Durable cryptographic keys

A computer-implemented method, comprising:

• obtaining a request for a first cryptographic key;
• selecting, based at least in part on parameters of the request indicating a durability duration, a public cryptographic key from a plurality of public cryptographic keys, wherein each of the plurality of public cryptographic keys has a corresponding private cryptographic key in a set of private cryptographic keys;
• applying the selected public cryptographic key to generate an encrypted first cryptographic key, the encrypted first cryptographic key being decryptable using a corresponding private key from the set of private cryptographic keys, the private cryptographic key being scheduled to be destroyed at a time corresponding to the durability duration;
• storing the encrypted first cryptographic key;
• and
• making the first cryptographic key available for use for an amount of time corresponding to the durability duration.

A system, comprising:

• memory storing instructions which, if executed by one or more processors of the system, cause the system to at least:
• obtain a request for a first cryptographic key, wherein the request includes parameters indicating a durability duration for the first cryptographic key;
• select, based at least in part on the parameters, a second cryptographic key from a set of cryptographic keys;
• use the selected second cryptographic key to encrypt the first cryptographic key such that:
• for a first amount of time corresponding to the durability duration, the first cryptographic key is recoverable from the encrypted first cryptographic key;
• after the first amount of time has passed, the first cryptographic key is irrecoverable from the encrypted first cryptographic key;
• and
• the second cryptographic key is scheduled to be destroyed corresponding to the durability duration;
• and
• provide the first cryptographic key to be available, in response to the request, for use for an amount of time corresponding to the durability duration.

A non-transitory computer-readable storage medium comprising executable instructions that, if executed by one or more processors of a computer system, cause the computer system to at least:

• determine a durability duration based at least in part on parameters included in an obtained request for a first cryptographic key;
• encrypt the first cryptographic key such that the first cryptographic key is decryptable using a second cryptographic key, wherein the parameters of the request indicate that the second cryptographic key has a limited lifetime before being destroyed in accordance with a durability duration;
• and
• cause the first cryptographic key to be available for use for a period of time that ends after the limited lifetime for the second cryptographic key has passed.