nøkkelrevokasjon

Key revocation (nøkkelrevokasjon) refers to the process of invalidating a cryptographic key before its scheduled expiration. This practice is essential in maintaining the security of systems that rely on asymmetric or symmetric keys for authentication, encryption, or digital signatures. When a key is compromised, misused, or retained longer than necessary, revocation prevents unauthorized parties from continuing to use it.

In public‑key infrastructures (PKI), key revocation is typically managed through revocation lists such as certificate revocation lists (CRLs) or online certificate status protocols (OCSP). These mechanisms publish information about revoked certificates so that relying parties can verify a key’s validity in real time. Other approaches include using short‑lived certificates, time‑stamping, or key rotation schedules that reduce the window of exposure.

Symmetric key revocation is less standardized; it often relies on key management protocols that replace keys at agreed intervals or upon detection of compromise. Some systems employ cryptographic key escalation or the use of hierarchical key structures where a master key governs the generation of session keys, simplifying revocation by rotating the master key.

Legal frameworks in many jurisdictions, such as the European Union’s GDPR or industry regulations like PCI‑DSS, mandate timely revocation of compromised credentials. Failure to revoke keys can lead to data breaches, fines, or loss of customer trust. Therefore, robust revocation procedures are a cornerstone of secure key lifecycle management and are regularly audited as part of broader cybersecurity governance.