Applied Cryptography
Which of the following is the main purpose of key rotation, replacing a cryptographic key with a new one at regular intervals?
- ATo make data encrypted with the old key impossible for anyone ever to decrypt again, erasing them for certain
- BTo make the cryptographic algorithm itself gradually stronger each time the key is changed
- CTo limit the amount of data and the period protected by one key, reducing the extent of damage if the key leaks
Show answer and explanation
Answer: C. To limit the amount of data and the period protected by one key, reducing the extent of damage if the key leaks
Key management sets a period during which each key may be used (the cryptoperiod) and manages the key lifecycle of generation, distribution, use, update, revocation and destruction. The longer one key is used, the more data it protects, the greater the damage if it leaks, and the longer it may tend to be leaked without anyone noticing. So that old data can still be read after rotation, the old key is usually kept for decryption only, for as long as needed. Changing the key does not change the strength of the algorithm, so if an algorithm becomes weak, the scheme itself must be replaced.
- A. To read old data, the old key is usually kept for decryption only.
- B. Changing the key does not change the strength of the algorithm.
- C. Correct. It limits the impact of a key leak in terms of both time and amount of data.