---
title: "Best practices: Managing cryptographic keys"
slug: "oas-ag-best-practices-managing-cryptographic-keys-3-28"
updated: 2025-11-24T12:52:19Z
published: 2025-11-24T12:53:54Z
canonical: "docs.onespan.com/oas-ag-best-practices-managing-cryptographic-keys-3-28"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Best practices: Managing cryptographic keys

- **Use the maximum key length.** When you create new keys, always use the maximum key length (256 bit for storage data, 128 bit for sensitive data).
- **Perform regular key rotation.** Cryptographic key rotation should be executed on all keys at least once a year (i.e. scheduled bulk rotation), or even more frequently if required by the security policy in place. More frequent key rotations typically equate to better security.
- **Perform on-the-fly key rotation.** It is highly advisable to rotate keys as soon as they are added (i.e. on-the-fly rotation). Combining scheduled bulk rotation and individual on-the-fly rotation constitutes sound security policy. For more information about performing key rotations individually or in bulk, see [Creating and managing cryptographic keys](/sec/docs/oas-ag-creating-and-managing-cryptographic-keys-3-28).
- **Handle old and compromised keys.** Implement a strict policy regarding old and compromised keys. Such a policy should include procedures for retiring, archiving, destroying, or revoking such keys, and should also include steps to address suspected compromised keys.
- **Limit key management privileges.** Limit the number of users with administrative privileges for key management, e.g. Rotate Key, or Create Key. By default, these privileges are not assigned to imported or newly created users.