Feature Spotlight: Automatic Key Management

This is the first part in a series of posts covering new (and old) features of Duende IdentityServer. These posts are
not supposed to be super technical deep dives (that’s what documentation is for), but rather explain the feature at a
more conceptual level, why it exists, and why it might useful for you.

The Problem

Obviously, a very important part of a security token service is the key material to sign the actual security tokens.
Also, we all know that it would be good security/crypto hygiene to rotate that key material periodically.

In practice (telling from over 15 years of experience with customers of all industries) this is rarely done. The reason
for that is not, that people are ignoring best practices, but rather that it is not trivial to do it properly. It needs
to be automated, and it needs to work very reliably to not cause issues with production environments.

It turns out OpenID Connect and the discovery mechanism were designed right from the start for both periodic and
emergency updates to the key material. Also, IdentityServer always included the primitives to implement any custom
rotation logic you might want – but it was pretty low-level. In fact
Brock wrote about this back in 2019
already.

While many people consider the signing key for tokens the “crown jewels”, in every ASP.NET Core application, there is
another key at play called the “data protection key”. This key is used to protect many features in ASP.NET Core
including things like authentication cookies. If you think about it, this key is even more sensitive than your token
signing key because if it gets compromised it could be used to create SSO cookies for the token service which in turn
would lead to issuing tokens.

So in reality you have to protect two keys. Data protection already has a rich ecosystem of plugins and storage
abstractions to find good solution for both on-premise and cloud hosting. This includes support for databases, blob
storage and key management services like Azure KeyVault and KMS.

The Solution

Once data protection is in place, you can use it to – well – protect data, for example your signing keys. So, what we
did in Duende IdentityServer key management, is to combine automatic signing key creation, rotation and retirement with
ASP.NET Core data protection to also enable secure storage.

What this means in practice is that instead of you dealing with signing keys yourself all you need to define is:

• What types of keys do you want? RSA or elliptic curves?
• What signing algorithm(s) do you need (e.g. RS256, ES256, PS256)?
• Should those keys be wrapped in an X.509 certificate?
• How often should those keys be rotated?
• How long before the rotation should the new keys be announced in discovery?
• How long should the old keys be kept around for validation?

(or you just use our defaults)

In code this could look like this:

var builder = services.AddIdentityServer(options =>
{
    // how often do we want new keys
    options.KeyManagement.RotationInterval = TimeSpan.FromDays(90);
    
    // when should the keys disappear from discovery
    options.KeyManagement.RetentionDuration = TimeSpan.FromDays(7);
    
    // how long before announcement to rotation
    options.KeyManagement.PropagationTime = TimeSpan.FromDays(7);
});

And all this is combined with our standard configuration storage mechanism (or custom) that in turn is backed by ASP.NET
Data Protection.

Key management is included in our preview 1 of Duende
IdentityServer and is a feature of the business edition and up. It is enabled by default.

The initial version only manages a single key, but in preview 2 we will publish the multi-key feature. Please give it a
try and give us feedback via our issue tracker.