Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm aware that it's advisable to rotate cryptographic keys periodically. HKDF accepts high-entropy input (IKM - Input Key Material), and expands it to an arbitrary length. It also accepts a salt, the RFC states that "the use of salt adds significantly to the strength of HKDF". Naturally, changing the salt results in distinct Output Key Material.

What I would like to clarify, is whether updating the salt (in the context of HKDF) constitutes 'key rotation', or whether the IKM itself needs to be changed periodically. I suspect the latter, but I'd like to hear what other people have to say. I assume that this also applies to other KDFs like Scrypt.

share|improve this question
1  
The question here is what you want to achieve with key rotation. Key rotation by itself doesn't do anything useful. One you decide on the desired security properties you can figure out what measures you want to take to achieve them, possibly including key rotation. –  CodesInChaos Jun 23 '13 at 20:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.