Why You Need to Rotate Your Signing Keys

For these tokens to be trusted by your applications, they need to be able to verify them. This means that when using JSON Web Tokens (JWTs), they must be signed by IdentityServer.

If the private keys used by IdentityServer to sign these tokens are compromised, then attackers can generate whatever access tokens they wish and do untold damage.

Protecting Your Keys

In the safe cracking world, safe makers will not warrant a safe as "uncrackable", but they will state that the safe is "uncrackable within a given time period".

So, if a guard physically checks on the safe during the warranty interval, you should be okay.

Signing keys are similar to items in the safe. We cannot guarantee they will never be stolen or compromised. But as long as we put measures in place to ensure that by the time they are compromised, they have become useless, then that is a win.

The time period for replacing keys will change over time as computing power changes. With today's computing power, 90 days would probably be sufficient. With quantum on the horizon, this may very well become a lot shorter very quickly.

As the IdentityServer administrator, you could set a diary entry to remind you to change the keys, but we all know how well that will play out. It is also not a matter of only replacing keys, as that would immediately require all applications to re-request tokens.

We need to phase out old keys and bring in new ones within a given window to avoid putting undue load on the system.

Implementing this manually is not going to be viable.

Automatic Key Rotation for IdentityServer

Our Key Rotation component automatically rotates keys for you, taking this process out of your hands. Rotating keys 90 days, 45 days or even 7 days can happen automatically.

Key Rotation utilises the ASP.NET Core Data Protection libraries to ensure that these keys are stored securely and remain available in a clustered environment, providing full protection.