Key rotation benefits of a multi-key hierarchy

Question

I think I have a decent grasp of the problems associated with key rotation, and as I'm working through them determining an approach for key management on an application I keep stumbling up against something that doesn't make any sense to me.

Consider that we've got a key used to encrypt data (the data encrypting key or DEK) and a key used to encrypt the DEK (the key encrypting key or KEK). So far so good - I understand that model.

However in numerous places I've seen it claimed that using this model makes key rotation easier, because when it's time to expire keys you just expire the KEK and not the DEK, so your data doesn't need to be reëncrypted.

I'm not questioning the value of the pattern; at the very least the KEK is another turtle in the "Who's got the most significant key?" game. But the claim about key rotation seems specious - if your KEK is compromised then so is your DEK and to be secure you need to reëncrypt everything. Am I missing something important there?

It occurs to me that perhaps I'm conflating key rotation with key replacement due to compromise and that in a simple rotation (where all keys are still assumed to be secret) rotating the KEK is sufficient. Is that the piece that's got me confused?

Answer 1

It occurs to me that perhaps I'm conflating key rotation with key replacement due to compromise and that in a simple rotation (where all keys are still assumed to be secret) rotating the KEK is sufficient. Is that the piece that's got me confused?

Seems that you've found the issue yourself. Key rotation is the periodic rotation of the keys to prevent possible future compromise. Key replacement due to key compromise would require the replacement of all keys which may have been compromised, which would include all keys encrypted by those keys.