Key version management

Available in Classic and VPC

Key version management

To prepare for various security threats to cryptographic keys, there are recommended validity periods based on the key's purpose. Generally, the same key can be used for a maximum of 2 years for encryption purposes (generating ciphertext) and up to 5 years for decryption. Therefore, to protect against security threats, it's recommended that you renew with a new key before the expiration date. A key resource identified by a key tag contains versions of the underlying raw key. There is no limit to the number of versions you can retain. When rotating a key to update it to a new version, a new raw key is added, which can be expected to have the same effect as completely changing the key.

Key rotation

Use key rotation to update a key to a new version. A newly created key starts at version 1. Each rotation updates it to a new version. There is no version limit, so you can continue using the key regardless of how many times it is rotated. Key rotation can be automatic, at a configured interval, or manual, whenever you need it. The descriptions for each are as follows:

• Automatic rotation: Rotates the key automatically at the configured cycle.
• Manual rotation: You rotate the key manually as needed. Manual rotation does not affect the next automatic rotation schedule. For example, if a key has a 90-day automatic rotation cycle and you rotate it manually 10 days before the next scheduled rotation, automatic rotation still occurs 10 days later.

Manual rotation

You can manually rotate a key immediately whenever necessary, such as when you suspect a security threat or the renewal deadline has passed. To manually rotate a key to a new version:

1. In the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Key Management Service > Key.
2. On the Basic information tab of the key you want to rotate manually, click [Key rotation].
3. When the Rotate now popup appears, click [Confirm].
4. View the updated version in Current version.

Configure automatic rotation

To configure automatic rotation so that a key is updated to a new version at regular intervals:

1. In the NAVER Cloud Platform console, navigate to Menu > All Services > Security > Key Management Service > Key.
2. On the Basic information tab of the key you want to rotate automatically, click Automatic rotation to change the setting.
3. To set the automatic rotation cycle, click [Edit] for Rotation period (next rotation date).
   
4. When the Change rotation cycle popup appears, enter a rotation cycle.
   • Enter a value from 1 to 730 days (default: 90 days).
   • The next rotation date changes immediately.
5. Click [OK].

Version management

Apart from the key's status, you can also set status at the key version level. Key versions have 2 states: Enabled or disabled. The most recent version of the key must always be enabled, so its version state cannot be configured. Disabled versions can no longer be used for decryption. As explained earlier, to follow the recommendation that keys for decryption should only be used for up to 5 years, you can disable the version. After rotating a key to create a new version, we recommend disabling the previous version.