I am trying to come up with a solution for a system where i need to generate a key (Kn) from time to time and distribute it to a large number of servers in a private network. Since it has to be a scalable solution, i thought about using a KDC along with multicast to communicate with all servers in order to update Kn, but although it is a private network i am concern about security. Even if i have a private key (K) known only to the KDC and all trusted servers, used to encrypt Kn like M = E(Kn,K) (and decrypt to recover Kn), how should K be distributed to all trusted servers?
Edit: What i am trying to do is, every time the KDC generates a new Kn, it will it send over multicast for all trusted servers in the multicast group. That means the servers will be passively listening for any key changes. Timing in this solution is not important.
If someone could point me in the right direction, i would appreciate it! Thank you.