reclave

Reclave is a term used in information security to denote the act of issuing a new cryptographic key to replace an existing key, typically as part of a key rotation or rekeying workflow. The word combines the prefix re- with clave, meaning key in some languages, but it is not a standardized term across all professionals or standards. In many contexts, practitioners use rekey or key rotation to describe the same concept, and reclamation of terminology varies by organization or vendor documentation.

In practice, reclave involves generating a new key, updating key management system metadata, and re-encrypting data or rewrapping keys so that protection rests on the new key. It can apply to data at rest, data in transit, or both, and is common in cloud environments, enterprise PKI, and hardware security module (HSM) workflows. Reclave is often part of broader security policies around key lifecycle management, including key generation, distribution, rotation, revocation, and retirement.

The process typically includes creating a secure new key, securely distributing access to authorized systems, re-encrypting or re-wrapping data with the new key, updating access controls and audit logs, validating data integrity, and retiring the old key after successful re-encryption. Potential challenges include performance impact, ensuring no data remains encrypted with the old key, and maintaining backward compatibility with systems that hold the old keys.

See also: rekeying, key rotation, envelope encryption, key management.