Crypto requirements - key rotation

[lwierzbicki]

During reading crypto requirements, I cannot find requirement which is related to key rotation (changing key and its related and appriopate time length when key is used). I started to consider this from key lifecycle and I think it is missing here.

Related guide NIST SP800-175B chapter 5.1.1

[commjoen]

Good point: either we extend MSTG-CRYPTO-5 or create a new requirement 👍

[vixentael]

+1 to key rotation.

@julepka and I recommend the following requirement (see #500):

| 3.7 | MSTG-CRYPTO-7 | Each cryptographic key is regularly rotated depending on its properties and cryptosystem design. |   | ✓ |

[cpholguera]

This is considered in the new release of MASVS-CRYPTO (#612, see MASVS-CRYPTO-3). Thanks a lot @lwierzbicki!

[cpholguera]

Now covered in this to-be-created weakness

https://mas.owasp.org/MASWE/MASVS-CRYPTO/MASWE-0011/

@lwierzbicki, @vixentael would you like to create this item for the new MASWE?