0
$\begingroup$

My use case:

I have few master keys, I use each for a specific operation (e.g. one for encrypting user's data and another for creating JWT signatures etc...).

I use these master keys in two specific things:

  1. in PBKDF2 as an input + a salt to derive symmetric keys and nonces (iv) and, then store the salt only with the ciphertext in the database
  2. in HMAC as a secret key (pepper)

I need to rotate these master keys when they get old.

Questions to clarify what I need to know:

  1. When do these master keys get old or need to be rotated ?
  2. How to rotate these keys and also can get back the old keys from the new keys to decrypt encrypted data or verify hashes that were made by these old keys ? I think I should do a bit-XOR on the old key with its corresponding new key
  3. I currently don't have the privilege of using HSMs (Hardware Security Modules) or secure enclaves, is storing these master keys in files beside the app API secure enough ? What things should I take in mind ?
  4. Am I fine with PBKDF2 or I'd better use a HKDF ? If yes, what other recommendations I should do when using HKDF ?
  5. What length recommendation for the master key in such a use case ?
  6. Is there any flows, problems or improvements in the whole thing ?
Improve this question
$\endgroup$
6
  • 3
    $\begingroup$ What exactly are you trying to defend against where you need to rotate the key in this manner? Generally, a key rotation involves using updated keys for new data, but not trying to re-protect the existing data? You seem want to update that existing protection, but without re-encrypting. Depending on what you're trying to protect against, that may be impossible (at least to my knowledge). $\endgroup$
    – Swashbuckler
    Jul 28 at 22:45
  • $\begingroup$ @Swashbuckler isn't it a good practice to rotate keys regularly ? also I know that these keys have a limited life cycle. The kind of encryption i am doing is encrypting private users data in a normal service, and the kind of hashing is generating signatures for tokens for users and hashing their passwords and any other data that needs to be private and i shouldn't know $\endgroup$
    – Mohamed Waleed
    Jul 28 at 23:04
  • $\begingroup$ @Swashbuckler I know that the life cycle of a key in general is related to its usage. I have keys that are used only to encrypt some data in a database, when should I rotate these ? when there is a leakage in data ? I also have some keys which are used very often in hashing and creating signatures for token, when should I rotate these too ? $\endgroup$
    – Mohamed Waleed
    Jul 28 at 23:07
  • $\begingroup$ @Swashbuckler i am thinking of key rotation as I think it is useful to make it more hard for an attacker to get any information, and also I will be hosting such an application on a vps $\endgroup$
    – Mohamed Waleed
    Jul 28 at 23:11
  • $\begingroup$ @Swashbuckler I am fine with the data encrypted with the old keys, I am asking about how to rotate the keys to update new data with a new key and also be able to decrypt old data without storing the full old key by doing a thing like an XOR for example $\endgroup$
    – Mohamed Waleed
    Jul 28 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.