Part 1: General - Computer Security Resource Center - National ...

March, 2007
This recommendation often uses “requirement” terms; these terms have the following meaning in
this document:
1. shall: This term is used to indicate a requirement of a Federal Information Processing
Standard (FIPS) or a requirement that must be fulfilled to claim conformance to this
recommendation. Note that shall may be coupled with not to become shall not.
2. should: This term is used to indicate an important recommendation. Ignoring the
recommendation could result in undesirable results. Note that should may be coupled
with not to become should not.
1.4 Purpose of FIPS and NIST Recommendations
FIPS security standards and NIST Recommendations are valuable because:
1. They establish an acceptable minimal level of security for U.S. government systems.
Systems that implement these standards and recommendations offer a consistent level of
security Approved for sensitive, unclassified government data.
2. They often establish some level of interoperability between different systems that
implement the standard or recommendation. For example, two products that both
implement the Advanced Encryption Standard (AES) cryptographic algorithm have the
potential to interoperate, provided that the other functions of the product are compatible.
3. They often provide for scalability because the U.S. government requires products and
techniques that can be effectively applied in large numbers.
4. They are scrutinized by the U.S. government to assure that they provide an adequate level
of security. This review is performed by U.S. government experts in addition to the
reviews performed by the public.
5. NIST Approved cryptographic techniques are periodically re-assessed for their continued
effectiveness. If any technique is found to be inadequate for the continued protection of
government information, the standard is revised or discontinued.
6. Several of the FIPS and NIST Recommendations (e.g., DES, TDEA, SHA-1, DSA, and
Cryptographic Modules) have required conformance tests. These tests are performed by
accredited laboratories on vendor products that claim conformance to the standards.
Vendors are permitted to modify non-conforming products so that they meet all
applicable requirements. Users of validated products can have a high degree of
confidence that validated products conform to the standard.
Since 1977, NIST has built up a cryptographic “toolkit” of FIPS security standards and NIST
Recommendations that form a basis for the implementation of Approved cryptography. This
recommendation references many of those standards and provides guidance on how they may be
properly used to protect sensitive information.
1.5 Content and Organization
Part 1, General Guidance, contains basic key management guidance. It is intended to advise
developers and system administrators on the "best practices" associated with key management.
17