Looking for cloud- or Unix-based open-source tools that support long-term enterprise-wide key/passphrase management and provide a programmatic API

Question

My question really is: how does an enterprise (a small ~150-employee company) manage the passphrases and encryption keys used at the time of encrypting a large volume of data, when such encrypted data is supposed to be in "cold storage", and available, for decades?

But this "underlying" question is perhaps too open-ended for this site, so I hope that answers to my "official" question in the title will point in the right direction.

---

^{The scenario alluded to above presents a serious conflict between the common practice of changing passphrases frequently, and the fact that the encrypted data is voluminous enough that could not be re-encrypted using a different key without a great deal of effort.}

Answer 1

I think you might want to consider GPG & it's keys, and possibly keyservers too if they might be useful.

• It's the only encryption software I can think of now that's already been working well for decades, and will probably be around in future decades
• Can have multiple recipients (users) able to decrypt something, or possibly only encrypt a "master key" for an archive, then encrypt the master key file for multiple users, and add or change users without needing to re-encrypt the entire archive (the master key stays the same, similar to the LUKS master key & passphrases model)
• You can change a secret key's passphrase without needing to create a whole new secret key