1"use strict";(globalThis.webpackChunkdocs=globalThis.webpackChunkdocs||[]).push([[2579],{73047(e,r,t){t.r(r),t.d(r,{assets:()=>l,contentTitle:()=>a,default:()=>p,frontMatter:()=>d,metadata:()=>i,toc:()=>c});const i=JSON.parse('{"id":"components/cli/policy/kas-registry/key/rotate","title":"otdfctl policy kas-registry key rotate","description":"Rotates a cryptographic key within a specified Key Access Server (KAS).","source":"@site/docs/components/cli/policy/kas-registry/key/rotate.mdx","sourceDirName":"components/cli/policy/kas-registry/key","slug":"/components/cli/policy/kas-registry/key/rotate","permalink":"/components/cli/policy/kas-registry/key/rotate","draft":false,"unlisted":false,"tags":[],"version":"current","lastUpdatedAt":null,"frontMatter":{"title":"otdfctl policy kas-registry key rotate"},"sidebar":"tutorialSidebar","previous":{"title":"otdfctl policy kas-registry key list","permalink":"/components/cli/policy/kas-registry/key/list"},"next":{"title":"otdfctl policy kas-registry key unsafe","permalink":"/components/cli/policy/kas-registry/key/unsafe/"}}');var s=t(74848),n=t(28453),o=(t(96540),t(68818));const d={title:"otdfctl policy kas-registry key rotate"},a=void 0,l={},c=[{value:"Examples",id:"examples",level:2},{value:"Rotate a key in <code>local</code> mode",id:"rotate-a-key-in-local-mode",level:3},{value:"Rotate a key in <code>provider</code> mode",id:"rotate-a-key-in-provider-mode",level:3},{value:"Rotate a key in <code>remote</code> mode",id:"rotate-a-key-in-remote-mode",level:3},{value:"Rotate a key in <code>public_key</code> mode",id:"rotate-a-key-in-public_key-mode",level:3},{value:"Key Algorithms and Modes",id:"key-algorithms-and-modes",level:2}];function h(e){const r={code:"code",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,n.R)(),...e.components};return(0,s.jsxs)(o.A,{...JSON.parse('{"title":"Rotate Key","command":{"name":"rotate","aliases":["r"],"flags":[{"name":"key","shorthand":"k","description":"The KeyID (human-readable identifier) or the internal UUID of the existing key to rotate from the specified KAS. The system will attempt to resolve the provided value as either a UUID or a KeyID.","required":true},{"name":"kas","description":"Specify the Key Access Server (KAS) where the key is registered. The KAS can be identified by its ID, URI, or Name."},{"name":"key-id","description":"A unique, often human-readable, identifier for the new key to be created.","required":true},{"name":"algorithm","shorthand":"a","description":"Algorithm for the new key (see table below for options).","required":true},{"name":"mode","shorthand":"m","description":"Describes how the private key is managed (see table below for options).","required":true},{"name":"wrapping-key-id","description":"Identifier related to the wrapping key. Its meaning depends on the `mode`. For `local` mode, it\'s a descriptive ID for the `wrappingKey` you provide. For `provider` or `remote` mode, it\'s the ID of the key within the external provider/system used for wrapping."},{"name":"wrapping-key","shorthand":"w","sensitive":true,"description":"The symmetric key material (AES cipher, hex encoded) used to wrap the generated private key. Primarily used when `mode` is `local`."},{"name":"private-key-pem","sensitive":true,"description":"The private key PEM (encrypted by an AES 32-byte key, then base64 encoded). Used when importing an existing key pair, typically with `provider` mode."},{"name":"provider-config-id","shorthand":"p","description":"Configuration ID for the key provider. Often required when `mode` is `provider` or `remote` and an external key provider is used."},{"name":"public-key-pem","shorthand":"e","description":"The base64 encoded public key PEM. Required for `remote` and `public_key` modes, and can be used with `provider` mode if importing an existing key pair."},{"name":"label","shorthand":"l","description":"Comma-separated key=value pairs for metadata labels to associate with the new key (e.g., \\"owner=team-a,env=production\\")."}]},"fullCommand":"otdfctl policy kas-registry key rotate"}'),children:[(0,s.jsx)(r.p,{children:"Rotates a cryptographic key within a specified Key Access Server (KAS).\nThis command replaces an existing key with a new one while maintaining references to the old key to ensure data encrypted with the old key can still be decrypted."}),(0,s.jsx)(r.h2,{id:"examples",children:"Examples"}),(0,s.jsxs)(r.h3,{id:"rotate-a-key-in-local-mode",children:["Rotate a key in ",(0,s.jsx)(r.code,{children:"local"})," mode"]}),(0,s.jsxs)(r.p,{children:["Rotate an existing key to a new key in local mode, where the KAS generates the key pair and the private key is wrapped by the provided ",(0,s.jsx)(r.code,{children:"wrappingKey"}),":"]}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-shell",children:'otdfctl policy kas-registry key rotate --key "old-key-id" --kas "https://kas.example.com/kas" --key-id "new-key-v2" --algorithm "rsa:2048" --mode "local" --wrapping-key-id "virtru-stored-key" --wrapping-key "a8c4824daafcfa38ed0d13002e92b08720e6c4fcee67d52e954c1a6e045907d1"\n'})}),(0,s.jsxs)(r.h3,{id:"rotate-a-key-in-provider-mode",children:["Rotate a key in ",(0,s.jsx)(r.code,{children:"provider"})," mode"]}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-shell",children:'otdfctl policy kas-registry key rotate --key "123e4567-e89b-12d3-a456-426614174000" --kas "https://kas.example.com/kas" --key-id "provider-key-v2" --algorithm "rsa:2048" --mode "provider" --public-key-pem "LS0tLS1CRUdJTi..." --private-key-pem "LS0tLS1CRUdJTi..." --wrapping-key-id "openbao-key" --provider-config-id "f86b166a-98a5-407a-939f-ef84916ce1e5"\n'})}),(0,s.jsxs)(r.h3,{id:"rotate-a-key-in-remote-mode",children:["Rotate a key in ",(0,s.jsx)(r.code,{children:"remote"})," mode"]}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-shell",children:'otdfctl policy kas-registry key rotate --key "my-remote-key" --kas "Secondary KAS" --key-id "remote-key-v2" --algorithm "rsa:2048" --mode "remote" --wrapping-key-id "openbao-key" --provider-config-id "f86b166a-98a5-407a-939f-ef84916ce1e5" --public-key-pem "LS0tLS1CRUdJTi..."\n'})}),(0,s.jsxs)(r.h3,{id:"rotate-a-key-in-public_key-mode",children:["Rotate a key in ",(0,s.jsx)(r.code,{children:"public_key"})," mode"]}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-shell",children:'otdfctl policy kas-registry key rotate --key "public-key-old" --kas "Secondary KAS" --key-id "public-key-v2" --algorithm "rsa:2048" --mode "public_key" --public-key-pem "LS0tLS1CRUdJTi..."\n'})}),(0,s.jsx)(r.h2,{id:"key-algorithms-and-modes",children:"Key Algorithms and Modes"}),(0,s.jsxs)(r.ol,{children:["\n",(0,s.jsxs)(r.li,{children:["\n",(0,s.jsxs)(r.p,{children:["The ",(0,s.jsx)(r.code,{children:'"algorithm"'})," specifies the key algorithm:"]}),"\n",(0,s.jsxs)(r.table,{children:[(0,s.jsx)(r.thead,{children:(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.th,{children:"Key Algorithm"})})}),(0,s.jsxs)(r.tbody,{children:[(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"rsa:2048"})})}),(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"rsa:4096"})})}),(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"ec:secp256r1"})})}),(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"ec:secp384r1"})})}),(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"ec:secp521r1"})})}),(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"hpqt:secp256r1-mlkem768"})})}),(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"hpqt:secp384r1-mlkem1024"})})}),(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"hpqt:xwing"})})}),(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"mlkem:768"})})}),(0,s.jsx)(r.tr,{children:(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"mlkem:1024"})})})]})]}),"\n"]}),"\n",(0,s.jsxs)(r.li,{children:["\n",(0,s.jsxs)(r.p,{children:["The ",(0,s.jsx)(r.code,{children:'"mode"'})," specifies where the key that is encrypting TDFs is stored. All keys will be encrypted when stored in Virtru's DB, for modes ",(0,s.jsx)(r.code,{children:'"local"'})," and ",(0,s.jsx)(r.code,{children:'"provider"'})]}),"\n",(0,s.jsxs)(r.table,{children:[(0,s.jsx)(r.thead,{children:(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.th,{children:"Mode"}),(0,s.jsx)(r.th,{children:"Description"})]})}),(0,s.jsxs)(r.tbody,{children:[(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"local"})}),(0,s.jsx)(r.td,{children:"Root Key is stored within Virtru's database and the symmetric wrapping key is stored in KAS"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"provider"})}),(0,s.jsx)(r.td,{children:"Root Key is stored within Virtru's database and the symmetric wrapping key is stored externally"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"remote"})}),(0,s.jsx)(r.td,{children:"Root Key and wrapping key are stored remotely"})]}),(0,s.jsxs)(r.tr,{children:[(0,s.jsx)(r.td,{children:(0,s.jsx)(r.code,{children:"public_key"})}),(0,s.jsx)(r.td,{children:"Root Key and wrapping key are stored remotely. Use this when importing another org's policy information"})]})]})]}),"\n"]}),"\n"]})]})}function p(e={}){const{wrapper:r}={...(0,n.R)(),...e.components};return r?(0,s.jsx)(r,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}},68818(e,r,t){t.d(r,{A:()=>p});var i=t(96540);const s=(0,i.createContext)(null),n={didCatch:!1,error:null};class o extends i.Component{constructor(e){super(e),this.resetErrorBoundary=this.resetErrorBoundary.bind(this),this.state=n}static getDerivedStateFromError(e){return{didCatch:!0,error:e}}resetErrorBoundary(){const{error:e}=this.state;if(null!==e){for(var r,t,i=arguments.length,s=new Array(i),o=0;o<i;o++)s[o]=arguments[o];null===(r=(t=this.props).onReset)||void 0===r||r.call(t,{args:s,reason:"imperative-api"}),this.setState(n)}}componentDidCatch(e,r){var t,i;null===(t=(i=this.props).onError)||void 0===t||t.call(i,e,r)}componentDidUpdate(e,r){const{didCatch:t}=this.state,{resetKeys:i}=this.props;var s,o;t&&null!==r.error&&function(){let e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:[],r=arguments.length>1&&void 0!==arguments[1]?arguments[1]:[];return e.length!==r.length||e.some((e,t)=>!Object.is(e,r[t]))}(e.resetKeys,i)&&(null===(s=(o=this.props).onReset)||void 0===s||s.call(o,{next:i,prev:e.resetKeys,reason:"keys"}),this.setState(n))}render(){const{children:e,fallbackRender:r,FallbackComponent:t,fallback:n}=this.props,{didCatch:o,error:d}=this.state;let a=e;if(o){const e={error:d,resetErrorBoundary:this.resetErrorBoundary};if("function"==typeof r)a=r(e);else if(t)a=(0,i.createElement)(t,e);else{if(void 0===n)throw d;a=n}}return(0,i.createElement)(s.Provider,{value:{didCatch:o,error:d,resetErrorBoundary:this.resetErrorBoundary}},a)}}var d=t(74848);function a({name:e,shorthand:r,description:t,default:i,required:s}){const n=(0,d.jsxs)("code",{children:["--",e," <",e,">"]}),o=r&&(0,d.jsxs)(d.Fragment,{children:[(0,d.jsxs)("code",{children:["-",r]}),","]});return(0,d.jsxs)("dl",{children:[(0,d.jsxs)("dt",{children:[o," ",n]}),(0,d.jsxs)("dd",{children:[t,"\xa0(",(0,d.jsx)("em",{children:"required"}),": ",(0,d.jsx)("code",{children:s?"true":"false"}
1),")",i&&(0,d.jsxs)(d.Fragment,{children:["\xa0(",(0,d.jsx)("em",{children:"default"}),": ",(0,d.jsx)("code",{children:i}),")"]})]})]})}function l(e){return e?(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{children:"Options"}),e?.map(e=>(0,d.jsx)(a,{...e}))]}):null}function c(e){return e?(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{children:"Aliases"}),e?.map((r,t)=>(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)("code",{children:r}),t<e.length-1&&", "]}))]}):null}function h({children:e,fullCommand:r,title:t,command:i}){console.log(i);const{flags:s,args:n,arbitrary_args:o,aliases:a,hidden:h}=i;let p=r;return s&&(p+=" [flags]"),n&&(p+=" "+n.map(e=>`<${e}>`).join(" ")),o&&(p+=" "+o.map(e=>`[${e}]`).join(" ")),(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)("div",{children:(0,d.jsxs)("p",{children:[i.name," - ",t]})}),(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{children:"Synopsis"}),(0,d.jsx)("pre",{children:(0,d.jsx)("code",{children:p})})]}),(0,d.jsxs)("div",{children:[(0,d.jsx)("h2",{children:"Description"}),e]}),l(s),c(a)]})}function p({children:e,...r}){return(0,d.jsx)(o,{fallback:({error:e,tryAgain:r})=>(0,d.jsxs)("div",{children:[(0,d.jsxs)("p",{children:["This component crashed because of error: ",e.message,"."]}),(0,d.jsx)("button",{onClick:r,children:"Try Again!"})]}),children:(0,d.jsx)(h,{...r,children:e})})}},28453(e,r,t){t.d(r,{R:()=>o,x:()=>d});var i=t(96540);const s={},n=i.createContext(s);function o(e){const r=i.useContext(n);return i.useMemo(function(){return"function"==typeof e?e(r):{...r,...e}},[r,e])}function d(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(n.Provider,{value:r},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.