Key management actions
One of the core features of KMF is to provide the capability to manage keys, such as revoking or rotating keys. KMF properly secures sensitive data with the most up-to-date encryption materials and life cycle operations.
The following table provides a summary of the key life cycle operations and management actions. The cryptographic module purpose is applied to the data with the cryptographic module configuration and has no impact on data.
| Key management action | Description |
|---|---|
| Generate key | Generates a new key for the given cryptographic module. A first generated key is set to `active`. |
| Rotate key | Deactivates the current key and generates a new one. The new module key is set to current \(active\). |
| Revoke key | Marks the current key and life cycle state as revoked. The cryptographic module auto-generates a new key on new data and sets the key status to active. Revoked means that the key is no longer used for encryption. However, it can still be used for decryption. You can’t destroy a key. |
| Suspend key | Marks the current key as suspended. Manually resume the suspended key or revoke the suspended key to generate a new module key before using the cryptographic module again. |
| Resume key | Marks a suspended key as the active key. |
| Renew key | Extends the life of the current key. The Renew button becomes available under the following circumstances:- You’re assigned the cryptographic manager role. - The life-cycle state is marked to either Active or Renewed. - An expiration date is set in the module life cycle definition. |
- View and manage keys
Review the status of any key to determine further key action, such as when to renew, rotate, suspend, deactivate, or destroy a current key. - Rotate keys
For increased security, you can rotate your cryptographic keys on a pre-determined schedule. Key rotation is when you retire an encryption key and replace that old key by generating a new cryptographic key.
Parent Topic:Key Management Framework