Key Rotation (Azure Key Vault)

[jhulbertpmn]

I have this library setup to work with Azure Key Vault and it is exactly what I needed. I did want to check to see how you suggest handling key rotation - if I rotate the key in the Key Vault - what are the implications for data already encrypted/how does the library handle getting the new key for future encryption and accessing data which has already been encrypted?

[harrison314]

Hello,
encryption scheme is designed to rotate asymmetric keys by re-encrypting the master key in the database. This will not lose the old data.

The ReEncrypted method is created for this, which receives the parameter fromProvider from the old key and toProvider from the encryption new key.

Then, it is possible to use both the new and old keys using the Azure Key Vault.

See: https://github.com/harrison314/Harrison314.EntityFrameworkCore.Encryption/blob/main/src/src/Harrison314.EntityFrameworkCore.Encryption/IDbContextEncryptedProvider.cs#L16