Part 1: General - Computer Security Resource Center - National ...

March, 2007
Split knowledge A process by which a cryptographic key is split into n multiple key
components, individually providing no knowledge of the original key,
which can be subsequently combined to recreate the original
cryptographic key. If knowledge of k (where k is less than or equal to
n) components is required to construct the original key, then
knowledge of any k-1 key components provides no information about
the original key other than, possibility, its length.
Note that in this document split knowledge is not intended to cover key
shares such as those used in threshold or multi-party signatures.
Static key A key that is intended for use for a relatively long period of time and is
typically intended for use in many instances of a cryptographic key
establishment scheme. Contrast with an ephemeral key
Symmetric key A single cryptographic key that is used with a secret (symmetric) key
algorithm.
Symmetric key
algorithm
A cryptographic algorithm that uses the same secret key for an
operation and its complement (e.g., encryption and decryption).
System initialization A function in the lifecycle of keying material; setting up and
configuring a system for secure operation.
Trust anchor A public key and the name of a certification authority that is used to
validate the first certificate in a sequence of certificates. The trust
anchor public key is used to verify the signature on a certificate issued
by a trust anchor certification authority. The security of the validation
process depends upon the authenticity and integrity of the trust anchor.
Trust anchors are often distributed as self-signed certificates.
Unauthorized
disclosure
An event involving the exposure of information to entities not
authorized access to the information.
User initialization A function in the lifecycle of keying material; the process whereby a
user initializes its cryptographic application (e.g., installing and
initializing software and hardware).
User registration A function in the lifecycle of keying material; a process whereby an
entity becomes a member of a security domain.
Work The expected time to break a cipher with a given resource. For
example, 12 MIPS years would be the amount of work that one
computer, with the capability of processing a Million Instructions Per
Second, could do in 12 years. The same amount of work could be done
by 12 such computers in one year assuming that the algorithm being
executed can be sufficiently parallelized.
X.509 certificate The ISO/ITU-T X.509 standard defined two types of certificates – the
X.509 public key certificate, and the X.509 attribute certificate. Most
commonly (including this document), an X.509 certificate refers to the
X.509 public key certificate.
28