Data protection key rotation
For better security, the key used to encrypt the data in VeridiumID server must be rotated periodically. An automatic mechanism for rotating the master key is available in Veridium Manager starting with version 3.6.
The encryption mechanism works with a master key that encrypts a secret. With the help of the encrypted secret, the data will be encrypted/decrypted.
The new key rotation mechanism actually rotates the master key and works as follows:
Automatic rotation
![image-20240327-092146.png](../../__attachments/3554903167/image-20240327-092146.png?inst-v=ffa2d127-74f7-4a38-ac00-bc62b4eb8eb4)
By pressing the “Rotate master key” from the right side panel, the key will be rotated.
Manual rotation
In order to rotate the key manually, the followings steps are necessary:
Generate a new keystore (Keystore Explorer is one tool that can do that)
You have to remember the keystore password and master key password
Transform keystore in base64
Go to VID in Settings → Advanced → config.json and find
dataProtection
entry.Replace
keystore
with the bas64, addmasterKeyPassword
andkeystorePassword
Press save