I need to encrypt user entered data in my java based web-application (using jasypt) which is persisted in a MySQL Database and I want to be able to change the encryption key/passphrase in a regular interval (e.g. 90 days). The application lives on a server in the web.

The existing already encrypted data would need to be reencrypted with the new key, but in order to do so it would of course need the old key.

  1. What are common practises to rotate the keys?
  2. What are common ways to make the encryption keys available to the system (e.g. System properties passed via commandline, encrypted properties files, downloading from another server via https)

I expect there is no single answer to this but I would like to get some hints, pointers and buzzwords to investigate in the right direction.

java security
Edit
Report