the crate, counts the goods, locks it again; the key goes back in the tube, gets sealed again, gets tied back on. She never touches a crate from beginning to end, and she has no idea whether it holds tea or gunpowder. She knows only tubes. On her sill lies a ledger: which tube, at what hour, handed in by whom — one line each.

Last winter it was put to the test. A gang came over the wall, worked three crates loose and dragged them off — brass tubes still tied to the handles, dragged off along with them. Two weeks later the goods turned up in the next port, crates still locked, tubes still sealed, not one of them opened. They got nothing, because the one thing they could not drag off was the iron door.

There was also the time someone did manage to copy a key, working from one particular lock. That one crate was lost. The two hundred beside it each had their own lock; the copied key wouldn’t go halfway into the second keyhole.

But the finest bit of craft was something else. The sealkeeper changes the great seal once a year — the old die is melted down and a new one cast. You might imagine that day means opening two hundred crates, re-locking every one, re-tagging the lot. What old Mai actually did was this: carry two hundred brass tubes into the yard, hand them through the slot one at a time, old seal checked, new seal pressed, back out, tied back on. Done by midday. Not a crate moved, not a lock changed, not a bale of goods lifted — all that was resealed were two hundred little tubes.

The boy asked once: and if the great seal itself were destroyed? Then those two hundred crates never open again, old Mai said. Not lost — simply shut forever. He wasn’t smiling when he said it.

— By now you have probably recognized it: old Mai’s arrangement — one lock per crate, the key sealed inside a small tube, the tube hanging openly on the crate, the great seal that never leaves the iron door — is envelope encryption.

The concept. Envelope encryption is the default shape of encryption at rest on every major cloud. Data is never encrypted directly with the master key. Instead, each object (or each write) gets a freshly generated one-time symmetric DEK (data encryption key), used locally for bulk encryption such as AES-GCM. That DEK is then handed to a KMS/HSM and encrypted once under a non-exportable KEK (key encryption key, also called a master key or CMK), producing a short ciphertext — the wrapped DEK — which is stored right next to the encrypted object. Reading reverses the flow: fetch the wrapped DEK, call kms:Decrypt to get the plaintext DEK back, decrypt the data locally, and wipe the DEK from memory immediately. The KEK never crosses the HSM boundary, and the KMS never sees your data.

Why it matters. First, scale: a KMS is a network service with rate limits and a payload ceiling of a few kilobytes; you cannot feed it a 5 TB volume. Keeping bulk encryption local and letting the KMS handle a few dozen bytes of key material is what makes the economics work at all. Second, blast radius: one DEK protects one object, so leaking one compromises nothing else — and it sidesteps cryptographic wear on a single key, since AES-GCM has a finite safe nonce space per key. Third, cheap rotation: rotating the KEK means re-wrapping those few-dozen-byte blobs, with not one byte of data rewritten. That is why S3 SSE-KMS, EBS, GCP CMEK, and Vault transit can promise master-key rotation on demand; rotating the DEK itself, by contrast, requires rewriting the data. Fourth, separation of privilege and audit: read access to the bucket without kms:Decrypt yields nothing but ciphertext, and every unwrap leaves a CloudTrail entry recording who opened which crate and when. Fifth, crypto-shredding: destroy the KEK and you have destroyed every object that depended on it, with no need to physically scrub replicas spread across dozens of disks — which is how a great deal of compliance-grade deletion is actually implemented, and also why KEK backup and key policy are the most fragile link in the chain. One last practical note: those thirty paces cost something. Every unwrap is a KMS round trip, which is why designs like S3 Bucket Keys and the Kubernetes KMS provider v2 cache or reuse a DEK across a bounded scope — trading a little blast radius for a great many fewer KMS calls.

Metaphor mapping:

• The goods inside the crate → the plaintext data / the object itself
• A brand-new lock and its key per crate → a random per-object DEK
• The key sealed inside the brass tube → the wrapped DEK (data key encrypted under the KEK)
• The tube tied openly to the crate handle → wrapped DEK stored alongside the ciphertext, safe in plain sight
• The great seal in the cabinet that never leaves the room → the KEK / master key, never leaving the KMS/HSM boundary
• The sealkeeper herself → the KMS: Encrypt/Decrypt only, never touching the goods
• The thirty paces across the yard → a KMS API round trip (latency, hence DEK caching / S3 Bucket Keys)
• Snapped key, unpickable lock → ciphertext plus wrapped DEK is useless on its own
• The three crates dragged over the wall → stolen media or leaked objects; encryption at rest still holds
• A copied key losing only one crate → per-object keys bound the blast radius
• Resealing two hundred tubes each year → KEK rotation = re-wrapping DEKs, zero data rewritten
• The ledger on the windowsill → the audit log (kms:Decrypt in CloudTrail)
• A destroyed seal die, crates shut forever → crypto-shredding: destroying the KEK destroys the data
• The single lock of thirty years ago → one shared key: one leak, and the whole port is open