A method, comprising: receiving , by a first network device, encryption data identifying: a receiving key for decrypting traffic, and a transmission key for encrypting traffic; installing , by the first network device, the receiving key on protocol hardware associated with a data plane of the first network device; receiving , by the first network device and from the data plane of the first network device, a first notification indicating that the receiving key is installed on the protocol hardware; providing , by the first network device and to a second network device, a first key agreement control message identifying the receiving key, wherein the first key agreement control message is provided based on receiving the first notification; receiving , by the first network device and from the second network device, an acknowledgment message indicating that the receiving key is installed on the second network device; installing , by the first network device, the transmission key on the protocol hardware based on receiving the acknowledgment message; receiving , by the first network device and from the data plane of the first network device, a second notification indicating that the transmission key is installed on the protocol hardware; and providing , by the first network device and to the second network device, a second key agreement control message identifying the transmission key, wherein the second key agreement control message is provided based on receiving the second notification, and wherein the first notification and the second notification enable the first network device to provide security key rollover without resulting in traffic loss. receiving , by a first network device, encryption data identifying: a receiving key for decrypting traffic, and a transmission key for encrypting traffic; a receiving key for decrypting traffic, and a transmission key for encrypting traffic; installing , by the first network device, the receiving key on protocol hardware associated with a data plane of the first network device; receiving , by the first network device and from the data plane of the first network device, a first notification indicating that the receiving key is installed on the protocol hardware; providing , by the first network device and to a second network device, a first key agreement control message identifying the receiving key, wherein the first key agreement control message is provided based on receiving the first notification; receiving , by the first network device and from the second network device, an acknowledgment message indicating that the receiving key is installed on the second network device; installing , by the first network device, the transmission key on the protocol hardware based on receiving the acknowledgment message; receiving , by the first network device and from the data plane of the first network device, a second notification indicating that the transmission key is installed on the protocol hardware; and providing , by the first network device and to the second network device, a second key agreement control message identifying the transmission key, wherein the second key agreement control message is provided based on receiving the second notification, and wherein the first notification and the second notification enable the first network device to provide security key rollover without resulting in traffic loss. wherein the second key agreement control message is provided based on receiving the second notification, and wherein the first notification and the second notification enable the first network device to provide security key rollover without resulting in traffic loss. <EOS>