Part 1: General - Computer Security Resource Center - National ...

March, 2007
establishment keys, see [SP800-56]; for specific details regarding assurance of possession of
digital signature keys, see [FIPS186-3]. Assurance of private key possession may be obtained by
participating in a protocol with the claimed owner of the key that uses the private key as it is
intended to be used. For example, a private digital signature key may be confirmed by using it to
sign data (see Section 8.1.5.1.1.1, item 1), and a private key establishment key may be confirmed
by performing a key confirmation protocol with the claimed owner of the key (see [SP800-56]).
Sometimes when a CA public key is distributed, the CA will sign its own public key to provide
assurance of possession. Assurance of validity shall always be obtained prior to, or concurrently
with, assurance of possession.
5.5 Compromise of Keys and other Keying Material
Information protected by cryptographic mechanisms is secure only if the algorithms remain
strong, and the keys have not been compromised. Key compromise occurs when the protective
mechanisms for the key fail (e.g., the confidentiality, integrity or association of the key to its
owner fail - see Section 6), and the key can no longer be trusted to provide the required security.
When a key is compromised, all use of the key to protect information (e.g., compute a digital
signature or encrypt information) shall cease and the compromised key shall be revoked (see
Section 8.3.5). However, the continued use of the key under controlled circumstances to remove
or verify the protections (e.g., decrypt or verify a digital signature) may be warranted, depending
on the risks of continued use and an organization's Key Management Policy (see Part 2). The
continued use of a compromised key shall be limited to processing protected information. In this
case, the entity that uses the information shall be made fully aware of the dangers involved.
Limiting the cryptoperiod of the key limits the amount of material that would be compromised
(exposed) if the key were compromised. Using different keys for different purposes (e.g.,
different applications as well as different cryptographic mechanisms), as well as limiting the
amount of information protected by a single key, also achieves this purpose.
The compromise of a key has the following implications:
1. The unauthorized disclosure of a key means that another entity (an unauthorized entity)
may know the key and be able to use that key to perform computations requiring the use
of the key.
In general, the unauthorized disclosure of a key used to provide confidentiality
protection 16 (i.e., via encryption) means that all information encrypted by that key could
be known by unauthorized entities. For example, if a symmetric data encryption key is
compromised, the unauthorized entity might use the key to decrypt past or future
encrypted information, i.e., the information is no longer confidential between the
authorized entities.
In the case of the unauthorized disclosure of a key used to provide integrity protection
(e.g., via digital signatures), the integrity protection on the data may be lost. For example,
if a private signature key is compromised, the unauthorized entity might sign messages as
if they were originated by the key’s real owner (either new messages or messages that are
16 As opposed to the confidentiality of a key that could, for example, be used as a signing private
key.
58