CyberGlossary

Cryptography

Key Rotation

Also known as: Cryptoperiod rotation, Key roll-over

Definition

The periodic replacement of cryptographic keys with new ones to limit the volume of data protected by any single key and contain the impact of compromise.

Key rotation is the operational practice of regularly generating new cryptographic keys and retiring older ones, while keeping enough overlap to decrypt previously protected data. Rotation limits the amount of ciphertext or signed material that an attacker can compromise with a single stolen key, supports cryptoperiod policies (e.g., NIST SP 800-57), enables migration to stronger algorithms, and is required by standards such as PCI DSS, FIPS 140-3 and SOC 2. Common patterns include key versioning (keys numbered, e.g., v1, v2), envelope encryption with rotating data-encryption keys under a stable key-encryption key, and automated rotation via KMS services like AWS KMS, Azure Key Vault or Google Cloud KMS. Rotation must be paired with monitoring, secure key destruction, and a rollback plan for failed deployments.

Examples

  • AWS KMS rotates the underlying key material of a CMK every year while keeping the same key ID.
  • Rotating an HMAC signing key used by an API every 90 days with a 7-day grace period.

Related terms