Key Management Framework key life-cycle states

  • Release version: Yokohama
  • Updated January 30, 2025
  • 2 minutes to read

    • KMF supports several cryptographic key life-cycle states through the enforcement of specific allowable actions. For example, only keys that are in the active state can be used fully for their intended cryptographic purpose. The following table provides further detail on the varying key life-cycle states.

    Key life-cycle state or action Description
    Active There can be only one active key for a given cryptographic specification in a cryptographic module.
    Compromised Several keys can exist in the compromised state for revocation in a given cryptographic specification in a cryptographic module. Any active or suspended key can be moved to a compromised state.

    Compromised keys can’t be used to generate new content, such as encrypting or signing, but may still be used to identify the purpose of existing content, such as decryption or verification.
    Deactivated Any active key can be deactivated. There could be several keys in a deactivated state for a given cryptographic specification in a cryptographic module.

    For example, when the key is rotated, the current active key is deactivated. Deactivated keys cannot be used to generate new content, such as encrypting and signing, but may still be used to identify purposes of existing content, such as decryption or verification.

    Note:
    Compromised and revoked keys are treated as deactivated keys.
    Destroyed When a key is destroyed key material is permanently removed and can no longer be used for any cryptographic purpose. Any deactivated key can be destroyed using lifecycle automation when it hasn’t been used in the configured designated time frame. There could be several keys in a destroyed state for a given cryptographic specification in a cryptographic module.
    Warning:
    Data associated with a destroyed key can no longer be accessed, therefore extreme caution should be exercised when performing a destroy key action.
    Generated Multiple keys can exist in the generated state for a given cryptographic specification in a cryptographic module.

    A generated key can be moved to an active state when no active key exists for the given cryptographic specification. The first key generated is automatically set to active.

    Note:
    If the choice is to generate a new key, then a new key is generated and made active even though there are keys in a generated state for the given cryptographic specification.
    Renewed An active key that has an expiration date can be renewed any number of times to extend the life-cycle period of the key.
    Note:
    The difference between the activation date and expiration date is calculated and the expiration date is postponed by that duration from the current day.
    Resume The UI action is available on suspended keys to move them back to an active state when no other active key exists for the given cryptographic specification.
    Revoked Any active or suspended key can be moved to the revoked state.

    Revoked keys can’t be used to generate new content, such as encrypting or signing, but may still be used to identify the purpose of existing content, such as for decryption or verification.

    Several keys in a revoked state may exist for a given cryptographic specification in a cryptographic module.
    Rotated Key rotation results in deactivating the current active key and making another key active. Select the new active key from the following:
    • Generation of a new key.
    • Point to an existing imported key. Any active key can be rotated.
    Suspended There could be several keys in the suspended state for a given cryptographic specification in a cryptographic module. When the key is suspended, the key can be resumed and reassigned to an active state when no other active key exists for that cryptographic specification.