Key encryption key rotation

An apparatus for encryption key handling at a set of hardware security modules (HSMs), comprising:

• a processor;
• memory in electronic communication with the processor;
• and
• instructions stored in the memory and executable by the processor to cause the apparatus to:
• generate, at a first HSM of the set of HSMs, a second key encryption key (KEK) based at least in part on an initiation of a key rotation process;
• propagate the second KEK to a different second HSM of the set of HSMs and to the other HSMs of the set of HSMs;
• identify, at the second HSM, a first KEK and the second KEK stored in the set of HSMs;
• retrieve, from a database and at the second HSM, a set of encryption keys encrypted by the first KEK;
• decrypt, at the second HSM, each encryption key of the set of encryption keys using the first KEK;
• re-encrypt, at the second HSM, each encryption key of the set of encryption keys with the second KEK;
• determine, at the second HSM, each encryption key of the set of encryption keys is encrypted by the second KEK;
• transmit, from the second HSM to the database, the set of encrypted encryption keys encrypted by the second KEK for storage, and an identifier associated with the second KEK;
• and
• delete the first KEK from the set of HSMs, wherein deleting the first KEK is based at least in part on determining each encryption key of the set of encryption keys is encrypted by the second KEK.

A non-transitory computer-readable medium storing code for encryption key handling at a set of hardware security modules (HSMs), the code comprising instructions executable by a processor to:

• generate, at a first HSM of the set of HSMs, a second key encryption key (KEK) based at least in part on an initiation of a key rotation process;
• propagate the second KEK to a different second HSM of the set of HSMs and to the other HSMs of the set of HSMs;
• identify, at the second HSM, a first KEK and the second KEK stored in the set of HSMs;
• retrieve, from a database and at the second HSM, a set of encryption keys encrypted by the first KEK;
• decrypt, at the second HSM, each encryption key of the set of encryption keys using the first KEK;
• re-encrypt, at the second HSM, each encryption key of the set of encryption keys with the second KEK;
• determine, at the second HSM, each encryption key of the set of encryption keys is encrypted by the second KEK;
• transmit, from the second HSM to the database, the set of encrypted encryption keys encrypted by the second KEK for storage, and an identifier associated with the second KEK;
• and
• delete the first KEK from the set of HSMs, wherein deleting the first KEK is based at least in part on determining each encryption key of the set of encryption keys is encrypted by the second KEK.