The meaning of rotate is going to depend on your data owner’s security policy.
It may help to understand how keys are often managed using a key lifecycle state chart. A typical key lifecycle looks like this:
- Generated (new, not to be used yet)
- Active (encrypt/decrypt)
- Inactive (decrypt-only)
- Retired (key irrevocably destroyed)
Additionally, states can be defined for keys that are “suspect”, “lost”, and/or “compromised”.
Rules are defined regarding how and when a key will transition from one state to another, which transitions are legal, and when. You’ll also see a rule that if a key is compromised it will require all the data to be re-encrypted with a new key (among many other disaster recovery tasks.)
In some organizations a key rotation will require a rotated key to be changed to an inactive state, and a new version of the key will need to be generated for encrypting new data. When the new key is made active, the old key is made inactive. The old data remains encrypted with its same old key until the key is retired, and then the old key is destroyed. This way, the old data doesn’t have to be decrypted and then re-encrypted with the new key. The application consuming the data has to use the same version of the key that was used when the data was encrypted.
Other organizations may have no inactive state, and a key rotation will require the old key to be retired and all previously encrypted data to be re-encrypted.