I am working on an application where we will be encrypting billions of small (< 2,000 bytes) records. Combined, we are facing many TB of data. Each record will be encrypted independently, using a unique IV/nonce.
We are aware of the restrictions around the reuse of IV/nonce values and the limits on the amount of data which can be encrypted using a key/IV pair (the NIST SP 800-38 series). Given that each record will use a unique IV, this will likely be the primary factor driving the rotation of keys.
Is there a maximum amount of data - regardless of the number of encryption operations using a unique IV/nonce - where the AES key itself should be rotated, or is the retirement driven entirely by the restrictions set by block chaining mode?