Retiring long-lived keys

Abstract

Every long-lived key is registered, then replaced by an identity that is not a secret on disk, disabled for a soak so a missed caller shows up safely, and only then deleted. A dated exception is allowed; a key under suspicion is kept as evidence.

A secret that can be retired should be, and one under suspicion is evidence, not something to rotate away.

Its figure in the paper: § III.B →

Retiring long-lived keys

Registered
Being replaced
Dated exception
Disabled, soaking
Deletedfinal
Kept as evidencefinal

Registered

Every long-lived key is known, owned and dated.

Legal from here

Try a move that is not legal here

What has been provided

No use observedNothing has used the key in the window.
A proven replacementThe new access path works for every caller.
The soak to finishThe disabled period has passed with nothing breaking.
An approved, dated exceptionA named owner approves keeping it until a date.

The record · 0 receipts

verified · 0

Nothing has been decided yet.

Try to break it

A claim stands because the attacks on it were attempted and refused. Each one runs against the instrument's own rules. 0 of 4 attempted · 0 refused

Delete a key that is still in use
Straight to deletion from the register.
Disable before the replacement works
The old key is switched off while callers still need it.
Delete without the soak
Disabled this morning, deleted this afternoon.
Rotate the key you are retiring
Issue a fresh copy of the secret instead of removing it.

Setting up the instrument…

Declared limits

Windows and soak periods are described, not specified.
Generic and illustrative throughout: the behaviour is shown, the internals of the systems it is drawn from are not.

Instruments beside it in § III.B

Every attack in the laboratory, on one page: try to break all of it →

Everything you did in the laboratory, in one chain you can rewind: the notebook →