Skip to content

Azure HSM Key Rotation Process - 2.40.02 onwards

📌 Overview

The Azure HSM re-encryption flow ensures that secrets stored in Azure Key Vault are securely migrated and updated using Hardware Security Module (HSM)-backed keys.
This mechanism enforces compliance, strengthens security, and simplifies key lifecycle management.

Re-encryption guarantees that:

  • ✅ Sensitive data is always protected by HSM keys
  • ✅ Key rotation and migrations are handled in a controlled, auditable process
  • ✅ Organizations remain compliant with security & regulatory mandates

📆 When to Re-encrypt

Re-encryption can be triggered under several scenarios:

  • 🔄 Scheduled Key Rotation → Routine maintenance (quarterly/annually)
  • 📜 Compliance Requirements → Regulatory or audit-driven demands
  • 🛡 Security Incidents → Suspected/confirmed key compromise
  • ⚙️ Policy Updates → Adopting stronger encryption algorithms/standards

📋 Prerequisites

  • Azure HSM Key Vault instance
  • Azure Standard Key Vault for secret storage
  • Service principal with key management permissions
  • Secure network connectivity to Azure services

🌐 API Endpoint

URL:
POST https://<KeyManagementService>/api/vault/migration/re-encrypt

Purpose:
Triggers re-encryption of all secrets using new HSM-backed keys.

📤 Request Configuration

{
  "connectionType": "azurehsm",
  "azureHsmKeyVaultUrl": "https://your-hsm.vault.azure.net/",
  "azureHsmKeyVaultClientId": "hsm-client-id",
  "azureHsmKeyVaultClientSecret": "hsm-secret",
  "azureHsmKeyVaultClientTenantId": "tenant-id",
  "azureKeyVaultUrl": "https://your-vault.vault.azure.net/",
  "azureKeyVaultClientId": "vault-client-id",
  "azureKeyVaultClientSecret": "vault-secret",
  "azureKeyVaultClientTenantId": "tenant-id",
  "masterKeyName": "master-keys",
  "masterKeyVersion": "88ec4ffe54054e38bf2bec749664d63d",
}

Note:

masterKeyName is required for custom master key
masterKeyVersion is Optional

⚙️ Configuration Notes

  • 🔐 HSM Vault → manages encryption keys in hardware
  • 📦 Standard Vault → stores encrypted secrets with HSM-backed keys
  • 🔑 Dual Authentication → both vaults require separate credentials

🔄 Process Flow

1. Connection Setup

  • Connect to Azure HSM Key Vault (for keys)
  • Connect to Azure Standard Key Vault (for secrets)

2. Key Generation

  • Create a new HSM master key (RSA_HSM)

3. Secret Retrieval

  • Read existing secrets from the standard vault

4. Re-encryption

  • Decrypt with old key(s)
  • Encrypt using new HSM-backed key

5. Secret Storage

  • Save updated, re-encrypted secrets back into the vault

6. Verification

  • Confirm that all secrets were successfully migrated

🔑 Key Components & Naming Conventions

  1. HSM Transit Keys

  2. Prefix: master-keys

  3. Type: RSA_HSM (hardware-backed)
  4. Pattern: master-keys-{version}

  5. Example: master-keys-1, master-keys-2

  6. Software Transit Keys

  7. Prefix: transit-keys

  8. Type: RSA (software-backed)
  9. Pattern: transit-keys-{version}

  10. Example: transit-keys-1, transit-keys-2

  11. Other Prefixes

  12. Execution Area: ex-*

  13. Data Subject: ds-*
  14. Format Preserving Encryption: fpe-*
  15. Metadata: mdt-*
  16. Nonces: nonce-*
  17. Salts: salt-*

🛠️ Re-encryption Flow Sequence

  1. Pre-Encryption Phase

  2. Validate environment configuration

  3. Initialize connections to both vaults

  4. Prepare transit key service with HSM enabled

  5. Key Creation

  6. Generate new RSA_HSM key in HSM vault

  7. Apply naming pattern → master-keys-{next_version}

  8. Increment version sequentially

  9. Data Migration

  10. Identify current key version in use

  11. Decrypt with old key (software or HSM)
  12. Re-encrypt with new HSM-backed key

  13. Maintain mapping between old & new key versions

  14. Key Lifecycle

  15. Optionally disable old keys

  16. Track active key versions
  17. Archive deprecated key versions
  18. Validate all re-encrypted data

✅ Success Response

{
  "message": "Vault re-encryption process completed successfully. All secrets have been securely migrated and re-encrypted using the new encryption key."
}

🔐 Security Notes

  • 🔑 Use service principals with minimal required permissions
  • 📊 Monitor re-encryption activities through Azure logs
  • 🗝 Follow organizational key retention policies
  • 🌐 Implement network restrictions where applicable
  • 📝 Maintain an audit trail of all key operations