GoKawiilYou don't want long-lived keys
Long-lived keys are liabilities that, broadly, compound over time:
As people leave the company, the risk of someone outside of your organization having potential knowledge of the key grows.
If you assume that someone is constantly trying to guess a key or password, the likelihood that they guess correctly grows over time.
Cryptographic keys have usage limits before their security guarantees start to degrade.
You can manage this risk in two ways. The first is to reduce the scope of what a given key can do. This is ideal but not always possible: a key may just need to be inherently powerful in order to do its job. The more general risk reduction is rotating keys. Key rotation is, also, an incredible pain. I suspect many readers have had an experience like:
A rotation that needed to be expedited because the key was leaked.
A key that was generated years ago by an ex-employee with inaccurate (or no) documentation on how the key was generated.
An outage during rotation because the rollout was rushed or because the documentation was too stale to follow.
An outage that had significant blast radius because a botched key rotation doesn't gracefully degrade.
... continue reading