Transparently rotating keys when using the Enterprise Library Cryptography Application Block

Topics: Cryptography Application Block
Jun 19, 2012 at 7:48 PM


I'd like to extend the cryptography application block to transparently rotate keys at a specific interval (once a day), without changing code that uses the application block.  I'm fine with changing the configuration and extending the application block.

My strategy is to

  1. define a location where keys are stored, be it in the database or file system
  2. define the interval when keys should be rotated
  3. define the algorithm used for encrypting and decrypting data
  4. when encrypting data, write a "header" which indicates which algorithm was used, the key size and version  followed by the encrypted data
  5. when decrypting the data, read the header, find the key in the key store and use it to decrypt the rest of the data. 

This seems to be common technique.

Any suggestions would be much appericated.