Part 1: General - Computer Security Resource Center - National ...

March, 2007
10.2 Content of the Key Management Specification
The level of detail required for each section of the Key Management Specification can be
tailored, depending upon the complexity of the device or application for which the Key
Management Specification is being written. The Key Management Specification should contain
a title page that includes the device identifier, and the developer’s or integrator’s identifier. A
revision page, list of reference documents, table of contents, and definition of abbreviations and
acronyms page should also normally be included. The terminology used in a Key Management
Specification shall be in accordance with the terms defined in appropriate NIST standards and
guidelines. Unless the information is tightly controlled, the Key Management Specification
should not contain proprietary or sensitive information. The Key Management Specification
should not contain proprietary information. [Note: If the cryptographic application is supported
by a PKI, a statement to that effect should be included in the appropriate Key Management
Specification sections below.]
10.2.1 Cryptographic Application
The Cryptographic Application section provides a basis for the development of the rest of the
Key Management Specification. The Cryptographic Application section provides a brief
description of the cryptographic application or proposed employment of the cryptographic
device. This includes the purpose or use of the cryptographic device (or application of a
cryptographic device), and whether it is a new cryptographic device, a modification of an
existing cryptographic device, or an existing cryptographic device for which a Key Management
Specification does not exist. A brief description of the security services (confidentiality,
integrity, non-repudiation, access control, identification and authentication, and availability) that
the cryptographic device/application provides should be included. Information concerning longterm
and potential interim key management support (key management components) for the
cryptographic application should be provided.
10.2.2 Communications Environment
The Communications Environment section provides a brief description of the communications
environment in which the cryptographic device is designed to operate. Some examples of
communications environments include:
1. Data networks (intranet, internet, VPN),
2. Wired communications (landline, dedicated or shared switching resources), and
3. Wireless communications (satellite, radio frequency).
The environment may also include any anticipated access controls on communications resources,
data sensitivity, privacy issues, non-repudiation requirements, etc.
10.2.3 Key Management Component Requirements
The key management component requirements section describes the types and logical structure
of keying material required for operation of the cryptographic device. Cryptographic applications
using public key certificates (i.e., X.509 certificates) should describe the types of certificates
supported. The following information should be included:
1. The different keying material classes or types required, supported, and/or generated (e.g.,
for PKI: CA, signature, key establishment, and authentication);
120