Rotate Keys

This guide shows how to rotate PureKit-related keys. There can never be enough security, so you should rotate your sensitive data regularly (about once a week).

Use this workflow to get an update_token for updating encryption keys in your database and to get a new app_secret_key and service_public_key for your application.

Learn more about Pure Records and keys rotation as a part of Post-Compromise Security in this guide.

Navigate to your Virgil Application panel at Virgil Dashboard and, after pressing "BEGIN ROTATION PROCESS" press “SHOW UPDATE TOKEN” button to get the update_token (UT).

Move to PureKit configuration file and specify your update_token (UT):

PureContext context = PureContext.createContext(
    "AT.znqRZcOdzybj62Rzer897pX2DZ9KZoYF",
    "NM.Qs0YFBS7Mr3Aaa9qn4OCVcNC1wvPCXfUpZNWFCPUOUI=",
    "BU.MCowBQYDK2VwAyEAKWSBAZbbekJ5Ns36jRcjEiut3rH4rpaCCVnRxcB+d/E=",
    "SK.1.3JE4SAOXGC95nDOjOhCyTXZqdQmjaqz9mtZhIN9s/2g=.cFGlNRis9FQ77DW2fCpBcx+EI4SHv7guS1sPCnSRmx0=.rKEuUZePvcr6CdOTJkk0kd0kUAq1rSx0x2A9lUegQHo=",
    "PK.1.BCIeyCW9xDfbuYQb6CIJ7dMqujrjBlIysJs6dXxV+9FU9kxC60fD1dl/P/6TT2wJN8p9E16IPNt5OdJ6Tq3S6L0=.BGjcd5b4wzuGapBQXcUxVXnHWvscYMDbTWk1zxqejSruppcoVWzeYlF0z7GTT3HUdejdrFtbL6sRxD/wOu5jYAs=",
    "UT.2.CiDd8vnWg2I5nzcCMbd0f72fcYPGgWoNnC48ZUBaiiX66hIgx9y+4+7wgwTHCk2wTK392mTQyBuzmQrZHTPAC7X+CG8=.gDHGqQ0uxqybPnuTWIP9FewlB4eq0Qff6/1VEZKtYkQ=.cr3Hs5Ej8Dz5BHt1KkHXf/Mqrqb/1/hU28W3ZwFOjJY=");

Pure pure = new Pure(context);

If you're using Virgil Cloud for storing users' encrypted passwords and encryption keys, then simply continue the rotation process at the Virgil Dashboard by clicking "CONTINUE KEYS ROTATION" and following the instructions.

If you're using a custom storage, run the performRotation function:

Pure.RotationResults results = pure.performRotation();

Note! You don't need to ask your users for a new password.

Note! The SDK is able to work with two versions of a user's password record (old and new). This means that if a user logs into your system while you're performing the migration, the PureKit SDK will verify their password without any problems.

After you've updated your database records, it's required to update (rotate) your application credentials. For security reasons, you need to use the Virgil CLI utility.

Use Virgil CLI update-keys command and your update_token (UT) to update the app_secret_key (SK) and service_public_key (PK):

virgil purekit update-keys PK.*** SK.*** UT.***

If you are using your own storage, you have to navigate to PureKit configuration and replace your previous app_secret_key, service_public_key with the new ones.

It is necessary to delete update_token and the previous app_secret_key, service_public_key after rotation for security reasons.

Here is an example of how to configure PureKit with the new credentials:

PureContext context = PureContext.createContext(
    "AT.znqRZcOdzybj62Rzer897pX2DZ9KZoYF",
    "NM.Qs0YFBS7Mr3Aaa9qn4OCVcNC1wvPCXfUpZNWFCPUOUI=",
    "BU.MCowBQYDK2VwAyEAKWSBAZbbekJ5Ns36jRcjEiut3rH4rpaCCVnRxcB+d/E=",
    "SK.2.3JE4SAOXGC95nDOjOhCyTXZqdQmjaqz9mtZhIN9s/2g=.cFGlNRis9FQ77DW2fCpBcx+EI4SHv7guS1sPCnSRmx0=.rKEuUZePvcr6CdOTJkk0kd0kUAq1rSx0x2A9lUegQHo=",
    "PK.2.BCIeyCW9xDfbuYQb6CIJ7dMqujrjBlIysJs6dXxV+9FU9kxC60fD1dl/P/6TT2wJN8p9E16IPNt5OdJ6Tq3S6L0=.BGjcd5b4wzuGapBQXcUxVXnHWvscYMDbTWk1zxqejSruppcoVWzeYlF0z7GTT3HUdejdrFtbL6sRxD/wOu5jYAs=",
    null);

Pure pure = new Pure(context);