Part 1: General - Computer Security Resource Center - National ...
Part 1: General - Computer Security Resource Center - National ... Part 1: General - Computer Security Resource Center - National ...
March, 2007 transaction 11 to establish one or more keys (e.g., key wrapping keys, data encryption keys, or MAC keys) and, optionally, other keying material (e.g., Initialization Vectors). 17. Symmetric authorization key: Symmetric authorization keys are used to provide privileges to an entity using a symmetric cryptographic method. The authorization key is known by the entity responsible for monitoring and granting access privileges for authorized entities and by the entity seeking access to resources. 18. Private authorization key: A private authorization key is the private key of an asymmetric (public) key pair that is used to provide privileges to an entity. 19. Public authorization key: A public authorization key is the public key of an asymmetric (public) key pair that is used to verify privileges for an entity that knows the associated private authorization key. 5.1.2 Other Cryptographic or Related Information Other information used in conjunction with cryptographic algorithms and keys also needs to be protected. 1. Domain Parameters: Domain parameters are used in conjunction with some public key algorithms to generate key pairs or to create digital signatures or to establish keying material. Domain parameters shall be protected in accordance with Table 6. 2. Initialization Vectors: Initialization vectors (IVs) are used by several modes of operation for encryption and decryption (see Section 4.2.2.3) and for the computation of MACs using block cipher algorithms (see Section 4.2.3.1) and shall be protected in accordance with Table 6. 3. Shared Secrets: Shared secrets are generated during a key establishment process as defined in [SP800-56]. Shared secrets shall not exist outside the cryptographic boundary of the cryptomodule. If a FIPS 140-2 validated cryptomodule is being used, then protection of the shared secrets is provided by the cryptomodule. 4. RNG seeds: RNG seeds are used in the generation of deterministic random numbers and shall remain secret (e.g., used to generate keying material that must remain secret or private). 5. Other public information: Public information (e.g., a nonce) is often used in the key establishment process. 6. Intermediate Results: The intermediate results of cryptographic operations using secret information shall be protected. Intermediate results shall not exist outside the cryptographic boundary of the cryptomodule. 8. Key control information: Information related to the keying material (e.g., the identifier, purpose, or a counter) shall be protected to ensure that the associated keying material can be correctly used. 11 The public ephemeral key agreement key of a sender may be retained by the receiver for later use in decrypting a stored (encrypted) message for which the ephemeral key pair was generated. 43
March, 2007 9. Random numbers: The random numbers created by a random number generator should be protected when retained. When used directly as keying material, the random numbers shall be protected as discussed in Section 6. 10. Passwords: A password is used to acquire access to privileges. As such, it is used as an authentication mechanism. 11. Audit information: Audit information that contains key management events shall be integrity protected. 5.2 Key Usage In general, a single key should be used for only one purpose (e.g., encryption, authentication, key wrapping, random number generation, or digital signatures). There are several reasons for this: 1. The use of the same key for two different cryptographic processes may weaken the security provided by one or both of the processes. 2. Limiting the use of a key limits the damage that could be done if the key is compromised. 3. Some uses of keys interfere with each other. For example, consider a key pair used for both key transport and digital signatures. In this case the private key is used as both a private key transport key to decrypt data encryption keys and a private signature key to apply digital signatures. It may be necessary to retain the private key transport key beyond the cryptoperiod of the corresponding public key transport key in order to decrypt the data encryption keys needed to access encrypted data. On the other hand, the private signature key should be destroyed at the expiration of its cryptoperiod to prevent its compromise. In this example, the longevity requirements for the private key transport key and the private digital signature key contradict each other. This principle does not preclude using a single key in cases where the same process can provide multiple services. This is the case, for example, when a digital signature provides nonrepudiation, authentication and integrity protection using a single digital signature, or when a single symmetric data encryption key can be used to encrypt and authenticate data in a single cryptographic operation (e.g., using an authenticated encryption operation, as opposed to separate encryption and authentication operations). Also refer to Section 3.7. This specification also permits the use of a key transport or key agreement private key to generate a digital signature for the following special case: When requesting the (initial) certificate for a static key establishment key, the associated private key may be used to sign the certificate request. Also refer to Section 8.1.5.1.1.2. 5.3 Cryptoperiods A cryptoperiod is the time span during which a specific key is authorized for use by legitimate entities, or the keys for a given system will remain in effect. A suitably defined cryptoperiod: 1. Limits the amount of information protected by a given key that is available for cryptanalysis, 2. Limits the amount of exposure if a single key is compromised, 44
- Page 1 and 2: ARCHIVED PUBLICATION The attached p
- Page 3 and 4: Abstract March, 2007 This Recommend
- Page 5 and 6: Authority March, 2007 This document
- Page 7 and 8: March, 2007 key validation, account
- Page 9 and 10: March, 2007 4.2.4.1 DSA............
- Page 11 and 12: March, 2007 8 KEY MANAGEMENT PHASES
- Page 13 and 14: March, 2007 10.2.9 Compromise Manag
- Page 15 and 16: March, 2007 Figure 3: Key states an
- Page 17 and 18: March, 2007 1.2 Audience The audien
- Page 19 and 20: March, 2007 1. Section 1, Introduct
- Page 21 and 22: March, 2007 Backup A copy of inform
- Page 23 and 24: March, 2007 Digital signature The r
- Page 25 and 26: Key Management Policy Key Managemen
- Page 27 and 28: Proof of possession (POP) Pseudoran
- Page 29 and 30: March, 2007 Split knowledge A proce
- Page 31 and 32: March, 2007 3 Security Services Cry
- Page 33 and 34: March, 2007 However, it is often th
- Page 35 and 36: March, 2007 4 Cryptographic Algorit
- Page 37 and 38: March, 2007 operates on blocks (chu
- Page 39 and 40: March, 2007 minimum key size 7 of 1
- Page 41 and 42: March, 2007 2. The protocols trigge
- Page 43: March, 2007 7. Symmetric key wrappi
- Page 47 and 48: March, 2007 In general, where stron
- Page 49 and 50: March, 2007 a. When a symmetric key
- Page 51 and 52: March, 2007 information. For less s
- Page 53 and 54: 8. Symmetric and Asymmetric RNG key
- Page 55 and 56: 15. Private ephemeral key agreement
- Page 57 and 58: Key Type 12. Symmetric Key Agreemen
- Page 59 and 60: March, 2007 establishment keys, see
- Page 61 and 62: March, 2007 c. Restricting plaintex
- Page 63 and 64: March, 2007 algorithms completely i
- Page 65 and 66: March, 2007 Table 3: Hash function
- Page 67 and 68: Table 4: Recommended algorithms and
- Page 69 and 70: March, 2007 size is available, the
- Page 71 and 72: Security life of data up to 4 years
- Page 73 and 74: March, 2007 6 Protection Requiremen
- Page 75 and 76: Table 5: Protection requirements fo
- Page 77 and 78: Key Type Security Service Private e
- Page 79 and 80: March, 2007 Crypto. Security Securi
- Page 81 and 82: March, 2007 may be applied only to
- Page 83 and 84: March, 2007 All cryptographic infor
- Page 85 and 86: March, 2007 8. Domain parameters (e
- Page 87 and 88: March, 2007 6. Destroyed Compromise
- Page 89 and 90: March, 2007 a. A private signature
- Page 91 and 92: 2 Pre-Operational Phase 3 7 1 4 Ope
- Page 93 and 94: March, 2007 8.1 Pre-operational Pha
March, 2007<br />
transaction 11 to establish one or more keys (e.g., key wrapping keys, data encryption<br />
keys, or MAC keys) and, optionally, other keying material (e.g., Initialization Vectors).<br />
17. Symmetric authorization key: Symmetric authorization keys are used to provide<br />
privileges to an entity using a symmetric cryptographic method. The authorization key is<br />
known by the entity responsible for monitoring and granting access privileges for<br />
authorized entities and by the entity seeking access to resources.<br />
18. Private authorization key: A private authorization key is the private key of an asymmetric<br />
(public) key pair that is used to provide privileges to an entity.<br />
19. Public authorization key: A public authorization key is the public key of an asymmetric<br />
(public) key pair that is used to verify privileges for an entity that knows the associated<br />
private authorization key.<br />
5.1.2 Other Cryptographic or Related Information<br />
Other information used in conjunction with cryptographic algorithms and keys also needs to be<br />
protected.<br />
1. Domain Parameters: Domain parameters are used in conjunction with some public key<br />
algorithms to generate key pairs or to create digital signatures or to establish keying material.<br />
Domain parameters shall be protected in accordance with Table 6.<br />
2. Initialization Vectors: Initialization vectors (IVs) are used by several modes of operation for<br />
encryption and decryption (see Section 4.2.2.3) and for the computation of MACs using<br />
block cipher algorithms (see Section 4.2.3.1) and shall be protected in accordance with Table<br />
6.<br />
3. Shared Secrets: Shared secrets are generated during a key establishment process as defined<br />
in [SP800-56]. Shared secrets shall not exist outside the cryptographic boundary of the<br />
cryptomodule. If a FIPS 140-2 validated cryptomodule is being used, then protection of the<br />
shared secrets is provided by the cryptomodule.<br />
4. RNG seeds: RNG seeds are used in the generation of deterministic random numbers and<br />
shall remain secret (e.g., used to generate keying material that must remain secret or private).<br />
5. Other public information: Public information (e.g., a nonce) is often used in the key<br />
establishment process.<br />
6. Intermediate Results: The intermediate results of cryptographic operations using secret<br />
information shall be protected. Intermediate results shall not exist outside the cryptographic<br />
boundary of the cryptomodule.<br />
8. Key control information: Information related to the keying material (e.g., the identifier,<br />
purpose, or a counter) shall be protected to ensure that the associated keying material can be<br />
correctly used.<br />
11 The public ephemeral key agreement key of a sender may be retained by the receiver for later use in decrypting a<br />
stored (encrypted) message for which the ephemeral key pair was generated.<br />
43
Change language