Re-Encrypt

This guide explains how to use the Re-Encrypt operation to transition your encrypted data to a new key seamlessly.

How Re-Encryption Works

The Re-Encryption operation decrypts and re-encrypts ciphertext entirely within Exoscale KMS, ensuring the underlying plaintext is never exposed to your application layer or transmitted over the network. You can use this operation to transition encrypted data (such as an enveloped Data Encryption Key, or DEK) to a completely different KMS key. Alternatively, you can re-encrypt the data under its current KMS key. Whenever you do this, KMS automatically encrypts the data using the latest available version of the key material, making this the standard method for updating your ciphertext after a key rotation. The operation also allows you to optionally set a new encryption context. Because of this, you can choose to re-encrypt data under the same KMS key solely to update its encryption context.

The process happens entirely within the Exoscale KMS secure boundary:

Decrypt: The service uses the source KMS key and your source encryption context (AAD) to recover the plaintext internally.
Encrypt: It immediately encrypts that plaintext using the destination KMS key and your target encryption context (AAD).
Return: The newly generated ciphertext is returned safely to your application.

The destination KMS key you reference must be compatible with the operation. Specifically, the key must be enabled, be of the same key type, and have the encrypt-decrypt usage permission.

Using the Exoscale CLI

You can perform this operation using the dedicated exo kms crypto reencrypt command. Ensure your CLI is configured for the zone where your source key is located, or use the --zone flag.

Re-encrypt a ciphertext:

exo kms crypto reencrypt <source-key-uuid> <destination-key-uuid> <base64-encoded-source-ciphertext> --zone <zone-name>

Using the Exoscale API

You can perform this operation using the Exoscale API. When running this command, ensure you are targetting the zone where your source key is located.

You must provide the payload as a JSON string containing the source and destination details.

Re-encrypt a ciphertext:

exo api re-encrypt <source-key-uuid> --zone <zone-name> <<< '{
  "source": {
    "key": "<source-key-uuid>",
    "ciphertext": "<base64-encoded-source-ciphertext>"
  },
  "destination": {
    "key": "<destination-key-uuid>"
  }
}'

Encryption Context

If your original ciphertext was encrypted using an Additional Authenticated Data (AAD) context, you must provide it in the source. You can also specify a new, optional encryption context for the destination. All contexts and ciphertexts must be Base64-encoded.

With the API:

exo api re-encrypt <source-key-uuid> --zone <zone-name> <<< '{
  "source": {
    "key": "<source-key-uuid>",
    "ciphertext": "<base64-encoded-source-ciphertext>",
    "encryption-context": "<base64-encoded-source-context>"
  },
  "destination": {
    "key": "<destination-key-uuid>",
    "encryption-context": "<base64-encoded-destination-context>"
  }
}'

With the CLI:

You must provide it using the –source-encryption-context (or -s) flag. You can also specify a new encryption context for the destination using the –dest-encryption-context (or -d) flag. All contexts and ciphertexts must be Base64-encoded.

exo kms crypto reencrypt <source-key-uuid> <destination-key-uuid> <base64-encoded-source-ciphertext> \
  --source-encryption-context "<base64-encoded-source-context>" \
  --dest-encryption-context "<base64-encoded-destination-context>" \
  --zone <zone-name>

Last updated on July 22, 2026