Update before key limits
04A traffic key has a finite usage bound and must be replaced before exceeding it.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 5.5 ↗
RFC 9846 · § 5.5EXAMPLE
3 / 3
03
Next key
Use the next traffic secret and reset the record sequence for the new key.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 8446 key-usage guidanceRFC 9846 § 1.2
The revision makes initiating key update before exceeding usage limits mandatory and limits KeyUpdate message behavior.
Read the updated RFC section ↗An implementation must initiate a key update before reaching its applicable usage limit.
- An implementation must initiate a key update before reaching its applicable usage limit.
- The usage bound depends on the AEAD algorithm and security target.
- KeyUpdate messages themselves are protected with the old key before moving to the new sending key.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy