Source: aegis/aegis-keys/src/rotation.rs. SHA-256: dd629129b75d43cfb74e0fa4b837843ceda291b2df3487d6efb5c12c44a320c6.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

rotation::KeyRotation

Key rotation coordinator (AEGIS Spec SS6.6).

Manages the lifecycle of key rotation events. When a rotation is initiated, a new key is generated and both keys remain valid for the duration of the grace period.

pub struct KeyRotation;

Source line: 20.

rotation::RotationRequest

A request to rotate a key.

pub struct RotationRequest {
/// The key ID being rotated.

pub key_id: String,
/// Grace period during which both old and new keys are valid.

pub grace_period: Duration
}

Source line: 23.

rotation::RotationResult

The result of a successful key rotation.

pub struct RotationResult {
/// The ID of the key being replaced.

pub old_key_id: String,
/// The newly generated replacement key.

pub new_key: ManagedKey,
/// Timestamp when the grace period ends and the old key is fully retired.

pub grace_period_ends: DateTime<Utc>
}

Source line: 31.

rotation::KeyRotation::initiate

Initiate key rotation for an existing managed key.

Generates a new key with the same role as the old key. Both the old and new keys are considered valid until the grace period expires. After the grace period, the old key should be decommissioned.

Arguments

• old - The existing managed key to rotate away from.
• encryption_key - A 32-byte AES-256 key for encrypting the new key's private material.

Returns

A RotationResult containing the new key and grace period metadata.

Errors

Returns KeyError::RotationFailed if the new key could not be generated.

pub fn initiate(
        old: &ManagedKey,
        encryption_key: &[u8; 32],
    ) -> Result<RotationResult, KeyError>;

Source line: 59.

rotation::KeyRotation::initiate_with_grace

Initiate key rotation with a custom grace period.

Arguments

• old - The existing managed key to rotate away from.
• encryption_key - A 32-byte AES-256 key for encrypting the new key's private material.
• grace_period - Duration during which both old and new keys are valid.

Errors

Returns KeyError::RotationFailed if the new key could not be generated.

pub fn initiate_with_grace(
        old: &ManagedKey,
        encryption_key: &[u8; 32],
        grace_period: Duration,
    ) -> Result<RotationResult, KeyError>;

Source line: 77.

rotation::KeyRotation::is_grace_period_expired

Check whether a grace period has expired.

Returns true if the current time is past the grace period end, meaning the old key should be decommissioned.

pub fn is_grace_period_expired(result: &RotationResult) -> bool;

Source line: 101.

rotation::is_rotation_eligible

Convenience function to check if a key role is eligible for rotation.

Session keys are not rotated -- they are short-lived and simply expire. Recovery keys require a special ceremony rather than standard rotation.

pub fn is_rotation_eligible(role: KeyRole) -> bool;

Source line: 110.