1
$\begingroup$

tl;dr: How do I formulaically determine key rotation schedules for different kinds of keys and use cases?

The organization I'm a part of for utilizes both symmetric and public/private key encryption for both external and internal communication. In the past we have essentially done key rotation on an as needed basis, or when operations resources free up. We're trying to get more serious about security in general and this isn't going to fly anymore. We'd also like to automate key rotation.

How can I calculate how often to rotate keys given key size and amount of data encrypted? Applied Cryptography gives some guidelines, but they're rather out of date and don't quite fit our use case. Most other public domain info is catered more towards PGP and file encryption key rotation.

I fully understand there isn't some magic formula that pings out the exact amount of minutes to keep a key, i'm just trying to find a way I can justify my policies to other engineers and potentially a way I can empower people not security minded to make rotation decisions.

Just a point in the direction of some literature or prior art would be fantastic as well, google has not been very useful.

| improve this question | |
$\endgroup$
  • 1
    $\begingroup$ It depends on the cipher used, message count, bytes encrypted, threat model, key size, probability of key exposure, probability of interception during rotation, and many other factors. Check NIST SP800-57 for baseline recommendations $\endgroup$ – Richie Frame Aug 23 '19 at 3:02
  • $\begingroup$ I should also mention there are 3 parts to SP800-57, you should look at all of them $\endgroup$ – Richie Frame Aug 23 '19 at 3:04
  • $\begingroup$ @RichieFrame thank you so much, this is exactly what I was looking for $\endgroup$ – EllipticSwerve Aug 23 '19 at 3:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.