Renewing a symmetric encryption KEK

When renewing a KEK, previous keys must remain accessible for unwrapping, and the new KEK must not be used until it has been deployed on all Stormshield KMaaS servers.

  1. Add a new KEK to the keks.json file:
    1. Retrieve the keks.json file on one of the servers.
    2. Generate a new AES 256 KEK.
    3. Add this KEK to the file and assign a new unique ID to it.
  2. Publish the keks.json file successively on each server:
    1. Replace the keks.json file with the one modified in step 1. Ensure that you keep the same access privileges as for the existing file.
    2. Run the restart command on the server.
      The server will restart and reload its list of KEKs from the keks.json file. The active KEK does not change for the moment.
  3. Set the new active KEK in the keks.json file:
    1. Edit the keks.json file again.
    2. Change the value associated with active_kek_id so that it points to the ID of the KEK generated in step 1.
  4. Publish the keks.json file again on all the servers.

      On each successive server:

    1. Replace the keks.json file with the one modified in step 3. Ensure that you keep the same access privileges as for the existing file.
    2. Run the restart command on the server.
      The server will restart and reload its list of KEKs from the keks.json file. The active KEK is changed and the server is ready to wrap keys with the new KEK.

      3. In step 4, if a wrapping request is submitted on a server that uses the new KEK, all the other servers can respond to an unwrapping request regardless of their status, since they all know the new key.