Why is rekeying after a certain period of time, or after a certain volume of data transfer, often implemented in modern secure transport protocols such as ESP or TLS?

What are the security risks of using a symmetric key for too long, assuming the underlying cryptography is sound and strong (say, 128-bit AES-GCM)?

How does exchanging and starting to use a new key mitigate these risks?


Rekeying is a part of perfect forward secrecy, if a malicious attacker is storing all your communication data hoping to get hold of the key in the future. Exchanging the key often will make it next to impossible to decrypt old messages with a current key. See https://en.wikipedia.org/wiki/Forward_secrecy

  • 1
    And it has the added bonus that if a key is compromised, only some of the messages can be decrypted. The remaining messages that used different keys will still be protected. Rekeying is good for the same reason that changing your password from time to time is good. – Mr. Llama Jul 14 '18 at 17:05
  • 1
    Thanks. I guess this is why the Signal (formerly Axolotl) protocol literally rekeys on every message: so that an attacker would have to have received every past message in order to decrypt any future ones. – Dan Lenski Jul 14 '18 at 17:33

In addition, there are sometimes limitations. For example, AES GCM can only transfer about 64 TB until it becomes possible for an attacker to forge tags.

  • Is that because the tags will cyclically repeat for a given (key, IV) after that many blocks? – Dan Lenski Jul 16 '18 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.