How often do you change encryption key

[billy2047]

Basically the title, I have seen systems (which I won't name) use the same key (not KID) for years and years. Isn't it a good practice to change key every once a while? And how often do you guys do it? Thanks.

 

[Project25_MASTR]

Depends on the available equipment and infrastructure.

If you have a KMF and the infrastructure to support OTAR, it's a fairly straightforward process to rekey equipment. Schedule it and push the keys. Anyone who missed the keys can always request a rekey OTA (we are assuming there is a functional KEK in the radio and the ID's match what the KMF has). I don't know if Motorola still supports it but they used to have a tactical keyload feature that could also be done over the air with just a KVL on a conventional channel.

If you don't have a KMF and the ability to OTAR, you have to manually touch each radio. The pain with that is just trying to get people to bring radios in. On the state law enforcement side, it can take 3-5 years just to get codeplug updates done from employees not wanting to bring equipment in, imaging attempting to do any sort or manual rekeying process...

 

[noderaser]

We have a fed departmental mandate for every six months, but we do OTAR. It's a pretty straightforward process, but if the user's radios are off the key changeover timeout is very short and they will have to initiate OTAR manually from the radio. We still get radios brought in because they "don't work" and all that's needed is manual OTAR... We're trying to improve the training available but some people just ignore the info.

 

[Project25_MASTR]

We have a fed departmental mandate for every six months, but we do OTAR. It's a pretty straightforward process, but if the user's radios are off the key changeover timeout is very short and they will have to initiate OTAR manually from the radio. We still get radios brought in because they "don't work" and all that's needed is manual OTAR... We're trying to improve the training available but some people just ignore the info.

Out of curiosity, is that a trunked system or conventional system? I need to get some more info about conventional OTAR and the amount of time it takes per radio on average.