IDataProtect key expiration

Pranto Biswas 21

I am using IDataProtector to encrypt a string and store that encrypted string in a database. It is said that the default lifetime for a key is 90 days. After that a new key is generated.

Can I decrypt that string after 90 days successfully??

Zhi Lv - MSFT 32,106 Reputation points Microsoft Vendor

2022-02-28T08:03:24.09+00:00

Hi @Pranto Biswas ,

From the document, it seems that you can decrypt that string as long as the retired keys remain on the system.

When a key expires, the app automatically generates a new key and sets the new key as the active key. As long as retired keys remain on the system, your app can decrypt any data protected with them..

Best regards,
Dillion

Accepted answer

Bruce (SqlWork.com) 61,731 Reputation points

2022-02-27T17:06:44.297+00:00

No. The point of the expiration is that the key stops working. For database storage, you would need to use a non-expiring key, or reencrypt on regular basis.

Note: Sqlserver has builtin support of at rest encryption and column encryption, why are you not using these features.
Please sign in to rate this answer.

1 person found this answer helpful.
Pranto Biswas 21 Reputation points

2022-02-28T10:05:13.293+00:00

Dear @Bruce (SqlWork.com) , Thanks. I'm using MySQL. And I want to encrypt the data from my service layer. Can you please suggest my any Asp .Net Core built in approach for long term data encryption to store in database?

Bruce (SqlWork.com) 61,731 Reputation points

2022-02-28T17:34:54.367+00:00

Then use a non-expiring key. You can write a utility to periodically update the values with a new key.
Sign in to comment

Share via

IDataProtect key expiration

0 additional answers