Part 1: General - Computer Security Resource Center - National ...

March, 2007
1. If the key is lost with the possibility of having been compromised, then the key shall be
replaced as soon as possible after recovery in order to limit the exposure of the recovered
key and the data it protects (see Section 8.2.3.1). This requires reapplying the protection
on the protected data using the new key. For example, suppose that the key (KeyA ) that
was used to encrypt data has been misplaced in a manner in which it could have been
compromised. As soon as possible after KeyA is recovered, KeyA shall be used to decrypt
the data, and the data shall be re-encrypted under a new key (KeyB). KeyB shall have no
relationship to KeyA (e.g., KeyB shall not be an update of KeyA).
2. If the key becomes inaccessible or has been modified, but compromise is not suspected,
then the key may be recovered. No further action is required. For example, if the key
becomes inaccessible because the system containing the key crashes or the key is
inadvertently overwritten, and a compromise is not suspected, then the key may simply
be restored.
The following subsections provide discussions to assist an organization in determining whether
or not key recovery is needed. Although the following discussions address only the
recoverability of keys, any related information shall also be recoverable.
B.3.1 Signature Key Pairs
The private key of a signature key pair (the private signature key) is used by the owner of the key
pair to apply digital signatures to information. The associated public key (the public signature
verification key) is used by relying entities to verify the digital signature.
B.3.1.1 Public Signature Verification Keys
It is appropriate to backup or archive a public signature verification key for as long as required in
order to verify the information signed by the associated private signature key. In the case of a
public key that has been certified (e.g., by a Certificate Authority), saving the public key
certificate would be an appropriate form of storing the public key; backup or archive storage may
be provided by the infrastructure (e.g., by a certificate repository). The public key should be
stored in backup storage until the end of the private key’s cryptoperiod, and should be stored in
archive storage as long as required for the verification of signed data. However, at some time the
cryptographic strength of the signature algorithm may be reduced or lost completely. The
algorithm may no longer offer adequate security or the private key may have been compromised.
If the signature algorithm has been withdrawn or the cryptoperiod of the public key has expired,
the signature shall be regarded as an error detection code rather than a cryptographic signature.
Appropriate storage systems are being developed that employ cryptographic time stamps to store
digitally signed data beyond the normal security life of the original signature mechanism or its
keys.
B.3.1.2 Private Signature Keys
Key backup is not usually desirable for the private key of a signing key pair, since the nonreputability
of the signature comes into question. However, exceptions may exist. For example,
replacing the private signature key and having its associated public signature verification key
distributed (in accordance with Section 8.1.5.1) in a timely manner may not be possible under
some circumstances. This may be the case, for example, for the private signature key of a CA. If
a private signature key is backed up, the private signature key shall be recovered using a highly
secure method. Depending on circumstances, the key should be recovered for immediate use
127