Skip to content

KEK Rotation

To understand the rotation, make sure you have read Data Privacy to understand envelope encryption. The KEK can be rotated automatically on a configurable interval, using the encryption rotation notebook.

Scheduling:

The customer must set the schedule for the PL_NCC_KEY_ROTATE pipeline themselves. We recommend running it once a day. The pipeline checks by itself whether it is time to rotate, so a daily run does not mean the KEK is rotated every day.

Parameters:

  • key_vault: Name of the Key Vault holding the KEK and wrapped DEKs.
  • kek_retention_period: Tenant variable with the number of days after which the KEK is rotated. A value of 3 means every 3 days. Defaults to 30 days when not set. The interval can be configured in the tenant, domain or environment settings in the Cloud Management Portal (CMP).

A key vault must be defined, as of now we support 2 ways of passing the key vault, this is the order in which NCC checks:

1.data_privacy_key_vault as tenant variable 2.key_vault as tenant variable

Tenant variable tab

What is KEK rotation?

KEK rotation replaces the Key Encryption Key (KEK) with a new version, without touching the data itself. Only the KEK rotates. The DEKs, which are the keys that actually encrypt the data, keep exactly the same value. This means no data has to be re-encrypted, which makes rotation fast and safe, even for large datasets.

The DEKs are stored in the Key Vault in wrapped form (as wrapped-dek-* secrets). A wrapped DEK is the DEK encrypted with the KEK. When the KEK changes, every wrapped DEK must be wrapped again with the new KEK, otherwise it could no longer be unwrapped once the old KEK version is disabled. The result of wrapping the same DEK with a different KEK is a different value, so each wrapped-dek-* secret gets a new version in the Key Vault. The underlying DEK is unchanged, only its protective layer is replaced.

How it works:

  1. The notebook compares the age of the current KEK version with kek_retention_period. If rotation is not due, it exits without changes.
  2. A new KEK version is created.
  3. Every wrapped-dek-* secret is unwrapped with the old KEK to obtain the DEK. The same DEK is then wrapped with the new KEK and stored again as a new version of the secret. The previous version of the secret is disabled.
  4. The old KEK version is disabled.

What this means in practice:

  • Data does not need to be re-encrypted, because the DEKs keep the same value.
  • After rotation, each wrapped-dek-* secret shows a new version in the Key Vault. This is expected and does not mean the DEK has changed.
  • Decryption keeps working, because the wrapped DEKs are always re-wrapped with the new KEK before the old KEK version is disabled. Rotation is transparent to existing pipelines: encryption and decryption keep working against the current KEK version.