tl;dr: How do I formulaically determine key rotation schedules for different kinds of keys and use cases?
The organization I'm a part of for utilizes both symmetric and public/private key encryption for both external and internal communication. In the past we have essentially done key rotation on an as needed basis, or when operations resources free up. We're trying to get more serious about security in general and this isn't going to fly anymore. We'd also like to automate key rotation.
How can I calculate how often to rotate keys given key size and amount of data encrypted? Applied Cryptography gives some guidelines, but they're rather out of date and don't quite fit our use case. Most other public domain info is catered more towards PGP and file encryption key rotation.
I fully understand there isn't some magic formula that pings out the exact amount of minutes to keep a key, i'm just trying to find a way I can justify my policies to other engineers and potentially a way I can empower people not security minded to make rotation decisions.
Just a point in the direction of some literature or prior art would be fantastic as well, google has not been very useful.