Key rotation replaces cryptographic keys according to a planned lifecycle. In a service-to-service system, manually changing one shared secret in multiple services creates coordination work and gives one service too much control. section 6.4
A public-key design makes rotation easier by separating distribution responsibilities:
- The payment service holds the RSA private key and exposes its public key through an endpoint. section 6.4
- The warehouse service encrypts refund details with the public key; the payment service decrypts them with the private key. section 6.4
- Rotating the pair avoids updating the same secret manually in two places and reduces secret sharing across services. section 6.4
ACME refund processing
ACME encrypts refunds.json in the warehouse service and sends it to the payment service. With AES, both sides must retain the same secret key. With RSA, the warehouse uses a configured public key while the payment service retains the private key, illustrating a more manageable rotation boundary. section 6.4
