<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-encryption-key-rotation
description: >-
  Implement automated encryption key rotation policies for KMS, TLS
  certificates, database encryption keys, and application secrets to
  maintain cryptographic hygiene and comply with key management standards.
domain: cybersecurity
subdomain: data-security
tags:
  - encryption
  - key-rotation
  - kms
  - certificate-management
  - cryptographic-hygiene
  - nist-800-57
  - key-lifecycle
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1552.004"]
---

# Implementing Encryption Key Rotation

## Overview

Encryption key rotation replaces active cryptographic keys on a defined
schedule or in response to compromise indicators. Regular rotation limits
the blast radius of key compromise, satisfies compliance requirements
(PCI DSS 3.6, NIST SP 800-57), and ensures cryptographic agility.
This skill covers KMS key rotation, TLS certificate renewal, database
encryption key rotation, and secret rotation automation.

Mode: `[MODE: ARCHITECT]` — Key management architecture and rotation design.

## Prerequisites

- KMS platform (AWS KMS, GCP Cloud KMS, Azure Key Vault, HashiCorp Vault)
- Certificate management tooling (cert-manager, Let's Encrypt, internal CA)
- Application secret management (Vault, AWS Secrets Manager)
- Key inventory with rotation schedules and ownership

## Key Concepts

### Key Lifecycle (NIST SP 800-57)

| Phase | Description | Duration |
|-------|-------------|----------|
| Pre-activation | Key generated, not yet in use | Until deployment |
| Active | Key in use for encryption | Per rotation policy |
| Deactivated | No new encryption, still decrypts | Transition period |
| Compromised | Key suspected/confirmed compromised | Immediate rotation |
| Destroyed | Key material cryptographically erased | After retention |

### Rotation Strategies

```
Key rotation approaches:
├── Automatic rotation (preferred)
│   ├── AWS KMS: Annual automatic rotation (365 days)
│   ├── GCP Cloud KMS: Configurable rotation period
│   ├── Vault Transit: API-driven rotation
│   └── Application keys: CI/CD pipeline rotation
├── Manual rotation (when automatic not available)
│   ├── Generate new key version
│   ├── Re-encrypt data with new key (envelope encryption)
│   ├── Verify decryption with new key
│   └── Deactivate old key after transition
└── Emergency rotation (compromise response)
    ├── Immediately generate new key
    ├── Revoke compromised key
    ├── Re-encrypt all protected data
    └── Audit access during compromise window
```

### AWS KMS Rotation

```bash
# Enable automatic key rotation (annual)
aws kms enable-key-rotation --key-id alias/my-data-key

# Verify rotation status
aws kms get-key-rotation-status --key-id alias/my-data-key

# Manual rotation: create new key, re-encrypt
aws kms create-key --description "Data key v2 - rotated $(date +%Y-%m-%d)"
```

### Scanning CLI

```bash
# Audit key rotation compliance
node scripts/agent.js --action audit --input /tmp/key_inventory.json \
  --max-age-days 365 --output /tmp/rotation_audit.json

# Check certificate expiration
node scripts/agent.js --action check-certs --input /etc/ssl/certs/ \
  --warn-days 30 --output /tmp/cert_check.json

# Generate rotation schedule
node scripts/agent.js --action schedule --input /tmp/key_inventory.json \
  --output /tmp/rotation_schedule.json
```

## Workflow

### Step 1: Inventory All Keys and Certificates

Build a complete inventory of encryption keys, certificates, and secrets.

### Step 2: Audit Rotation Compliance

```bash
node scripts/agent.js --action audit --input /tmp/key_inventory.json \
  --max-age-days 365
```

### Step 3: Configure Automated Rotation

Enable automatic rotation on all KMS keys and certificate renewals.

### Step 4: Monitor Rotation Health

```bash
node scripts/agent.js --action check-certs --input /etc/ssl/certs/ --warn-days 30
```

## Detection

```yaml
title: Encryption Key Rotation Detection
id: aae449c0-31ed-41e6-b0ef-d8025af1183f
status: experimental
description: Detects suspicious activity related to implementing encryption key rotation techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1552.004
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] All KMS keys have automatic rotation enabled
- [ ] TLS certificates renew automatically before expiration
- [ ] Database encryption keys rotated per policy schedule
- [ ] Application secrets rotated without downtime
- [ ] Key inventory maintained with rotation dates
- [ ] Emergency rotation procedure tested and documented
- [ ] Compliance evidence generated for audit (PCI DSS 3.6)

## References

- [NIST SP 800-57 — Key Management Guidelines](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final)
- [PCI DSS Requirement 3.6 — Key Management](https://www.pcisecuritystandards.org/)
- [AWS KMS Key Rotation](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html)
- [HashiCorp Vault Transit Secrets Engine](https://developer.hashicorp.com/vault/docs/secrets/transit)
