Rotating Credentials Is Not Revoking Them. The Revocation Unit Decides Whether You Can.
The revocation unit decides whether credential rotation can ever be atomic. It is the scope one revoke action removes: a token, an identity, or a trust root. Most teams treat rotation and revocation as one operation. They aren't. Rotation issues new secrets. Revocation removes the authority of everything that could have used the old ones, and it works only if the architecture can name that set…
The article discusses the distinction between credential rotation and revocation, emphasizing that the two are separate operations. While rotation creates new secrets, revocation removes authority from old ones and requires a specific unit of revocation to be determined. The revocation unit is an architectural decision that dictates what exactly is being revoked when an incident occurs.
The article highlights that most teams treat rotation and revocation as one operation, which can lead to issues if the architecture cannot accurately name and remove the set of credentials that need to be revoked. It stresses that the revocation unit must enclose the full reachability graph of the affected set, and any survivor with read access to the store holding the replacement secrets can simply collect them.
The article concludes by suggesting that rotating everything may not be the best solution, as it only relocates the problem.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
