Untitled | DataStax Enterprise

Expiring an encryption key

Security policies generally limit the amount of time an encryption key is in use; this section describes how to expire a key without re-encrypting the exiting data. After a key expires, it is no longer used to encrypt new data, but is still used to decrypt existing data.

To change the key used for both encryption and decryption, see Rekeying tables using a new key.

Procedure

Get a list of the available keys and states from the KMIP server:

dsetool managekmip list <kmip_group_name>

For example, the <host_name> has two keys:

Keys on <host_name>:
    ID                                     Name               Cipher         State                Activation Date   Creation Date              Protect Stop Date   Namespace
02-449   82413ef3-4fa6-4d4d-9dc8-71370d731fe4_0        AES/CBC/PKCS5   Deactivated   Mon Apr 25 20:25:47 UTC 2016             n/a                            n/a         n/a
02-540   0eb2277e-0acc-4adb-9241-1dd84dde691c_0                  AES        Active   Tue May 31 12:57:59 UTC 2016             n/a                            n/a

DSE supports one or more KMIP hosts. Each KMIP host is defined under a user-defined kmip_group_name in the kmip_hosts section of the dse.yaml.

Expire the key:

Immediately expire the key:

dsetool managekmip expirekey <kmip_group_name> <key_id>

Schedule an expiration date:

dsetool managekmip expirekey <kmip_group_name> <key_id> <datetime>

After the key expires, the database gets a new key for encryption the next time it refreshes the key cache (key_cache_millis in dse.yaml); the default setting is five minutes. Expired keys are still available to decrypt data.

Optionally, force a refresh of the DSE key cache by performing a rolling restart.

Expiring an encryption key

Procedure

Was this helpful?

Give Feedback