title: Data key rotation in Yugabyte DB
body: <p>From the <a href="https://github.com/yugabyte/yugabyte-db/blob/master/architecture/design/docdb-encryption-at-rest.md" rel="nofollow noreferrer">encryption at rest design document in Github</a>, only the Universe Keys are rotated while the data keys remain unchanged for the lifetime of the data file.</p>
  <p>However, the Yugabyte docs mention that &quot;Old data will remain unencrypted, or encrypted, with an older key, until compaction churn triggers a re-encryption with the new key.&quot;.</p>
  <ol>
  <li><p>Does this mean that the data keys implicitly get rotated when doing compaction?</p>
  </li>
  <li><p>And we can force this compaction (and data key rotation) by triggering a manual compaction via the yb-admin tool?</p>
  </li>
  </ol>