Part 1: General - Computer Security Resource Center - National ...

Table 10: Archive of other cryptographic related information
March, 2007
Type of Key Archive? Retention period (minimum)
Domain parameters OK Until all keying material, signatures and
signed data using the domain parameters are
removed from the archive
Initialization vector OK; normally
stored with the
protected
information
Shared secret No
RNG seed No
Until no longer needed to process the
protected data
Other public information OK Until no longer needed to process data using
the public information
Intermediate result No
Key control information (e.g.,
IDs, purpose)
Random number No
Password No, unless used
to detect the
reuse of old
passwords
OK Until the associated key is removed from
the archive
Until no longer needed to detect password
reuse
Audit information OK Until no longer needed
After the end of a key’s cryptoperiod, keying material may be recovered from archival storage,
providing that the keying material has been archived. Alternatively, the keying material may be
reconstructed (e.g., re-derived), if the key management system has been appropriately designed.
Key recovery of archived keying material may be required to remove (e.g., decrypt) or check
(e.g., verify a digital signature or a MAC) the cryptographic protections on archived data. The
key recovery process results in retrieving the desired keying material from archive storage in
order to perform the required cryptographic operation. Immediately after completing this
operation, the keying material shall be erased from the cryptographic process but still exists in
the archive (see Section 8.3.4). Further advice on key recovery issues is provided in Appendix B.
8.3.2 Entity De-registration Function
The entity de-registration function removes the authorizations of an entity to participate in a
security domain. When an entity ceases to be a member of a security domain, the entity shall be
de-registered. De-registration is intended to prevent other entities from relying on or using the
de-registered entity's keying material.
111