Part 1: General - Computer Security Resource Center - National ...
Part 1: General - Computer Security Resource Center - National ... Part 1: General - Computer Security Resource Center - National ...
19. Public authorization key: March, 2007 a. Type Considerations: A public authorization key is the public element of an asymmetric key pair used to verify privileges for an entity that possesses the associated private key. The length of the public authorization key cryptoperiod is of far less concern, from a security point of view, than is that of the associated private key. b. Cryptoperiod: The cryptoperiod of the public authorization key shall be the same as the authorization private key: no more than two years. Table 1 below is a summary of the cryptoperiods that are recommended for each key type. Table 1: Recommended Cryptoperiods for key types 13 Key Type Originator Usage Period (OUP) Cryptoperiod Recipient Usage Period 1. Private Signature Key 1-3 years 2. Public Signature Key Several years (depends on key size) 3. Symmetric Authentication Key < 2 years < OUP + 3 years 4. Private Authentication Key 1-2 years 5. Public Authentication Key 1-2 years 6. Symmetric Data Encryption Keys 7. Symmetric Key Wrapping Key 8. Symmetric and asymmetric RNG Keys < 2 years < OUP + 3 years < 2 years < OUP + 3 years Upon reseeding 9. Symmetric Master Key About 1 year 10. Private Key Transport Key < 2 years 14 11. Public Key Transport Key 1-2 years 13 In some cases risk factors affect the cryptoperiod selection (see Section 5.3.1). 14 . In certain email applications where received messages are stored and decrypted at a later time, the cryptoperiod of the private key transport key may exceed the cryptoperiod of the public key transport key. 55
Key Type 12. Symmetric Key Agreement Key 13. Private Static Key Agreement Key 14. Public Static Key Agreement Key 15. Private Ephemeral Key Agreement Key 16. Public Ephemeral Key Agreement Key 17. Symmetric Authorization Key Originator Usage Period (OUP) Cryptoperiod 1-2 years 1-2 years 15 1-2 years Recipient Usage Period One key agreement transaction One key agreement transaction < 2 years 18. Private Authorization Key < 2 years 19. Public Authorization Key < 2 years 5.3.7 Recommendations for Other Keying Material March, 2007 Other keying material does not have well-established cryptoperiods, per se. The following recommendations are offered regarding the disposition of this other keying material: 1. Domain parameters remain in effect until changed. 2. An IV is associated with the information that it helps to protect, and is needed until the information and its protection are no longer needed. 3. Shared secrets shall be destroyed as soon as they are no longer needed to derive keying material. 4. RNG seeds should be destroyed immediately after use. 5. Other public information should not be retained longer than needed for cryptographic processing. 6. Intermediate results shall be destroyed immediately after use. 15 In certain email applications whereby received messages are stored and decrypted at a later time, the cryptoperiod of the private static key agreement key may exceed the cryptoperiod of the public static key agreement key. 56
- Page 5 and 6: Authority March, 2007 This document
- Page 7 and 8: March, 2007 key validation, account
- Page 9 and 10: March, 2007 4.2.4.1 DSA............
- Page 11 and 12: March, 2007 8 KEY MANAGEMENT PHASES
- Page 13 and 14: March, 2007 10.2.9 Compromise Manag
- Page 15 and 16: March, 2007 Figure 3: Key states an
- Page 17 and 18: March, 2007 1.2 Audience The audien
- Page 19 and 20: March, 2007 1. Section 1, Introduct
- Page 21 and 22: March, 2007 Backup A copy of inform
- Page 23 and 24: March, 2007 Digital signature The r
- Page 25 and 26: Key Management Policy Key Managemen
- Page 27 and 28: Proof of possession (POP) Pseudoran
- Page 29 and 30: March, 2007 Split knowledge A proce
- Page 31 and 32: March, 2007 3 Security Services Cry
- Page 33 and 34: March, 2007 However, it is often th
- Page 35 and 36: March, 2007 4 Cryptographic Algorit
- Page 37 and 38: March, 2007 operates on blocks (chu
- Page 39 and 40: March, 2007 minimum key size 7 of 1
- Page 41 and 42: March, 2007 2. The protocols trigge
- Page 43 and 44: March, 2007 7. Symmetric key wrappi
- Page 45 and 46: March, 2007 9. Random numbers: The
- Page 47 and 48: March, 2007 In general, where stron
- Page 49 and 50: March, 2007 a. When a symmetric key
- Page 51 and 52: March, 2007 information. For less s
- Page 53 and 54: 8. Symmetric and Asymmetric RNG key
- Page 55: 15. Private ephemeral key agreement
- Page 59 and 60: March, 2007 establishment keys, see
- Page 61 and 62: March, 2007 c. Restricting plaintex
- Page 63 and 64: March, 2007 algorithms completely i
- Page 65 and 66: March, 2007 Table 3: Hash function
- Page 67 and 68: Table 4: Recommended algorithms and
- Page 69 and 70: March, 2007 size is available, the
- Page 71 and 72: Security life of data up to 4 years
- Page 73 and 74: March, 2007 6 Protection Requiremen
- Page 75 and 76: Table 5: Protection requirements fo
- Page 77 and 78: Key Type Security Service Private e
- Page 79 and 80: March, 2007 Crypto. Security Securi
- Page 81 and 82: March, 2007 may be applied only to
- Page 83 and 84: March, 2007 All cryptographic infor
- Page 85 and 86: March, 2007 8. Domain parameters (e
- Page 87 and 88: March, 2007 6. Destroyed Compromise
- Page 89 and 90: March, 2007 a. A private signature
- Page 91 and 92: 2 Pre-Operational Phase 3 7 1 4 Ope
- Page 93 and 94: March, 2007 8.1 Pre-operational Pha
- Page 95 and 96: 8.1.5.1.1 Distribution of Static Pu
- Page 97 and 98: March, 2007 and then provide eviden
- Page 99 and 100: March, 2007 listed in Section 8.1.5
- Page 101 and 102: March, 2007 encrypting key or publi
- Page 103 and 104: March, 2007 8.1.5.3.5 Intermediate
- Page 105 and 106: March, 2007 of keying material and
Key Type<br />
12. Symmetric Key Agreement<br />
Key<br />
13. Private Static Key<br />
Agreement Key<br />
14. Public Static Key Agreement<br />
Key<br />
15. Private Ephemeral Key<br />
Agreement Key<br />
16. Public Ephemeral Key<br />
Agreement Key<br />
17. Symmetric Authorization<br />
Key<br />
Originator Usage<br />
Period (OUP)<br />
Cryptoperiod<br />
1-2 years<br />
1-2 years 15<br />
1-2 years<br />
Recipient Usage<br />
Period<br />
One key agreement transaction<br />
One key agreement transaction<br />
< 2 years<br />
18. Private Authorization Key < 2 years<br />
19. Public Authorization Key < 2 years<br />
5.3.7 Recommendations for Other Keying Material<br />
March, 2007<br />
Other keying material does not have well-established cryptoperiods, per se. The following<br />
recommendations are offered regarding the disposition of this other keying material:<br />
1. Domain parameters remain in effect until changed.<br />
2. An IV is associated with the information that it helps to protect, and is needed until the<br />
information and its protection are no longer needed.<br />
3. Shared secrets shall be destroyed as soon as they are no longer needed to derive keying<br />
material.<br />
4. RNG seeds should be destroyed immediately after use.<br />
5. Other public information should not be retained longer than needed for cryptographic<br />
processing.<br />
6. Intermediate results shall be destroyed immediately after use.<br />
15 In certain email applications whereby received messages are stored and decrypted at a later time, the cryptoperiod<br />
of the private static key agreement key may exceed the cryptoperiod of the public static key agreement key.<br />
56
Change language