Part 1: General - Computer Security Resource Center - National ...

March, 2007
configuration of required key pairs that may be used, depending on the requirements of a
communication situation.
4.2.5.2 Discrete Log Key Agreement Schemes Using Elliptic Curve Arithmetic
Key agreement schemes based on the intractability of the discrete logarithm problem and using
elliptic curve arithmetic have been adopted in [SP800-56] from [ANSX9.63]. Seven of the
eleven key agreement schemes have been adopted. Each scheme provides a different
configuration of required key pairs that may be used, depending on the requirements of a
communication situation.
4.2.5.3 RSA Key Transport
RSA key agreement and key transport schemes will be adopted from [ANS X9.44] 8 .
4.2.5.4 Key Wrapping
Key wrapping is the encryption of a key by a key encrypting key using a symmetric algorithm
(e.g., an AES key is encrypted by an AES key encrypting key) 9 . Key wrapping provides both
confidentiality and integrity to the wrapped material.
4.2.5.5 Key Confirmation
Key confirmation is used by two parties in a key establishment process to provide assurance that
common keying material and/or shared secret has been established. The assurance may be
provided to only one party (unilateral) or it may be provided to both parties (bilateral). The
assurance may be provided as part of the key establishment scheme or it may be provided by
some action that takes place outside of the scheme. For example, after a key is established, two
parties may confirm to one another that they possess the same secret by demonstrating their
capability to encrypt and decrypt data intended for each other. [SP800-56] provides for unilateral
key confirmation for schemes where one party has a static key establishment key, and bilateral
key confirmation for schemes where both parties have static key establishment keys.
4.2.6 Key Establishment Protocols
Key establishment protocols use key establishment schemes in order to specify the processing
necessary to establish a key. However, key establishment protocols also specify message flow
and format. Key establishment protocols must be carefully designed to not give secret
information to a potential attacker. For example, a protocol that indicates abnormal conditions,
such as a data integrity error, may permit an attacker to confirm or reject an assumption
regarding secret data. Alternatively, if the time or power required to perform certain
computations are based upon the value of the secret or private key in use, then an attacker may
be able to deduce the key from observed fluctuations.
Therefore, it is best to design key establishment protocols so that:
1. The protocols do not provide for an early exit from the protocol upon detection of a
single error
8 Further text will be developed after X9.44 is completed.
9 Additional text will be added after key wrapping standards are completed.
39