keyset

A keyset is a collection of cryptographic keys stored and managed as a unit, used by security libraries to perform operations such as encryption, decryption, signing, and verification. Keysets help organize multiple keys and support key rotation and lifecycle management.

Typically a keyset contains multiple keys, each with a unique key_id, a status (ENABLED, DISABLED, DESTROYED), and metadata describing the algorithm, key type (symmetric or asymmetric), and possibly an output prefix type. A keyset also designates a primary key id that identifies the key used to generate operation prefixes and to select keys for certain operations.

In practice, keysets are used by cryptographic libraries and key management services. They may be represented in JSON or binary formats and can underpin envelope encryption, where a data key is used to encrypt data and the data key itself is protected by the keyset. Many libraries separate key material from application data and rely on the keyset to manage which keys are active and how data is processed.

Lifecycle and rotation: new keys can be added, and a primary key can be changed to rotate the active key without invalidating previously encrypted data. Existing enabled keys remain usable for decryption if the ciphertext contains the corresponding prefix. Disabled keys may be retained for audit or future use but are not selected for new operations.

Security considerations: keysets should be protected at rest and in transit, using strong access control, auditing, and integrity checks. Access to key material should be minimized, and backups should be protected. Proper lifecycle management reduces the risk of compromised keys and aids compliance.