---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Key Management Framework Key Exchange

# Key Management Framework Key Exchange {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

KMF
Key Exchange is a subset function of KMF
Resource Exchange. Key Exchange securely transfers encrypted
data across multiple instances.

## Overview of Key Exchange {#kmf-key-exchange-overview__section_qk4_3sm_tnb}

Key Exchange securely transfers keys across instances.

KMF
Key Exchange provides a secure way for customers to exchange KMF keys between instances. One application use case is the data cloning process. With Key Exchange, crypto module keys are copied over during the data cloning of KMF components. Cryptographic modules, module key specifications, and module access policies are included in the cloning process. Transfer of keys isn't included.

This functionality is included with the Key Management Framework, which is included in the ServiceNow AI Platform Encryption subscription bundle. For details on this product, see [Key Management Framework](https://servicenow-prod.fluidtopics.net/q6czxeDhuxcM~173nSor7w "Use the Key Management Framework (KMF) to generate, exchange, store, use, and replace the cryptographic keys used to encrypt and decrypt sensitive data on your ServiceNow instance.").

## Using Key Exchange {#kmf-key-exchange-overview__section_uky_prq_b4b}

Administrators who use KMF for Field Encryption can use Key Exchange to clone the keys between production instances when performing data cloning. In data cloning, the administrator/ KMF cryptographic manager can perform the following:

* Exchange all keys to the other instances.
* Exchange particular keys one time or periodically to the other instance.
* Send on-demand requests from the target instance to the key source instance.
* Exchange keys from source to target for rekeying ciphertext.
  * Manage the expiration time of the request with the ability to delete keys or reject the key exchange request if the request has expired.
  * After the request is completed and the key is imported, the used key will be set as expired and timestamped.
  * Rekey ciphertext on the target instance that was encrypted with keys from the source.
  {#kmf-key-exchange-overview__ul_ffm_lkt_qpb}
{#kmf-key-exchange-overview__ul_hv1_kst_tnb}

## Supported modes {#kmf-key-exchange-overview__section_ptp_4vq_b4b}

Key Exchange supports several modes on the encryption module crypto
specification level:  
{#kmf-key-exchange-overview__table_sdk_z5t_tnb__entry__2}

| Mode | Description |
|-|-|
| Automatic (no configuration, default behavior) | All keys are sent over automatically during the data cloning process without additional configuration. |
| Configurable (one-time configuration setup) | The administrator configures the keys to be sent over during the data cloning process. |
| Manual (person in the loop) | The administrator sends an on-demand request on the target instance to the source. The request must be approved by an administrator on the key source instance. |
| Rekey (automated request) | The administrator selects the option of rekey during the cloning setup process. |
[ ]

{#kmf-key-exchange-overview__table_sdk_z5t_tnb}