Rotating a key creates a new version of the existing key with the same name, algorithm and key length. After rotation, the latest version becomes the default for the key and its tokenization policies. Older versions remain enabled and usable until you manually disable or delete them.

A tokenization or detokenization request with only policyName uses the default (latest) version of the key. A request that specifies both policyName and keyGuid uses that exact version of the key identified by keyGuid. This allows data tokenized before rotation to be detokenized with the original key version.

The vault does not store your data. Your business application tracks the policy and key version used to tokenize data. The Cryptographic Security Platform Vault for Cryptographic APIs webGUI shows the creation date of each key version. 

This page describes how to rotate a key.

To rotate a key

1. Log in to the Cryptographic Security Platform Vault for Cryptographic APIs web GUI.

2. From the Home tab, select Manage > Keys.

3. On the Manage Keys page, select the key that you want to rotate.

4. Select Actions > Rotate Key.

5. On the confirmation screen, click Rotate.