Ex: Re: Datasealer key rotation and CAS

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Tuesday, October 27, 2020 5:38 AM
> 
> In fact, to be clear, the code doesn't deal in "new" or "old". The fact I use
> numbers by default was just an obvious convenience to make it easy to
> produce unique labels. All the code knows is "default" or "not default, must
> read from keystore".

Oh, okay; I misunderstood the purpose of the refresh interval. I had assumed it was how often it looked to see if the keystore had changed and reload the keys within. But it seems its purpose is only to check and see if the default key has changed so it could start using it to encrypt stuff. So as long as the keystore is updated on all of the nodes at the same time, while each node might start using the newest key for encryption purposes at a different time, all of them will be able to decrypt stuff encrypted by other nodes with said key.

Thanks for the clarification, that makes a lot more sense.