Cryptographic Key Rotation

Objective

Refreshing the security credentials of a Domain Service while maintaining the Chain of Trust and ensuring zero downtime for the application.

The Protocol Workflow

1. Generation: The Domain Service generates a new Service Key-Pair.
2. Rotation Request: The service constructs a payload containing the new Service Public Key and signs it with its current (old) Service Private Key.
3. Registry Submission: The service sends a request to the App Registry.
   provisional payload

   {
     "version": "1.0",
     "data": {
       "new_public_key": "PUB_KEY_V2_ABC...",
       "rotation_timestamp": 1705412600,
       "nonce": "m5n8b2v1",
       "context": "key_rotation"
     },
     "signature": "e5f6a7b8c9d0..." 
   }
4. Verification: The Registry verifies that the signature was created by the key currently authorized for that service_id.
5. Commit: The Registry updates the record, archives the old key for a “grace period,” and activates the new key.
6. Propagation: The Registry broadcasts an invalidation signal to the core services (Auth Provider and the Billing Service).
   provisional payload

   {
     "version": "1.0",
     "data": {
       "origin": "omiappreg.org",
       "app_id": "org.omiappreg.alice.business_app.7f8a9d",
       "service_id": "cms-article-77",
       "event": "KEY_ROTATION",
       "old_public_key": "PUB_KEY_V1_OLD...",
       "new_public_key": "PUB_KEY_V2_NEW...",
       "grace_period_expiry": 1705412900,
       "timestamp": 1705412610,
       "nonce": "n7b2v9x4"
     },
     "signature": "s8d7f6g5h4j3k2l1..."
   }