If "DbBackupSchedule" option has been set to never during or after installation, make sure you created a database backup before creating a new key.
If you are using MetaDefender® MFT in High Availability setup please read this page as well.
The product uses a randomly generated cryptographic key to encrypt uploaded files and other secrets.
Manual encryption key generation
To generate a new cryptographic key:
- Go to "Settings" → "Security" → "Encryption."
- Click the "Generate Key" button.
- Confirm the action in the appearing window.
- Select "Cancel" to abort. Select "Confirm" to continue.
- The new cryptographic key will be generated, and a one-time chance to download it will be provided. Store it securely in a file.
- If storage is dismissed by mistake, generate a new encryption key. The previous key will be automatically removed by the system.
Automatic encryption key rotation
To enable automatic encryption key rotation:
Go to "Settings" → "Security" → "Encryption."
Toggle "Enable Encryption Key Rotation" switch element
Choose your preferable rotation schedule
- Change encryption key weekly
- Change encryption key monthly
Configure schedule details
- Weekly: choose one day of week + time
- Monthly: choose day of month (1-31) + time
Enter a path to store rotated keys
Click "Save Configuration"
Cleanup of obsolete keys can take significant time, and users may be locked out of MFT until the process completes. Plan rotations outside business hours to reduce disruption.
Weekly rotation is generally the most predictable option. If monthly rotation is required, select a stable day such as the 1st or 15th and run it during a non-peak time window.
The system uses the AES algorithm with CBC mode and PKCS7 padding to generate cryptographic keys. Newly created keys are stored as UTF8-encoded hexadecimal characters.
Once a new encryption key is generated, it will be used for all subsequent file uploads. Files uploaded prior will remain encrypted with the old keys.
Obsolete keys are automatically removed when all files encrypted with those keys are deleted. Manual process is not allowed.
Example
- File1 and File2 are encrypted with key A.
- User generates key B => key A becomes obsolete.
- User uploads File3.
- File3 is encrypted with key B.
- System runs a cleanup check and finds that key A is obsolete but is still used to encrypt files File1 and File2; thus, it is not removed.
- User generates key C => key B becomes obsolete similar to key A.
- User deletes files File1 and File3.
- System runs a cleanup check and deletes key B (obsolete + no encrypted files). Key A still has one file (File2) encrypted with it so it is left intact. Key C has no files encrypted with it but it is still the active key, so it remains intact, too.