Key Rotation
Pronunciation: kee roh-TAY-shuhn
Also known as: Cryptographic Key Rotation
Definition
Key rotation is the planned replacement of an active cryptographic key with a new key while preserving service continuity and authorization. Rotation limits exposure from long-lived keys, supports policy changes, and provides a controlled response to suspected compromise.
Overview
Meaning in plain language
Key rotation is the planned replacement of an active cryptographic key with a new key while preserving service continuity and authorization. Rotation limits exposure from long-lived keys, supports policy changes, and provides a controlled response to suspected compromise.
How it works
Key rotation replaces one active key with another according to a scheduled or emergency process. The old and new keys may overlap briefly so systems can update without downtime, or the change may occur atomically at a defined block or transaction. A successful rotation updates every place where the public key, address, signer policy, or trust relationship is referenced.
A configurable Account Authority can authorize a new key directly, while a fixed-address system may require moving funds or permissions to another account. Validators may separate identity, consensus, and withdrawal keys, each with different rotation rules. Multisignature systems can replace one signer without changing the entire policy if the contract or account supports it.
Rotation establishes the successor key and continuity plan; revocation declares that the old key should no longer be trusted. A routine rotation may keep the old key valid for a controlled overlap, whereas compromise response should minimize or eliminate that period.
Operational preparation includes generating the replacement securely, verifying its public identifier, updating signers and monitoring, testing recovery, and confirming the final on-chain state. Teams should track key age, owners, purpose, storage device, and next rotation date. Automatic rotation is useful only when dependencies can consume the change safely; otherwise it can cause signing failures or loss of access.
Where people get it wrong
Rotation must include downstream clients and webhook signatures. Rotating a database token is not equivalent to moving blockchain funds away from a compromised private key.
Related concepts
Secret Key, Signing Key, Webhook Verification.
Reference
Example
A provider issues a replacement API credential while the old one remains valid for a short controlled overlap. Integrations update their secrets, test requests, monitor failures, then revoke the old credential.
Comparison
Rotation replaces authorized credential material; revocation invalidates a credential, and compromised wallet keys may require moving funds.
Key Takeaway
Key rotation is a coordinated authority transition, not merely generation of a new key, and must update every dependent verifier and signer.
Sources
- Recommendation for Key Management: Part 1 — NIST (2026-08-02)
- Root Zone KSK Ceremonies — IANA (2026-08-02)