Key Rollover

[christophwille]

It would be beneficial to Joe Average if the library had a sample for key rollover (the symmetric keys as well as the RSA key). Definitely a scenario too few devs think about beforehand.

[cmatskas]

Hi @christophwille. I like your idea, but I'm afraid this is something I haven't done in the past. If you would care to send me a pseudo algorithm on how this feature could be implemented, I will be more than happy to extend the library to accommodate rolling keys. As far as I understand, new keys will invalidate the old encrypted data rendering them un-decryptable. So, I am open to suggestions on how to implement this without breaking anything and any pointers/help would be greatly appreciated. Thanks

[christophwille]

There are a few options, some outlined in the section "Key Rotation" here (plus key validity considerations):

https://sqlcolumnencryption.codeplex.com/

A C++ library doing this can be found at https://code.google.com/p/keyczar/ - maybe the concepts can be transferred to C#.