Part 1: General - Computer Security Resource Center - National ...
Part 1: General - Computer Security Resource Center - National ... Part 1: General - Computer Security Resource Center - National ...
March, 2007 Contingency planning includes a full range of integrated logistics support functions. Spare parts (including copies of critical software programs, manuals, and data files) should be available (acquired or arranged for) and pre-positioned (or delivery staged). Emergency maintenance, replacement, and/or bypass instructions should be prepared and disseminated to both designated individuals and to an accessible and advertised access point. Designated individuals should be trained in their assigned recovery procedures, and all personnel should be trained in reporting procedures and workstation-specific recovery procedures. 9.3.3.2 Cryptography and Key Management-specific Recovery Issues Cryptographic keys are relatively small components or data elements that often control access to large volumes of information or critical processes. As the Office of Management and Budget has noted [OMB11/01], “without access to the cryptographic key(s) needed to decrypt information [an] agency risks losing access to its valuable information.” Agencies are reminded of the need to protect the continuity of their information technology operations and agency services when implementing encryption. The guidance particularly stresses that agencies must address information availability and assurance requirements through appropriate data recovery mechanisms, such as cryptographic key recovery. Key recovery generally involves some redundancy, or multiple copies of keying material. If one copy of a critical key is lost or corrupted, another copy usually needs to be available in order to recover data and/or restore capabilities. At the same time, the more copies of a key that exist and are distributed to different locations, the more susceptible the key usually is to compromise through penetration of the storage location or subversion of the custodian (e.g., user, service agent, key production/distribution facility). In this sense, key confidentiality requirements conflict with continuity of operations requirements. Special care needs to be taken to safeguard all copies of keying material, especially symmetric keys and private asymmetric keys. More detail regarding contingency plans and planning requirements is provided in Part 2 of this Recommendation for Key Management. 9.3.4 Compromise Recovery When keying material that is used to protect sensitive information or critical processes is disclosed to unauthorized entities, all of the information and/or processes protected by that keying material becomes immediately subject to disclosure, modification, subversion, and/or denial of service. All compromised keys shall be revoked; all affected keys shall be replaced; and, where sensitive or critical information or processes are affected, an immediate damage assessment should be conducted. Measures necessary to mitigate the consequences of suspected unauthorized access to protected data or processes and to reduce the probability or frequency of future compromises may follow. Where symmetric keys or private asymmetric keys are used to protect only a single user’s local information or communications between a single pair of users, the compromise recovery process can be relatively simple and inexpensive. Damage assessment and mitigation measures are often local matters. On the other hand, where a key is shared by or affects a large number of users, damage can be widespread, and recovery is both complex and expensive. Some examples of keys, the compromise of which might be particularly difficult or expensive to recover from, include the following: 117
March, 2007 1. Private key used to sign a root certificate in a public key infrastructure 2. Symmetric key transport key shared by a large number of users 3. Private asymmetric key transport key shared by a large number of users 4. Master key used in the generation of keys by a large number of users 5. Symmetric data encryption key used to encrypt data in a large distributed database 6. Symmetric key shared by a large number of communications network participants 7. Key used to protect a large number of stored keys 8. A certification authority’s (CA’s) private key In all of these cases, a large number of holders would need to be immediately notified of the compromise. Inclusion of the key identifier on a Compromised Key List (CKL) or Certificate Revocation List (CRL) to be published at a later date would not be sufficient. This means that a list of holders would need to be maintained and a means for communicating news of the compromise to the holders would be required. News of the compromise and the replacement of keys should be sent only to the affected entities so as not to encourage others to exploit the situation. In all of these cases, a secure path for replacing the compromised keys is required. In order to permit rapid restoration of service, an electronic (e.g., over-the-air) replacement path is preferred (see Section 8.2.3). In some cases, however, there may be no practical alternative to manual distribution (e.g., compromise of a root CA’s private key). Contingency distribution of alternate keys may help restore service rapidly in some circumstances (e.g., compromise of a widely held symmetric key), but the possibility of simultaneous compromise of operational and contingency keys would need to be considered. Damage assessment can be extraordinarily complex, particularly in cases such as the compromise and replacement of CA private keys, widely used transport keys, and keys used by many users of large distributed databases. 118
- Page 67 and 68: Table 4: Recommended algorithms and
- Page 69 and 70: March, 2007 size is available, the
- Page 71 and 72: Security life of data up to 4 years
- Page 73 and 74: March, 2007 6 Protection Requiremen
- Page 75 and 76: Table 5: Protection requirements fo
- Page 77 and 78: Key Type Security Service Private e
- Page 79 and 80: March, 2007 Crypto. Security Securi
- Page 81 and 82: March, 2007 may be applied only to
- Page 83 and 84: March, 2007 All cryptographic infor
- Page 85 and 86: March, 2007 8. Domain parameters (e
- Page 87 and 88: March, 2007 6. Destroyed Compromise
- Page 89 and 90: March, 2007 a. A private signature
- Page 91 and 92: 2 Pre-Operational Phase 3 7 1 4 Ope
- Page 93 and 94: March, 2007 8.1 Pre-operational Pha
- Page 95 and 96: 8.1.5.1.1 Distribution of Static Pu
- Page 97 and 98: March, 2007 and then provide eviden
- Page 99 and 100: March, 2007 listed in Section 8.1.5
- Page 101 and 102: March, 2007 encrypting key or publi
- Page 103 and 104: March, 2007 8.1.5.3.5 Intermediate
- Page 105 and 106: March, 2007 of keying material and
- Page 107 and 108: March, 2007 2. The application in w
- Page 109 and 110: March, 2007 and the key derivation
- Page 111 and 112: March, 2007 Type of Key Archive? Re
- Page 113 and 114: March, 2007 All records of the enti
- Page 115 and 116: March, 2007 other cryptographic inf
- Page 117: March, 2007 access to information e
- Page 121 and 122: March, 2007 10.2 Content of the Key
- Page 123 and 124: March, 2007 Management Specificatio
- Page 125 and 126: March, 2007 is the same value as th
- Page 127 and 128: March, 2007 If the decision is made
- Page 129 and 130: March, 2007 only, and then shall be
- Page 131 and 132: March, 2007 may be stored in backup
- Page 133 and 134: March, 2007 and the method of key r
- Page 135 and 136: March, 2007 ephemeral key pairs, an
- Page 137 and 138: B.3.14.7 Key Control Information Ma
- Page 139 and 140: March, 2007 to be saved. Keys for t
- Page 141 and 142: [HAC] Handbook of Applied Cryptogra
- Page 143: March, 2007 the owner by the CA tha
March, 2007<br />
Contingency planning includes a full range of integrated logistics support functions. Spare parts<br />
(including copies of critical software programs, manuals, and data files) should be available<br />
(acquired or arranged for) and pre-positioned (or delivery staged). Emergency maintenance,<br />
replacement, and/or bypass instructions should be prepared and disseminated to both designated<br />
individuals and to an accessible and advertised access point. Designated individuals should be<br />
trained in their assigned recovery procedures, and all personnel should be trained in reporting<br />
procedures and workstation-specific recovery procedures.<br />
9.3.3.2 Cryptography and Key Management-specific Recovery Issues<br />
Cryptographic keys are relatively small components or data elements that often control access to<br />
large volumes of information or critical processes. As the Office of Management and Budget has<br />
noted [OMB11/01], “without access to the cryptographic key(s) needed to decrypt information<br />
[an] agency risks losing access to its valuable information.” Agencies are reminded of the need<br />
to protect the continuity of their information technology operations and agency services when<br />
implementing encryption. The guidance particularly stresses that agencies must address<br />
information availability and assurance requirements through appropriate data recovery<br />
mechanisms, such as cryptographic key recovery.<br />
Key recovery generally involves some redundancy, or multiple copies of keying material. If one<br />
copy of a critical key is lost or corrupted, another copy usually needs to be available in order to<br />
recover data and/or restore capabilities. At the same time, the more copies of a key that exist and<br />
are distributed to different locations, the more susceptible the key usually is to compromise<br />
through penetration of the storage location or subversion of the custodian (e.g., user, service<br />
agent, key production/distribution facility). In this sense, key confidentiality requirements<br />
conflict with continuity of operations requirements. Special care needs to be taken to safeguard<br />
all copies of keying material, especially symmetric keys and private asymmetric keys. More<br />
detail regarding contingency plans and planning requirements is provided in <strong>Part</strong> 2 of this<br />
Recommendation for Key Management.<br />
9.3.4 Compromise Recovery<br />
When keying material that is used to protect sensitive information or critical processes is<br />
disclosed to unauthorized entities, all of the information and/or processes protected by that<br />
keying material becomes immediately subject to disclosure, modification, subversion, and/or<br />
denial of service. All compromised keys shall be revoked; all affected keys shall be replaced;<br />
and, where sensitive or critical information or processes are affected, an immediate damage<br />
assessment should be conducted. Measures necessary to mitigate the consequences of suspected<br />
unauthorized access to protected data or processes and to reduce the probability or frequency of<br />
future compromises may follow.<br />
Where symmetric keys or private asymmetric keys are used to protect only a single user’s local<br />
information or communications between a single pair of users, the compromise recovery process<br />
can be relatively simple and inexpensive. Damage assessment and mitigation measures are often<br />
local matters.<br />
On the other hand, where a key is shared by or affects a large number of users, damage can be<br />
widespread, and recovery is both complex and expensive. Some examples of keys, the<br />
compromise of which might be particularly difficult or expensive to recover from, include the<br />
following:<br />
117