-
Type:
Task
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: None
-
Server Security
-
Fully Compatible
-
Server Security 2026-03-27, Server Security 2026-04-10, Server Security 2026-06-19, Server Security 2026-07-03, Server Security 2026-07-17, Server Security 2026-07-31, Server Security 2026-08-14, Server Security 2026-08-28, Server Security 2026-09-11, Server Security 2026-09-25, Server Security 2026-10-09, Server Security 2026-10-23, Server Security 2026-11-06, Server Security 2026-11-20
-
None
-
None
-
None
-
None
-
None
-
None
-
None
From a security perspective, we need to guarantee that a KEK has not been used 2^32-1 times to perform encryption. This follows a security guideline outlined by section 8.3 of [NIST GCM recommendations|section 8.3 of https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf].
This will likely have to be persisted in the keystore itself.