# How is key rotation defined?

I'm aware that it's advisable to rotate cryptographic keys periodically. HKDF accepts high-entropy input (IKM - Input Key Material), and expands it to an arbitrary length. It also accepts a salt, the RFC states that "the use of salt adds significantly to the strength of HKDF". Naturally, changing the salt results in distinct Output Key Material.

What I would like to clarify, is whether updating the salt (in the context of HKDF) constitutes 'key rotation', or whether the IKM itself needs to be changed periodically. I suspect the latter, but I'd like to hear what other people have to say. I assume that this also applies to other KDFs like Scrypt.

• The question here is what you want to achieve with key rotation. Key rotation by itself doesn't do anything useful. One you decide on the desired security properties you can figure out what measures you want to take to achieve them, possibly including key rotation. – CodesInChaos Jun 23 '13 at 20:27

The main purpose of varying the salt is to mitigate multi-target attacks: if everyone used the same salt, or no salt, with IKM having only 128 bits of min-entropy, and if there are $$u$$ different users of the system, the adversary can get a factor of $$u$$ cost reduction and factor of $$u^3$$ speedup by attacking them simultaneously parallelized $$u^2$$ ways at an expected cost of $${\sim}2^{128}/u$$ in the expected time for $${\sim}2^{128}/u^3$$ sequential trial evaluations of the cryptosystem. But if all users have distinct salts, the batch advantage vanishes. Another way to thwart the batch advantage is to use 256 bits of min-entropy instead, and 256-bit keys everywhere.