After rotating a Vault symmetric key used for permit PDFs, last mon…

Question

After rotating a Vault symmetric key used for permit PDFs, last month’s ciphertext must still decrypt. What does rotation do?

Accepted Answer

Generates a new key version under the same key OCID; new encrypts use the latest version while older versions remain so prior ciphertext still decrypts. — Rotation adds a new version of the same key—the OCID stays put. Fresh locks use the new version; old versions remain so last month’s PDFs still open. Do not delete history the day you rotate.

Answer

Deletes every prior key version immediately so old ciphertext can never be read again.

Answer

Creates an entirely new key resource with a new OCID and abandons the previous OCID.

Answer

Converts the symmetric key into an asymmetric key automatically and drops version tracking.

After rotating a Vault symmetric key used for permit PDFs, last month’s ciphertext must still decrypt. What does rotation do?

Short Explanation

Full Explanation