Secure replaceable verification key architecture in a memory sub-system

A method comprising:

• receiving, at processing device of a memory sub-system, from a host system, a key manifest and a digital signature, the digital signature being generated based on the key manifest using a private key corresponding to a key pair, the key pair comprising the private key and a public key stored in an immutable storage component of the processing device, the key manifest comprising one or more verification keys and a security version, the security version comprising a major value and a minor value, the major value indicating whether one or more keys are being replaced or revoked due to a security event, the minor value indicating whether one or more keys are being replaced due to a non-security event;
• verifying the digital signature using a public key of the key pair;
• validating the security version of the key manifest based on a comparison of the security version to a current security version associated with a previously stored key manifest, the validating of the security version of the key manifest comprises determining the major value of the security version is greater than or equal to a major value of the current security version associated with the previously stored key manifest;
• storing the key manifest in a persistent storage component in response to successful verification of the digital signature and validation of the security version of the key manifest;
• and
• utilizing the one or more verification keys in one or more verification operations based on the key manifest being stored in the persistent memory component.

A memory sub-system comprising:

• at least one memory component to store a set of key manifest verification keys;
• and
• a processing device, operatively coupled with the at least one memory component, to perform operations comprising:
• receiving, from a host system, a key manifest and a digital signature, the digital signature being generated based on the key manifest using a private key corresponding to a public/private key pair, the key manifest including a security version and specifying a first key manifest verification key from the set of key manifest verification keys to be revoked, the security version comprising a major value and a minor value, the major value indicating whether one or more keys are being replaced or revoked due to a security event, the minor value indicating whether one or more keys are being replaced due to a non-security event;
• verifying the digital signature using a public key of the public/private key pair;
• validating the security version of the key manifest based on a comparison of the security version to a current security version associated with a previously stored key manifest, the validating of the security version of the key manifest comprises determining the major value of the security version is greater than or equal to a major value of the current security version associated with the previously stored key manifest;
• and
• based on successful verification of the digital signature and validation of the security version, revoking the first key manifest verification key.