Keys are used to protect specific data. Therefore, the security of the data depends on the security of its keys. You can regularly rotate keys between key versions to improve key security and implement security policies and best practices for data protection.

Achieve security goals

You can regularly rotate keys to achieve the following goals:
  • Reduce the amount of data encrypted based on each key

    The security of a key is inversely proportional to the amount of data encrypted based on the key. This amount is usually defined by the total bytes of data or the total number of messages that are encrypted based on the same key. For example, National Institute of Standards and Technology (NIST) defines the secure lifecycle of a key in Galois/Counter Mode (GCM) as the total number of messages encrypted based on the key. Regular key rotation allows each key to remain secure and minimizes vulnerability to cryptanalytic attacks.

  • Respond in advance to security events

    In the early days of system design, key rotation was introduced as a routine operations and maintenance (O&M) method. This provides the system with a method to handle security events when they occur, and complies with the fail early, fail often principle of software engineering. If key rotation is not executed in the system until an emergency event has already occurred, the probability of system failure increases exponentially.

  • Provide logical isolation of data

    Data encrypted before a key rotation is isolated from data encrypted after the key rotation. The impact of key-related security events can be identified and preventive measures can be taken.

  • Reduce the window of time to crack keys

    Regular rotation of encryption keys ensures that you can control and reduce the window of time during which the key and its encrypted data are vulnerable to being cracked. The interval between rotation tasks during which attackers are able to crack the key is limited. This practice greatly increases the security of your data against cryptanalytic attacks.

Meet the requirements of regulatory compliance

Regular key rotation facilitates compliance with various regulations, which include but are not limited to the following regulations:
  • Payment Card Industry Data Security Standard (PCI DSS)
  • Cryptography-related industrial standards issued by State Cryptography Administration, such as GM/T 0051-2016
  • Cryptography-related standards issued by NIST, such as NIST Publication 800-38D