Double Key Encryption (DKE)
Double Key Encryption (DKE)
Protect Microsoft 365 documents with customer-controlled encryption keys
Product teaser
Double Key Encryption for Microsoft 365
The product teaser shown on duokey.com.
Introduction & Concepts
Modern work environments, especially those using cloud services, require advanced data protection. While standard permissions and encryption offer baseline security, Microsoft Purview Information Protection (MPIP) strengthens it by encrypting data and embedding usage rights directly with the information.
For highly sensitive data, even stronger safeguards are needed—particularly protection from the cloud provider itself. This is where Double Key Encryption (DKE) comes in.
The Challenge: Protecting Sensitive Data in the Cloud
Key Control
Cloud providers typically manage the encryption keys
Technical Access
Providers have technical ability to access encrypted data
Shared Control
Shared control poses regulatory and compliance challenges
Microsoft Purview Information Protection (MPIP)
Before exploring DKE, it's essential to understand MPIP/Azure RMS, which DKE extends.
| Component | Description |
|---|---|
| Microsoft Entra ID | Manages identities and tenant separation |
| Purview Information Protection | Handles sensitivity labels and protection settings |
| Azure Rights Management (Azure RMS) | Manages Microsoft-controlled cryptographic keys |
| Clients | Apps (e.g., Microsoft 365) accessing protected content |
| DKE Web Service | Customer-controlled component for DKE flow |
What is Double Key Encryption?
Double Key Encryption (DKE) builds directly on top of Microsoft Purview Information Protection. It achieves maximum data confidentiality and control by introducing a second encryption key.
Two Keys
One key managed by Microsoft, second key held exclusively by you
Customer Control
Microsoft has no access to your private, second key
Data Privacy by Design
DuoKey can never access your document content
Swiss Cloud Service
HSM-protected keys with DuoKey MPC
DuoKey - DKE
DuoKey DKE is a Swiss cloud service offering Double Key Encryption to encrypt Microsoft 365 Office documents with Hardware Security Module protected keys.
Architecture
DuoKey DKE with Microsoft 365
Key 1 stays with Microsoft in Azure RMS. Key 2 is served by the DuoKey DKE web service, which checks your Zero Trust policy before every decrypt and computes with key shares held across the MPC vault.
The DuoKey DKE Solution Provides
- The customer-controlled private key (DKE Key Management)
- The deployment of DKE Web Service apps
- Control of DKE service access
How Double Key Encryption Works
Exploded view
Anatomy of a DKE-protected document
The access metadata that unlocks the content is encrypted twice: first with your DuoKey key, then with the Microsoft key. Opening the document needs both. Source: Microsoft Learn, DKE encryption workflow.
Sequence
Protecting a document with DKE
Steps 1 to 6 of Microsoft's DKE encryption workflow. The client caches the Azure public key (30 days by default) and the DKE public key, so later documents are protected without calling either service. Source: Microsoft Learn, DKE encryption workflow.
Critical Security Considerations
DKE provides powerful control, but its security effectiveness is entirely dependent on your organization's ability to secure its components.
| Consideration | Description |
|---|---|
| Protect Your Key | The primary security requirement is rigorously safeguarding the customer-controlled private key |
| Protect Identities | Protecting user and administrator identities authorized to access the DKE service is critical |
| Identity Provider Risk | Using the same identity provider for both M365 and DKE introduces risk of single identity compromise |
DKE Components
| Component | Description |
|---|---|
| Client Functionality | Microsoft 365 desktop apps on Windows (Word, Excel, PowerPoint, Outlook) and Adobe Acrobat |
| DKE Web Service | Web server component operated by DuoKey and controlled by the customer |
Comparison: Standard MPIP vs. DKE
| Feature | Standard MPIP | DKE (with DuoKey) |
|---|---|---|
| Who holds encryption key? | Microsoft (cloud provider) | Microsoft + Customer (DuoKey HSM) |
| Can Microsoft access content? | Technically possible (with limitations) | No access possible |
| Control over sensitive data | Shared control | Exclusive customer control |
| Compliance with regulations | Limited (depends on jurisdiction) | Enhanced compliance |
What's Next
Get Started
Comprehensive setup task list
Operations
Key Management and DKE Service guides
Knowledge Base
In-depth DKE instructions
Vendor Documentation
See Also
Book a 30-Minute Demo: Schedule a personalized demo to explore how DKE can benefit your organization.