{"id":"kms-rotation-decoupled-from-reencryption","text":"KMS key rotation creates new versions without re-encrypting existing data; the version is embedded in ciphertext for symmetric keys, automatic rotation only works for symmetric keys, and manual rotation preserves auto schedules — making re-encryption a separate operational responsibility.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"kms-rotation-decoupled-from-reencryption","truth_value":"IN","reason":"premise"}]}}