Key rotation
Replacing a cryptographic key with a new one on a schedule, its cryptoperiod, or after a suspected compromise, while keeping old keys available to decrypt or verify existing data until it is re-encrypted or expires. Rotation limits how much data one key protects; it does not undo a past compromise.
- Also called
- rotating keys
- Defined in
- NIST glossary: Key Rotation
Covered in
Envelope encryption and key rotation: data keys, KMS keys and backups
Encrypt each record with its own data key, wrap that key in a KMS or HSM key, and keep wrapping-key rotation, data re-encryption, key deletion and restored backups as separate, tested operations.
Case study: Storm-0558 and the forged Microsoft tokens (2023)
How a stolen 2016 consumer signing key and a token validation gap let Storm-0558 read enterprise Exchange Online mail in 2023, and what the review board found about rotation, logging and culture.
Practice: Local project: Bind ciphertext to the correct record