Google CSE Backup & Re-wrap
PreviousView Google CSE Files Wrapped by Workspace KeyNextSupported services, applications, and data types with Google CSE
Last updated
Last updated
You're using Google Workspace Client-Side Encryption (CSE) with Key Service A (e.g., Oten KMS). Now you need to switch to Key Service B (maybe upgrading to a new version, changing vendors, or consolidating services).
The challenge: Thousands of files are already encrypted with Key Service A. How do you switch without:
Breaking access to existing files?
Requiring users to re-encrypt everything manually?
Causing downtime?
The solution: Google's Rewrap feature coordinates with your KMS providers to automatically re-encrypt all Data Encryption Keys (DEKs) in the background while users continue working normally.
Understanding the architecture helps clarify who does what during migration.
The Three Players
Your Old Key Service remains connected so the New one can call it to unwrap old DEKs during migration.
The "Backup" configuration does TWO things:
The "Backup" is NOT:
The "Backup" IS:
This tells Google to include
original_kacls_urlin rewrap requests, pointing to your Old Key Service
Migration starts immediately - Google begins sending
/rewraprequests to your New Key Service
Monitor your Key Service logs for:
Once migration counter shows 0 items:
After this, you can decommission Old Key Service (but keep key material for potential recovery)
Only ONE backup service per KMS at a time.
For Rewrap: Tells the New Key Service where to send /unwrap requests for old DEKs
For User Access: Allows Google to route decryption requests to Old Key Service for files not yet migrated
A copy of your data
A snapshot of your keys
A disaster recovery mechanism
Managed by Google
Your Old Key Service that must stay running
A configuration that enables Key Service-to-Key Service communication
Your responsibility to maintain
Super Administrator account for Google Workspace
Old Key Service running and accessible
New Key Service deployed with /rewrap implemented
New Key Service configured with Old Key Service credentials
Go to Google Admin Console
Navigate to Data > Compliance > Client-side encryption
Click Add new service
Enter New Key Service details:
Name: Your new service name
URL: https://new-key-service.example.com
Critical: Under "Select backup key", choose your Old Key Service
In Client-side encryption, click Assign
Select your Organizational Unit or Group
Under "Key service", select your New Key Service
Toggle Migration to ON
Confirm and Save
Go back to Assign section
Select your Organizational Unit
Check the Migration counter
Status
Meaning
X items remaining
X files still using Old Key Service
0 items
All DEKs migrated to New Key Service
/rewrap requests from Google
/unwrap calls to Old Key Service
Any errors or failures
Go to Key Service list
Select your New Key Service
Click Remove backup
Trigger
Admin enables Migration toggle
Google's action
Sends /rewrap to New Key Service for each file
New Key Service's action
Calls Old Key Service /unwrap, then wraps with new KEK
Result
DEKs permanently converted to New Key Service format
Trigger
User opens file not yet migrated
Google's action
Sends /unwrap to Old Key Service (Backup)
Old Key Service's action
Unwraps DEK and returns to Google
Result
User gets access; file stays with Old Key Service until rewrap reaches it
Trigger
New Key Service has critical failure
Admin's action
Click "Disable & use backup"
Google's action
Routes ALL requests to Old Key Service
Result
Old Key Service handles all encrypt/decrypt until Key Service KMS recovers
Service
Rewrap via Admin Console?
Drive, Docs, Sheets, Slides
Yes
Calendar, Meet
Yes
Gmail
No - requires Gmail API
No email when migration completes
No progress bar
Admins must manually check the counter