Part 1: General - Computer Security Resource Center - National ...

March, 2007
Management Specification shall identify where human and automated tracking actions are
required and where two-person integrity is required, if applicable. Section 9.1 of this
recommendation provides accountability guidance.
10.2.9 Compromise Management and Recovery
This section of the Key Management Specification should address any support for the
restoration of protected communications in the event of the compromise of keying material used
by the cryptographic device/application. The recovery process description should include the
methods for re-keying. For PKI cryptographic applications, the implementation of Certificate
Revocation Lists (CRLs) and Compromised Key Lists (CKLs) should be detailed. For system
specifications, a description of how certificates will be reissued and renewed within the
cryptographic application should also be included. General compromise recovery guidance is
provided in Section 9.3.4 of this recommendation.
10.2.10 Key Recovery
This section of the Key Management Specification describes product support or system
mechanisms for effecting key recovery. Key recovery addresses how unavailable encryption
keys can be recovered. System developers should include a discussion of the generation, storage,
and access for long-term storage keys in the key recovery process description. The process of
transitioning from the current to future long-term storage keys should also be included. General
contingency planning guidance is provided in Section 9.3.3 of this recommendation. Key
recovery is treated in detail in Appendix B, Key Recovery.
122