Design Encryption Service - System Design | WinJob

Problem Statement & Encryption Service Context

Enterprise encryption services centralize key custody, policy enforcement, and audit so thousands of microservices never touch long-lived plaintext master keys. Interviewers at AWS KMS, HashiCorp Vault, or Google Cloud KMS expect you to separate data-plane crypto (encrypt/decrypt at scale) from control-plane governance (who may use which key, when rotation happens).

Key points

CMKs never leave HSM; apps hold only wrapped DEKs
Every crypto call is authorized, metered, and audited
Envelope encryption keeps KMS QPS bounded

Deep dive

Anchor on measurable outcomes: encrypt/decrypt p95 under 25ms including HSM round-trip, 99.999% availability for regional endpoints, zero silent key material export, and tamper-evident audit for every GenerateDataKey and Decrypt call. When failures occur, specify fail-closed behavior—no fallback to software keys in FIPS mode—and how multi-tenant isolation prevents cross-customer DEK reuse.

javaOne Dark Pro

1 public final class EncryptionContext {
2   private final String tenantId;
3   private final String resourceArn;
4   public Map<String, String> canonical() {
5     return Map.of("tenant", tenantId, "arn", resourceArn);
6   }
7 }

pythonOne Dark Pro

1 @dataclass(frozen=True)
2 class DataKeyRequest:
3     key_id: str
4     context: dict[str, str]
5     key_spec: str = "AES_256"

typescriptOne Dark Pro

1 interface GenerateDataKeyResult {
2   plaintextKey: Uint8Array;
3   ciphertextBlob: Uint8Array;
4 }
5  
6 export function mustZeroize(key: Uint8Array): void {
7   key.fill(0);
8 }

Operational notes

Section 1 note 1: Enterprise context — tie KMS SLOs.
Section 1 note 2: Enterprise context — document envelope flow.
Section 1 note 3: Enterprise context — publish rotation overlap.
Section 1 note 4: Enterprise context — rate-limit per tenant.
Section 1 note 5: Enterprise context — never export CMK plaintext.
Section 1 note 6: Enterprise context — fanout audit under 5s.
Section 1 note 7: Enterprise context — prefer MRK for DR.
Section 1 note 8: Enterprise context — shard metadata by account.
Section 1 note 9: Enterprise context — audit Disable/Import.
Section 1 note 10: Enterprise context — fail closed on tag mismatch.
Section 1 note 11: Enterprise context — size HSM queue depth.
Section 1 note 12: Enterprise context — drill break-glass quarterly.

If challenged on breach response, answer with disable CMK + emergency rotation + re-wrap pipeline—not “change the app password.”

Why interviewers care

Encryption Service interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement & Encryption Service Context that proves you understand real outages, not happy-path diagrams.

Key Highlights

•CMKs never leave HSM; apps hold only wrapped DEKs
•Every crypto call is authorized, metered, and audited
•Envelope encryption keeps KMS QPS bounded

1	public final class EncryptionContext {
2	private final String tenantId;
3	private final String resourceArn;
4	public Map<String, String> canonical() {
5	return Map.of("tenant", tenantId, "arn", resourceArn);
6	}
7	}

1	@dataclass(frozen=True)
2	class DataKeyRequest:
3	key_id: str
4	context: dict[str, str]
5	key_spec: str = "AES_256"

1	interface GenerateDataKeyResult {
2	plaintextKey: Uint8Array;
3	ciphertextBlob: Uint8Array;
4	}
5
6	export function mustZeroize(key: Uint8Array): void {
7	key.fill(0);
8	}