Decryption Workflow

Here's the basic workflow for the decryption of an encrypted data:

flowchart TB
    subgraph KMS[🔐 Key Management Service]
        KEK[["Key Encryption Key\n(KEK)"]]
        DECRYPT_EEK([1. Unwrap the EEK])
    end

    subgraph PG["🐘 Postgres"]
        DEK[["✉️ Data Encryption Key\n(DEK)"]]
        EEK[["Envelop Encryption Key\n(EEK)"]]
        NONCE{{"🎲 DEK Nonce"}}
        DATANONCE{{"🎲 DATA Nonce"}}
        DATA[["Encrypted DATA"]]
        PDATA{{"Plaintext DATA"}}
        PEEK{{"🔑 Plaintext EEK"}}
        DECRYPT_DEK([2. Unseal the Envelop])
        PDEK{{"🔑 Plaintext DEK"}}
        DECRYPT_DATA([3. Decrypt the Data])
    end


    EEK --> DECRYPT_EEK
    KEK --> DECRYPT_EEK
    DECRYPT_EEK ===> PEEK

    PEEK ---> DECRYPT_DEK
    NONCE ---> DECRYPT_DEK
    DEK   ---> DECRYPT_DEK
    DECRYPT_DEK ===> PDEK

    PDEK ---> DECRYPT_DATA
    DATANONCE ---> DECRYPT_DATA
    DATA ---> DECRYPT_DATA
    DECRYPT_DATA ===> PDATA

    style EEK fill:#ffe0e0,stroke:#c0392b,stroke-width:2px
    style DEK fill:#ffe0e0,stroke:#c0392b,stroke-width:2px
    style KEK fill:#ffe0e0,stroke:#c0392b,stroke-width:2px
    style DATA fill:#ffe0e0,stroke:#c0392b,stroke-width:2px

    style PDEK fill:#e0ffe0,stroke:#66ff66,stroke-width:2px
    style PEEK fill:#e0ffe0,stroke:#66ff66,stroke-width:2px
    style PDATA fill:#e0ffe0,stroke:#66ff66,stroke-width:2px

    style NONCE fill:#f0f0f0,stroke:#7f8c8d

    style DECRYPT_EEK fill:#ccccff
    style DECRYPT_DEK fill:#ccccff
    style DECRYPT_DATA fill:#ccccff