Key Management Framework key lifecycle states

  • Release version: Washingtondc
  • Updated February 1, 2024
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Key Management Framework Key Lifecycle States

    The Key Management Framework (KMF) provides a structured approach to managing cryptographic keys through various lifecycle states. Each state enforces specific allowable actions, ensuring that keys are used appropriately for their cryptographic purposes.

    Show full answer Show less

    Key Features

    • Active: Only one active key per cryptographic specification can be used fully.
    • Compromised: Keys can be marked as compromised to prevent their use in new operations, while still allowing existing content to be verified.
    • Deactivated: Active keys can be deactivated, leading to multiple deactivated keys for a specification, which can also identify existing content.
    • Destroyed: Permanently removes key material, rendering it unusable. Caution is advised as associated data becomes inaccessible.
    • Generated: New keys can be generated and made active. If a new key is generated, it overrides existing generated keys.
    • Renewed: Active keys with expiration dates can be renewed to extend their lifecycle.
    • Resume: Suspended keys can be reinstated to active status when no other active key exists.
    • Revoked: Active or suspended keys can be revoked, preventing their use for new operations while still allowing identification of existing content.
    • Rotated: Involves deactivating the current active key and selecting a new one, either through generation or using an existing key.
    • Suspended: Keys can be temporarily inactivated and later resumed when needed.

    Key Outcomes

    By understanding and utilizing these key lifecycle states, ServiceNow customers can effectively manage cryptographic keys, ensuring security and compliance while minimizing risks associated with compromised or expired keys. Proper management leads to enhanced operational integrity and data protection.

    KMF supports several cryptographic key lifecycle states through the enforcement of specific allowable actions. For example, only keys that are in the active state can be used fully for their intended cryptographic purpose. The following table provides further detail on the varying key lifecycle states.

    Key lifecycle state or action Description
    Active There can be only one active key for a given cryptographic specification in a cryptographic module.
    Compromised Several keys can exist in the compromised state for revocation in a given cryptographic specification in a cryptographic module. Any active or suspended key can be moved to a compromised state.

    Compromised keys cannot be used to generate new content, such as encrypting or signing, but may still be used to identify the purpose of existing content, such as decryption or verification.
    Deactivated Any active key can be deactivated. There could be several keys in a deactivated state for a given cryptographic specification in a cryptographic module.

    For example, when the key is rotated, the current active key is deactivated. Deactivated keys cannot be used to generate new content, such as encrypting and signing, but may still be used to identify purposes of existing content, such as decryption or verification.

    Note:
    Compromised and revoked keys are treated as deactivated keys.
    Destroyed When a key is destroyed key material is permanently removed and can no longer be used for any cryptographic purpose. Any deactivated key can be destroyed using lifecycle automation when it has not been used in the configured designated time frame. There could be several keys in a destroyed state for a given cryptographic specification in a cryptographic module.
    Warning:
    Data associated with a destroyed key can no longer be accessed, therefore extreme caution should be exercised when performing a destroy key action.
    Generated Multiple keys can exist in the generated state for a given cryptographic specification in a cryptographic module.

    A generated key can be moved to an active state when no active key exists for the given cryptographic specification. The first key generated is automatically be set to active.

    Note:
    If the choice is to generate a new key, then a new key is generated and made active even though there are keys in a generated state for the given cryptographic specification.
    Renewed An active key that has an expiration date can be renewed any number of times to extend the lifecycle period of the key.
    Note:
    The difference between the activation date and expiration date is calculated and the expiration date is postponed by that duration from the current day.
    Resume The UI action is available on suspended keys to move them back to an active state when no other active key exists for the given cryptographic specification.
    Revoked Any active or suspended key can be moved to the revoked state.

    Revoked keys cannot be used to generate new content, such as encrypting or signing, but may still be used to identify the purpose of existing content, such as for decryption or verification.

    Several keys in a revoked state may exist for a given cryptographic specification in a cryptographic module.
    Rotated Key rotation results in deactivating the current active key and making another key active. Select the new active key from the following:
    • Generation of a new key.
    • Point to an existing imported key. Any active key can be rotated.
    Suspended There could be several keys in the suspended state for a given cryptographic specification in a cryptographic module. When the key is suspended, the key can be resumed and reassigned to an active state when no other active key exists for that cryptographic specification.