I read about recommendations about secret keys (or password as rfc8018 call it), one of them is to change the password from time to time.
I would like to know: is there some best practice for this change of password?
I found this reference in the RFC with the following information:
changing a password changes the key that protects the associated DPK(s). Therefore, whenever a password is changed, any DPK that is protected by the retiring password shall be recovered (e.g., decrypted) using the MK or the derived keying material that is associated with the retiring password, and then re-protected (e.g., encrypted) using the appropriate MK or the derived keying material that is associated with a new password.
I understood from this text, that I have to re-protect again. But when and by who this process has to be made? "re-protect" could be a batch process? Or is there a better option?
In short, how to carry out this process without reinventing the wheel?
Clarifying the reference to password
I believe IMHO, that the word password leads to confusion, I have used the word password since the RFC refers to it as follows:
"In many applications of public-key cryptography, user security is ultimately dependent on one or more secret text values or passwords. Since a password is not directly applicable as a key to any conventional cryptosystem, however, some processing of the password is required to perform cryptographic operations with it. Moreover, as passwords are often chosen from a relatively small space, special care is required in that processing to defend against search attacks."
Reading the text, I think this password is not related to user passwords (I could be wrong), For me this is a secret that can be used by the entire application, in my case to encrypt a text.
I hope I have clarified the point, Thank you.