This service uses one key-encrypting key to decipher an input key and then enciphers this key using another key-encrypting key within the secure environment.