This draft proposes a generic mechanism for deriving short-lived traffic keys from the longed-lived keys. The long-lived key could be a preshared secret or a key obtained from some key management protocol. The mechanism described in this draft can be used to implement key rollovers without requiring the participating routers to exchange any additional information.