Expiring an encryption key

Security policies generally limit the amount of time an encryption key is in use; this section describes how to expire a key without re-encrypting the exiting data. After a key expires, it is no longer used to encrypt new data, but is still used to decrypt existing data.

To change the key used for both encryption and decryption, see Rekeying tables using a new key.

Procedure

  1. Get a list of the available keys and states from the KMIP server:

    dsetool managekmip list <kmip_group_name>

    For example, the <host_name> has two keys:

    Keys on <host_name>:
        ID                                     Name               Cipher         State                Activation Date   Creation Date              Protect Stop Date   Namespace
    02-449   82413ef3-4fa6-4d4d-9dc8-71370d731fe4_0        AES/CBC/PKCS5   Deactivated   Mon Apr 25 20:25:47 UTC 2016             n/a                            n/a         n/a
    02-540   0eb2277e-0acc-4adb-9241-1dd84dde691c_0                  AES        Active   Tue May 31 12:57:59 UTC 2016             n/a                            n/a

    DSE supports one or more KMIP hosts. Each KMIP host is defined under a user-defined kmip_group_name in the kmip_hosts section of the dse.yaml.

  2. Expire the key:

    • Immediately expire the key:

      dsetool managekmip expirekey <kmip_group_name> <key_id>
    • Schedule an expiration date:

      dsetool managekmip expirekey <kmip_group_name> <key_id> <datetime>

      After the key expires, the database gets a new key for encryption the next time it refreshes the key cache (key_cache_millis in dse.yaml); the default setting is five minutes. Expired keys are still available to decrypt data.

      After the key expires, the database gets a new key for encryption the next time it refreshes the key cache (key_cache_millis in dse.yaml); the default setting is five minutes. Expired keys are still available to decrypt data.

  3. Optionally, force a refresh of the DSE key cache by performing a rolling restart.

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000, info@datastax.com