Module key_rotation 

Key rotation functionality for Signal Protocol keys

Implements periodic rotation of signed pre-keys and Kyber pre-keys, plus consumption-based pre-key management following Signal Protocol security model.

Constants

GRACE_PERIOD_SECS

Grace period before deleting old keys (7 days in seconds)

MIN_PRE_KEY_COUNT

Minimum pre-key count before replenishment is triggered

REPLENISH_COUNT

Number of pre-keys to generate when replenishing

ROTATION_INTERVAL_SECS

Key rotation interval (7 days in seconds)

Functions

cleanup_expired_kyber_pre_keys

Deletes Kyber pre-keys older than the grace period

cleanup_expired_signed_pre_keys

Deletes signed pre-keys older than the grace period

consume_pre_key

Consumes a pre-key and triggers replenishment if count falls below threshold

kyber_pre_key_needs_rotation

Checks if the current Kyber pre-key needs rotation

replenish_pre_keys

Generates and stores new batch of pre-keys

rotate_kyber_pre_key

Rotates the Kyber post-quantum pre-key by generating and storing a new one

rotate_signed_pre_key

Rotates the signed pre-key by generating and storing a new one

signed_pre_key_needs_rotation

Checks if the current signed pre-key needs rotation