Rekeying (cryptography)

In cryptography, rekeying refers to the process of changing the session key—the encryption key of an ongoing communication—in order to limit the amount of data encrypted with the same key.

Roughly equivalent to the classical procedure of changing codes on a daily basis, the key is changed after a pre-set volume of data has been transmitted or a given period of time has passed.

In contemporary systems, rekeying is implemented by forcing a new key exchange, typically through a separate protocol like Internet key exchange (IKE). The procedure is handled transparently to the user.

A prominent application is Wi-Fi Protected Access (WPA), the extended security protocol for wireless networks that addresses the shortcomings of its predecessor, WEP, by frequently replacing session keys through the Temporal Key Integrity Protocol (TKIP), thus defeating some well-known key recovery attacks.

In public key infrastructure, rekeying (or "re-keying") leads to issuance of new certificate (in contrast to certificate renewal - issuance of new certificate for the same key, which is usually not allowed by CAs).

See also

• Diffie–Hellman key exchange
• Elliptic-curve Diffie-Hellman
• IPsec and Internet key exchange (IKE)
• Over the Air Rekeying (OTAR)

External links

• OpenSSH: KeyRegenerationInterval parameter, ~R command