Part 1: General - Computer Security Resource Center - National ...

March, 2007
symmetric key or the public key of a key pair, although the private key associated with the public
key is also revoked.
Key revocation may be accomplished using a notification indicating that the continued use of the
keying material is no longer recommended. The notification could be provided by actively
sending the notification to all entities that might be using the revoked keying material, or by
allowing the entities to request the status of the keying material (i.e., a “push” or a “pull” of the
status information). The notification should include a complete identification of the keying
material, the date and time of revocation and the reason for revocation, when appropriate (e.g.,
key compromised). Based on the revocation information provided, other entities could then make
a determination of how they would treat information protected by the revoked keying material.
For example, if a signature verification public key is revoked because an entity left an
organization, it may be appropriate to honor all signatures created prior to the revocation date. If
a signing private key is compromised resulting in the revocation of the associated public key, an
assessment needs to be made as to whether or not information signed prior to the revocation
would be considered as valid.
As another example, a symmetric key that is used to generate MACs may be revoked so that it is
not used to generate MACs on new information. However, the key may be retained so that
archived documents can be verified.
The details for key revocation should reflect the lifecycle for each particular key. If a key is used
in a pair-wise situation (e.g., two entities communicating in a secure session), the entity revoking
the key shall inform the other entity. If the key has been registered with an infrastructure, the
entity revoking the key cannot always directly inform the other entities that may rely upon that
key. Instead, the entity revoking the key shall inform the infrastructure that the key shall be
revoked (e.g., using a certificate revocation request). The infrastructure shall respond by deregistering
the key material (see 8.3.3).
8.4 Destroyed Phase
The keying material is no longer available. All records of its existence may have been deleted.
However, some organizations may require the retention of certain key attributes for audit
purposes. For example, if a copy of an ostensibly destroyed key is found in an uncontrolled
environment or later determined to have been compromised, records of the identifier of the key
and its type, and cryptoperiod may be helpful in determining what information was protected
under the key and how best to recover from the compromise.
In addition, by keeping a record of the attributes of both destroyed and destroyed compromised
keys, one will be able to track which keys transitioned through a normal lifecycle and which
ones were compromised at some time during their lifecycle. Thus, protected information that is
linked to key names that went through the normal lifecycle may still be considered secure,
provided that the security strength of the algorithm remains sufficient. However, any protected
information that is linked to a key name that has been compromised may itself be compromised.
9 Accountability, Audit, and Survivability
Systems which process valuable information require controls in order to protect that information
from unauthorized disclosure and modification. Cryptographic systems which contain keys and
113