Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have an app which uses an asymmetric key for encrypting/decrypting data between devices.
However, these devices should no longer be able to decrypt after a certain period of time.
Currently, I'm generating the keypair in the form of plain RSA and I can use the key indefinitely.
Is it possible to embed some sort of expiry date in the private and public keys such that when used after a certain date, the keys will simply just can't perform?
Yes you can design a protocol where key generator and key user agree on where this timestamp is saved (NB: next to the key bytes or inside the key bytes, but the later option is highly dangerous as it might reduce entropy so don't do it). You might need to also device some mechanism to make sure the date cannot be changed.
There are all kind of clever ways for that, but X.509 certificates already standardize this, so you might simply use them.
The owner of the secret key would have to check if the secret key matches the certificates public key, if the certificate is properly signed from a trusted issuer and the current time is well within the validity period.
"Embedding an expiry date" (as stated in the title) is the easy part and as Eckes has pointed out there are already standard wasy to do it. But these schemes usually rely on the cooperation of the participants. For example your browser usually will at least warn you if you connect to sites with expired certificates.
If you want to enforce the inability to encrypt the data after a certain date, this is one facet of controlling access for geerally legitamete users which is usually called DRM (a term seen rather negatively in some circles due to some debatable use cases). The problem there is not so much about the protocols but about the implementations. How do you prevent copies of the decrypted data? How do stop users "debugging" the software and extracting the keys? How prevent faking the time? Your users have the keys, but you want to prevent unlimited usage.
There are techniques that try to achieve this goal (with or without special hardware or OS support), but most of them have failed over sooner or later.
