Skip to main content

Expire Key in Cpp

The following code sample expires a key, shows that every later use of it is refused, then removes the key and shows that it is gone.

  • Expire (TEKey::expireKey). The key's record is kept: its access control list can still be read, with its expiration flag set. Every later use of the key -- decrypt, encrypt under its t-Tag, export, an access-control update -- is refused with TEKey::CODE_KEY_EXPIRED (0x0406), on every key server of the deployment. An expiry is never undone.
  • Remove (TEKey::removeKey). The key, its access control list and every cached copy are deleted from the key server, and every later use is refused with TEKey::CODE_NO_SUCH_KEY (0x0404). An expired key can still be removed by its owner. Removal is local to that key server: a copy of the key exported earlier (TEKey::exportKey) is not reached, and can be imported again.

Both take a list of t-Tags and answer one result per key, in request order, through their results overloads: RESULT_EXPIRED or RESULT_ALREADY_EXPIRED for an expiry, RESULT_REMOVED for a removal, or the key server's error code for a key it refused. Each key is applied on its own: one refused key neither stops nor undoes the others. The overloads without results throw when any key is refused, after every other key was applied. Both need the Encryptor role's Expire Key and the OWNER right on each key -- the principal that created a key owns it.

Code Sample​

See the C++ environment settings for details on setting the project environment.

cpp_expire_key.cpp​

The complete source for this sample is published in the SDK reference and is the maintained copy:

cpp_expire_key.cpp

Run as a principal holding the Encryptor role, it prints:

decrypted: Test Data
expired
decrypt refused, the key is expired: 0x0406
removed
decrypt refused, no such key: 0x0404
Done!