Part 1: General - Computer Security Resource Center - National ...

RECOMMENDATION FOR KEY MANAGEMENT
Part 1: General
March, 2007
1 INTRODUCTION
Cryptographic mechanisms are one of the strongest ways to provide security services for
electronic applications and protocols and for data storage. The National Institute of Standards
and Technology (NIST) publishes Federal Information Processing Standards (FIPS) and NIST
Recommendations (which are published as Special Publications) that specify cryptographic
techniques for protecting sensitive unclassified information.
Since NIST published the Data Encryption Standard (DES) in 1977, the suite of Approved
standardized algorithms has been growing. New classes of algorithms have been added, such as
secure hash algorithms and asymmetric key algorithms for digital signatures. The suite of
algorithms now provides different levels of cryptographic strength through a variety of key sizes.
The algorithms may be combined in many ways to support increasingly complex protocols and
applications. This NIST Recommendation applies to U.S. government agencies using
cryptography for the protection of their sensitive unclassified information. This recommendation
may also be followed, on a voluntary basis, by other organizations that want to implement sound
security principles in their computer systems.
The proper management of cryptographic keys is essential to the effective use of cryptography
for security. Keys are analogous to the combination of a safe. If the combination becomes known
to an adversary, the strongest safe provides no security against penetration. Similarly, poor key
management may easily compromise strong algorithms. Ultimately, the security of information
protected by cryptography directly depends on the strength of the keys, the effectiveness of
mechanisms and protocols associated with keys, and the protection afforded the keys.
Cryptography can be rendered ineffective by the use of weak products, inappropriate algorithm
pairing, poor physical security, and the use of weak protocols.
All keys need to be protected against unauthorized substitution and modification. Secret and
private keys need to be protected against unauthorized disclosure. Key management provides the
foundation for the secure generation, storage, distribution, and destruction of keys.
1.1 Goal/Purpose
Users and developers are presented with many new choices in their use of cryptographic
mechanisms. Inappropriate choices may result in an illusion of security, but little or no real
security for the protocol or application. Basic key management guidance is provided in [SP800-
21]. This recommendation (i.e., SP 800-57) expands on that guidance, provides background
information and establishes frameworks to support appropriate decisions when selecting and
using cryptographic mechanisms.
15