When using software that does encryption using shared secrets what are the recommended practices for changing the keys.
To be specific, this is a distributed software running in a cluster and the communication between the nodes is encrypted using a shared secret. The clustering software in this case uses the eventual consistency model and there is no designated leader.
There is an out of band mechanism for all the nodes to learn the key. I am considering an user option to designate one node to do the key change.
when using shared secrets is it a must to provide an option to do key-rotation ?
Assuming it is must, is it better to do it periodically (like once in 2 days) ? How often is too often for key rotation ?