Cryptography
Key Rotation
Also known as: Cryptoperiod rotation, Key roll-over
Definition
The periodic replacement of cryptographic keys with new ones to limit the volume of data protected by any single key and contain the impact of compromise.
Examples
- AWS KMS rotates the underlying key material of a CMK every year while keeping the same key ID.
- Rotating an HMAC signing key used by an API every 90 days with a 7-day grace period.
Related terms
Cryptographic Key
A high-entropy secret or public value that parameterizes a cryptographic algorithm to encrypt, decrypt, sign or authenticate data.
Key Derivation Function (KDF)
A cryptographic function that derives one or more strong cryptographic keys from a secret input such as a password, shared secret or master key.
Key Escrow
An arrangement in which copies of cryptographic keys are stored with a trusted third party so they can be recovered by authorized entities under defined conditions.
Session Key
A short-lived symmetric key used to protect a single communication session and then discarded.
Master Key
A high-value long-term key from which other cryptographic keys are derived or which directly encrypts other keys.
Perfect Forward Secrecy
A protocol property ensuring that the compromise of long-term keys does not allow decryption of past session traffic.