Part 1: General - Computer Security Resource Center - National ...

March, 2007
A key agreement scheme and its associated key establishment protocol should provide the
following assurances:
1. Each entity in the key establishment process knows the identifier of the other entity(ies);
this may be achieved by the key agreement scheme or may be achieved by the protocol in
which key agreement is performed. Note that the identifier may be a “pseudo-identifier”,
not the identifier appearing on the entity’s birth certificate, for example.
2. The keys used in the key agreement scheme are correctly associated with the entities
involved in the key establishment process.
3. The derived keys are correct.
Keys derived through key agreement and its enabling protocol should not be used to protect and
send information until the three assurances described above have been achieved.
8.1.5.3 Generation and Distribution of Other Keying Material
Keys are often generated in conjunction with or are used with other keying material. This other
keying material shall be protected in accordance with Section 6.2.
8.1.5.3.1 Domain Parameters
Domain parameters are used by some public key algorithms to generate key pairs, to compute
digital signatures, or to establish keys. Typically, domain parameters are generated infrequently
and used by a community of users for a substantial period of time. Domain parameters may be
distributed in the same manner as the public keys with which they are associated, or they may be
made available at some other accessible site. Assurance of the validity of the domain parameters
shall be obtained prior to use, either by a trusted entity that vouches for the parameters (e.g., a
CA), or by the entities themselves. Assurance of domain parameter validity is addressed in
[FIPS186-3] and [SP800-56]. Obtaining this assurance should be addressed in a CA’s certificate
practices statement or an organization's security plan.
8.1.5.3.2 Initialization Vectors
Initialization vectors (IVs) are used by symmetric algorithms in several modes of operation for
encryption and decryption, or for authentication. The criteria for the generation and use of IVs is
provided in [SP800-38]; IVs shall be protected as specified in Section 6. When distributed, IVs
may be distributed in the same manner as their associated keys, or may be distributed with the
information that uses the IVs as part of the encryption or authentication mechanism.
8.1.5.3.3 Shared Secrets
Shared secrets are computed during a key agreement process and are subsequently used to derive
keying material. Shared secrets are generated as specified by the appropriate key agreement
scheme (see [SP800-56]), but shall not be distributed.
8.1.5.3.4 RNG Seeds
RNG seeds are used to initialize a Deterministic Random Bit Generator (DRBG). The criteria for
the selection of a RNG seed are provided in the specification of an Approved DRBG. When
distributed using an Approved method, the integrity and confidentiality of RNG seeds shall be
protected in accordance with Section 6.
101