Part 1: General - Computer Security Resource Center - National ...

March, 2007
On a more frequent basis, the actions of the humans that use, operate and maintain the system
should be reviewed to verify that the humans continue to follow established security procedures.
Strong cryptographic systems can be compromised by lax and inappropriate human actions.
Highly unusual events should be noted and reviewed as possible indicators of attempted attacks
on the system.
9.3 Key Management System Survivability
9.3.1 Back-up Keys
[OMB11/01] notes that encryption is an important tool for protecting the confidentiality of
disclosure-sensitive information that is entrusted to an agency’s care, but that the encryption of
agency data also presents risks to the availability of information needed for mission performance.
Agencies are reminded of the need to protect the continuity of their information technology
operations and agency services when implementing encryption. The guidance specifically notes
that, without access to the cryptographic keys that are needed to decrypt information,
organizations risk the loss of their access to that information. Consequently, it is prudent to retain
back-up copies of the keys necessary to decrypt stored enciphered information, including master
keys, key encrypting keys, and the related keying material necessary to decrypt encrypted
information until there is no longer any requirement for access to the underlying plaintext
information (see Tables 7-8 in Section 8.2.2.1).
As the tables show, there are other keys for the operations of some organizations that may
require the retention of back-up copies (e.g. public signature verification keys and authorization
keys). Back-up copies of keying material shall be stored in accordance with the provisions of
Section 6 in order to protect the confidentiality of encrypted information and the integrity of
source authentication, data integrity, and authorization processes.
9.3.2 Key Recovery
There are a number of issues associated with key recovery. An extensive discussion is provided
in Appendix B. Key recovery issues to be addressed include:
1. Which keying material, if any, needs to be backed up or archived for later recovery?
2. Where will backed-up or archived keying material be stored?
3. Who will be responsible for protecting the backed up or archived keying material?
4. What procedures need to be put in place for storing and recovering the keying material?
5. Who can request a recovery of the keying material and under what conditions?
6. Who will be notified when a key recovery has taken place and under what conditions?
7. What audit or accounting functions need to be performed to ensure that the keying
material is only provided to authorized entities?
9.3.3 System Redundancy/Contingency Planning
Cryptography is a useful tool for preventing unauthorized access to data and/or resources, but
when the mechanism fails, it can prevent access by valid users to critical information and
processes. Loss or corruption of the only copy of cryptographic keys can deny users access to
information. For example, a locksmith can usually defeat a broken physical mechanism, but
115