Rekeying tables using a new key
Change the encryption key that is used for both encrypting new data and decrypting the existing data. Use these steps to secure the data after an event that potentially compromised an encryption key, such as a change in security administration staff. Before destroying the old key, revoke the compromised KMIP key, wait for the database key cache refresh, and then re-encrypt existing SSTables with the new key.
The database caches the encryption keys and refreshes the cache at an interval set by the
key_cache_millis (default setting is
To get a new key, either wait for the key cache refresh interval or perform a rolling restart.
expirekey: Database stops using the key for encryption at the specified time and continues to use the expired key to decrypt existing data. Data re-keying is not required.
Use this command to satisfy security policies that require periodic switching of the encryption key.
revoke: Permanently disables the key on the
KMIPserver. Database can no longer use the key for encryption, but continues to use the key for decryption of existing data. Re-encrypt existing data before completely removing the key from the
Use this command as the first step when replacing a compromised key.
destroy: Completely removes the key from the
KMIPserver. Database can no longer use the key for encryption or decryption. Existing data that has not been re-encrypted becomes inaccessible.
Use this command only after revoking a key and re-encrypting existing data.
Revoke the compromised key using the
dsetool managekmip revoke:
Get the ID of the KMIP encryption key you want to revoke from the
dsetool managekmip list <kmip_groupname>
The following is an example of a
KMIPserver that has two keys,
ID Name Cipher State Activation Date Creation Date Protect Stop Date Namespace 02-449 82413ef3-4fa6-4d4d-9dc8-71370d731fe4_0 AES/CBC/PKCS5 Deactivated Mon Apr 25 20:25:47 UTC 2016 n/a n/a n/a 02-540 0eb2277e-0acc-4adb-9241-1dd84dde691c_0 AES Active Tue May 31 12:57:59 UTC 2016 n/a n/a n/a
DSE supports one or more
KMIPhost is defined under a user-defined
kmip_hostssection of the
The location of the
dse.yamlfile depends on the type of installation:
Revoke the key you want to replace using the ID:
dsetool managekmip expirekey <kmip_groupname> <key_id>
Revoking permanently deactivates the key on the
KMIPserver. When the key cache refreshes, a new key for encryption or decryption is automatically created. Revoked keys are used to decrypt existing data. DO NOT destroy the revoked key until after re-encrypting the existing data.
Verify that the key State is
dsetool managekmip list kmip_groupname
The following is an example of a
KMIPserver that has two keys:
ID Name Cipher State Activation Date Creation Date Protect Stop Date Namespace 02-449 82413ef3-4fa6-4d4d-9dc8-71370d731fe4_0 AES/CBC/PKCS5 Deactivated Mon Apr 25 20:25:47 UTC 2016 n/a n/a n/a 02-540 0eb2277e-0acc-4adb-9241-1dd84dde691c_0 AES Deactivated Tue May 31 12:57:59 UTC 2016 n/a Thu Jul 27 17:16:38 UTC 2017
Refresh the database key cache using one of the following methods:
KMIPkeys are cached on the DSE node. DSE refreshes the cache and a new key is automatically generated by the KMIP server after
key_cache_millislapses; the default setting is
Optional: Get a list of the affected tables to re-encrypt using the new key using the DESC keyspace command:
For example to find all tables in the cycling keyspace that use the
DESC KEYSPACE cycling
nodetool upgradesstablesto rewrite the encrypted SSTables using the new key. Run the following command on every node in the cluster:
Target only specific tables:
nodetool upgradesstables --include-all-sstables keyspace_name table_name [table_name …]
Target specific keyspace:
nodetool upgradesstables --include-all-sstables keyspace_name
All keyspaces and tables:
nodetool upgradesstables --include-all-sstables
Optional: Remove the encryption key so that it is no longer available for decryption:
dsetool managekmip destroy <key_id>
The backed up SSTables are only accessible using the old key. Ensure that the data is accessible before removing the key.