Part 1: General - Computer Security Resource Center - National ...

March, 2007
1.2 Audience
The audiences for the Recommendation for Key Management include system or application
owners and managers, cryptographic module developers, protocol developers, and system
administrators. The recommendation has been provided in three parts. The different parts into
which the recommendation has been divided have been tailored to specific audiences.
Part 1 of this recommendation provides general key management guidance that is intended to be
useful to both system developers and system administrators. Cryptographic module developers
may benefit from this general guidance through a greater understanding of the key management
features that are required to support specific intended ranges of applications. Protocol developers
may identify key management characteristics associated with specific suites of algorithms and
gain a greater understanding of the security services provided by those algorithms. System
administrators may use this recommendation to determine which configuration settings are most
appropriate for their information.
Part 2 of this recommendation is tailored for system or application owners for use in identifying
appropriate organizational key management infrastructures, establishing organizational key
management policies, and specifying organizational key management practices and plans.
Part 3 of this recommendation is intended to provide guidance to system administrators
regarding the use of cryptographic algorithms in specific applications, the selection of products
to satisfy specific operational environments, and the appropriate configuration of the products.
Though some background information and rationale are provided for context and to support
recommendations, this document assumes that the reader has a basic understanding of
cryptography. For background material, readers may look to a variety of NIST and commercial
publications. [SP800-21] includes a brief introduction to cryptography. [SP800-5] and [SP800-
32] provide an introduction to public key infrastructure. A mathematical review of cryptography
and cryptographic algorithms is found in [HAC] and [AC].
1.3 Scope
This recommendation encompasses cryptographic algorithms, infrastructures, protocols, and
applications, and the management thereof. All cryptographic algorithms currently Approved by
NIST for the protection of unclassified but sensitive information are in scope.
This recommendation focuses on issues involving the management of cryptographic keys: their
generation, use, and eventual destruction. Related topics, such as algorithm selection and
appropriate key size, cryptographic policy, and cryptographic module selection, are also included
in this recommendation. Some of the topics noted above are addressed in other NIST standards
and guidance. This recommendation supplements more focused standards and guidelines.
This recommendation does not address implementation details for cryptographic modules that
may be used to achieve the security requirements identified. These details are addressed in
[SP800-21], [FIPS140-2], and the derived test requirements (available at
http://csrc.nist.gov/cryptval/).
This recommendation also does not address the requirements or procedures for operating an
archive other than discussing the types of keying material that are appropriate to include in an
archive and the protection to be provided to the archived keying material.
16