use automated key rotation due to AES-CCM/BCP107

[mcr]

doc> provides the above uniqueness guarantee. Additionally, since it can
doc> be difficult to use AES-CCM securely when using statically configured
doc> keys, implementations should use automated key management [RFC4107].

This is BCP 107, so I think we could use stronger language than "should
use". Also we should cite it as the BCP.

[[TODO]]

[cabo]

I don't get it. This is about using AES-CCM between a client and itself?
There needs to be some key rollover (limits in the amount of encrypted bits per key), and some entropy in the keys, but no "key management". Where did the RFC 4107 reference come in?

[cabo]

The git history was nuked in March, but the I-D history shows it came in in -03.

[cabo]

@thomas-fossati -- do you remember what you had in mind here?

Archived-At: https://mailarchive.ietf.org/arch/msg/core/tVZJ7iCUTtn1sSLeFcicagCB4eg

[ektrah]

https://github.com/ektrah/I-D/commit/791b83807aeee2b5af8fb6de8b4f5f8da3ac6425

(The draft is older than the https://github.com/core-wg/stateless repository.)

[thomas-fossati]

@thomas-fossati -- do you remember what you had in mind here?

Archived-At: https://mailarchive.ietf.org/arch/msg/core/tVZJ7iCUTtn1sSLeFcicagCB4eg

This should say "automated key rotation" rather than "automated key management". Sorry for the confusion!