I think I have a decent grasp of the problems associated with key rotation, and as I'm working through them determining an approach for key management on an application I keep stumbling up against something that doesn't make any sense to me.
Consider that we've got a key used to encrypt data (the data encrypting key or DEK) and a key used to encrypt the DEK (the key encrypting key or KEK). So far so good - I understand that model.
However in numerous places I've seen it claimed that using this model makes key rotation easier, because when it's time to expire keys you just expire the KEK and not the DEK, so your data doesn't need to be reëncrypted.
I'm not questioning the value of the pattern; at the very least the KEK is another turtle in the "Who's got the most significant key?" game. But the claim about key rotation seems specious - if your KEK is compromised then so is your DEK and to be secure you need to reëncrypt everything. Am I missing something important there?
It occurs to me that perhaps I'm conflating key rotation with key replacement due to compromise and that in a simple rotation (where all keys are still assumed to be secret) rotating the KEK is sufficient. Is that the piece that's got me confused?
