Question 1503

Turning Twelve Million Keys

The same store: 40 TB across 12,000,000 objects, one 184-byte wrapped data key per object. Compare two rotations.

Re-wrapping every data key under a new KMS key version moves

12×106 objects×184 B=2.208×109 B≈2.21 GB12\times10^{6}\ \text{objects}\times 184\ \text{B} = 2.208\times10^{9}\ \text{B} \approx 2.21\ \text{GB}

Re-encrypting every object under a fresh data key moves the full 40×101240\times10^{12} B, read and written.

Which conclusion follows?

A

Both move roughly 40 TB, because unwrapping and re-wrapping a data key requires decrypting and re-encrypting the object that key protects.

B

About 2.21 GB against 40 TB, a factor near 1.8×1041.8\times10^{4}. That gap is why key hierarchies put scheduled rotation at the wrapping key and reserve data-key rotation for a suspected compromise of the data key itself.

C

The byte counts are right, but re-wrapping is the expensive operation in practice: twelve million KMS calls are twelve million network round trips, while rewriting objects is local I/O.

D

About 22 GB against 40 TB, a factor near 1.8×1031.8\times10^{3}, because each object also carries its 12-byte nonce and 16-byte tag through the rewrite.