Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -49,4 +49,4 @@ The next 128 bits, or 16 bytes is the key identifier (80 9C 81 0C 19 66 19 40 95
The remainder contains the payload and is specific to the format used.

> [!WARNING]
> All payloads protected to a given key will begin with the same 20-byte (magic value, key id) header. Administrators can use this fact for diagnostic purposes to approximate when a payload was generated. For example, the payload above corresponds to key {0c819c80-6619-4019-9536-53f8aaffee57}. If after checking the key repository you find that this specific key's activation date was 2015-01-01 and its expiration date was 2015-03-01, then it's reasonable to assume that the payload (if not tampered with) was generated within that window, give or take a small fudge factor on either side.
> All payloads protected to a given key will begin with the same 20-byte (magic value, key id) header. Administrators can use this fact for diagnostic purposes to approximate when a payload was generated. For example, the payload above corresponds to key {aaaaaaaa-0b0b-1c1c-2d2d-333333333333}. If after checking the key repository you find that this specific key's activation date was 2015-01-01 and its expiration date was 2015-03-01, then it's reasonable to assume that the payload (if not tampered with) was generated within that window, give or take a small fudge factor on either side.
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ Keys exist as top-level objects in the key repository. By convention keys have t

```xml
<?xml version="1.0" encoding="utf-8"?>
<key id="80732141-ec8f-4b80-af9c-c4d2d1ff8901" version="1">
<key id="aaaaaaaa-0b0b-1c1c-2d2d-333333333333" version="1">
<creationDate>2015-03-19T23:32:02.3949887Z</creationDate>
<activationDate>2015-03-19T23:32:02.3839429Z</activationDate>
<expirationDate>2015-06-17T23:32:02.3839429Z</expirationDate>
Expand Down Expand Up @@ -50,7 +50,7 @@ The \<key> element contains the following attributes and child elements:

* A \<descriptor> element, which contains information on the authenticated encryption implementation contained within this key.

In the above example, the key's id is {80732141-ec8f-4b80-af9c-c4d2d1ff8901}, it was created and activated on March 19, 2015, and it has a lifetime of 90 days. (Occasionally the activation date might be slightly before the creation date as in this example. This is due to a nit in how the APIs work and is harmless in practice.)
In the above example, the key's id is {aaaaaaaa-0b0b-1c1c-2d2d-333333333333}, it was created and activated on March 19, 2015, and it has a lifetime of 90 days. (Occasionally the activation date might be slightly before the creation date as in this example. This is due to a nit in how the APIs work and is harmless in practice.)

## The \<descriptor> element

Expand All @@ -74,7 +74,7 @@ For revocations of individual keys, the file contents will be as below.
<?xml version="1.0" encoding="utf-8"?>
<revocation version="1">
<revocationDate>2015-03-20T22:45:30.2616742Z</revocationDate>
<key id="eb4fc299-8808-409d-8a34-23fc83d026c9" />
<key id="bbbbbbbb-1c1c-2d2d-3e3e-444444444444" />
<reason>human-readable reason</reason>
</revocation>
```
Expand Down
4 changes: 2 additions & 2 deletions aspnetcore/security/key-vault-configuration.md
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ The X.509 certificate is managed by the OS. The app calls <xref:Microsoft.Extens
Example values:

* Key Vault name: `contosovault`
* Application ID: `627e911e-43cc-61d4-992e-12db9c81b413`
* Application ID: `00001111-aaaa-2222-bbbb-3333cccc4444`
* Certificate thumbprint: `fe14593dd66b2406c5269d742d04b6e1ab03adb1`

`appsettings.json`:
Expand Down Expand Up @@ -516,7 +516,7 @@ The X.509 certificate is managed by the OS. The app calls <xref:Microsoft.Extens
Example values:

* Key Vault name: `contosovault`
* Application ID: `627e911e-43cc-61d4-992e-12db9c81b413`
* Application ID: `00001111-aaaa-2222-bbbb-3333cccc4444`
* Certificate thumbprint: `fe14593dd66b2406c5269d742d04b6e1ab03adb1`

`appsettings.json`:
Expand Down
Loading