ReKeying

Rekeying is the process of changing the cryptographic keys used to protect data or traffic to reduce the impact of a compromise and limit data exposure. It is a standard element of key management and is part of a broader key lifecycle that includes generation, distribution, use, storage, rotation, and destruction.

In practice, rekeying can apply to data at rest (disk or file encryption), data in transit (secure communications), or application-level encryption. It often uses a key hierarchy or envelope encryption: data is encrypted with one or more data encryption keys (DEKs) that are themselves encrypted under master keys (KEKs). Rekeying typically means rotating the DEKs or KEKs and re-encrypting data or re-wrapping the envelopes, gradually migrating to new keys without losing access.

Triggers can be time-based (regular intervals), volume-based (after encrypting a threshold amount of data), event-based (detected compromise, key leakage, or staff changes), or policy-driven (regulatory requirements). Automated key management systems handle generation, distribution, rotation, and revocation, often with auditable logs.

Practical considerations include ensuring continuity of access during rekeying, performance impact, and secure handling of old keys. Rekeying should preserve data integrity, support reverse compatibility, and maintain forward secrecy where applicable. Any compromised key must be revoked and old data re-protected if possible.

See also: encryption key rotation, envelope encryption, key management, forward secrecy.