key rotation
also: key replacement, credential rotation
Key rotation is the practice of periodically replacing cryptographic keys with new ones to limit exposure if a key is compromised. It's a security best practice that reduces the window of vulnerability for any single key.
Key rotation involves systematically generating new cryptographic keys and retiring old ones on a scheduled basis or after a security event. This practice ensures that even if an attacker obtains a key, it will only grant access for a limited time before being replaced.
Common scenarios include rotating SSH keys on servers, refreshing TLS certificates, updating database encryption keys, and renewing API tokens. For example, a system administrator might rotate SSH host keys every 90 days and user keys annually, or immediately after detecting suspicious login activity.
In automated systems, key rotation can be managed by tools like HashiCorp Vault or cloud provider services (AWS KMS, Azure Key Vault) that handle scheduling, distribution, and revocation. Without rotation, a single compromised key could provide persistent unauthorized access.