Key lifetime refers to how long a key should be used (actually encrypting, decrypting, signing, MACing, and so on) before being destroyed (zeroized).
In general, asymmetric keys (for example, PKI certificates) can be used for much longer periods of time, given their ability to be used for establishing fresh, unique session keys (achieving perfect forward secrecy). Symmetric keys, in general, should have much shorter key lifetimes. Upon expiration, new keys can be provisioned in myriad ways:
- Transported by a central key management server or other host (key transport, using algorithms such as AES-WRAP; the AES-WRAP algorithm encrypts the key being transported and as such the AES-WRAP key makes use of a KEK)
- Securely embedded in ...
