NAE Key Management Operations
A versioned key maintains the same key metadata (key name, owner, algorithm, key size, etc), but has a unique set of bytes for each version. Therefore, each version is different enough for encryption purposes, but similar enough to allow for easy management.
Each key version has its own key bytes, default IV, state, and creation date. The state determines which operations are available for a key version. Possible states are:
Active: Encryption, decryption, and all key management options are allowed.
Restricted: Only information operations are allowed.
Retired: No operations or access to key management is allowed.
Wiped: The key version is deleted.
The state combined with the key type and group permissions determine how the key version can be used. Ultimately, a key version can only be used when: the key’s group permissions permit the operation, the key version’s state permits the operation, and the request comes from a member of the permitted group. A key can have a maximum of 4000 versions.
The NAE Server allows you to perform key management tasks through the CADP for C. These tasks include:
