Part 1: General - Computer Security Resource Center - National ...

March, 2007
size is available, the selection may be based on algorithm performance, memory
requirements, etc. as long as the minimum requirements are met.
c. Key establishment: Select a key establishment scheme based on the application and
environment (see [SP800-56]), the availability of an algorithm in an implementation, and
its performance. Select a key size from Table 2 for the algorithm that provides at least
128 bits of security. For example, if an ECC key agreement scheme is available, use the
ECC scheme with a 256-bit key. However, it is recommended that the key used for key
agreement be different from an ECDSA key used for digital signatures.
Agencies that procure systems should consider the potential operational lifetime of the system.
The agencies shall either select algorithms that are expected to be secure during the entire
system lifetime, or should ensure that the algorithms and key sizes can be readily updated.
5.6.4 Transitioning to New Algorithms and Key Sizes
The estimated time period during which data protected by a specific cryptographic algorithm
(and key size) remains secure is called the algorithm security lifetime. During this time, the
algorithm may be used to both apply cryptographic protection (e.g., encrypt data) and to process
the protected information (e.g., decrypt data); the algorithm is expected to provide adequate
protection for the protected data during this period.
Typically, an organization selects the cryptographic services that are needed for a particular
application. Then, based on the algorithm security lifetime and the security life of the data to be
protected, an algorithm and key size suite is selected that is sufficient to meet the requirements.
The organization then establishes a key management system (if required), including validated
cryptographic products that provide the services required by the application. As an algorithm and
key size suite nears its expiration date, transitioning to a new algorithm and key size suite should
be anticipated.
There are many legacy applications currently available that use algorithms and key sizes not
specified in Table 2. When the algorithm or key size is determined to no longer provide the
desired protection for information (e.g., the algorithm may have been "broken"), any information
"protected" by the algorithm or key size is considered to be "exposed" (e.g., no longer
confidential, or the integrity cannot be assured). If the protected data is retained, it should be reprotected
using an Approved algorithm and key size that will protect the information for the
remainder of its security life. However, it should be assumed that encrypted information could
have been collected and retained by unauthorized entities (adversaries). The unauthorized entity
may attempt to decrypt the information at some later time. In addition, the recovered plaintext
could be used to attempt a matched plaintext-ciphertext attack on the new algorithm.
When using Table 2 and Table 4 to select the appropriate key size for an algorithm, it is very
important to take the expected security life of the data into consideration. As stated earlier, an
algorithm (and key size) is used both to apply cryptographic protection to data and process the
protected data. When the security life of the data is taken into account, cryptographic protection
should not be applied to data using a given algorithm (and key size) if the security life of the
data extends beyond the end of the algorithm security lifetime. The period of time that an
algorithm (and key size) may be used to apply cryptographic protection is called the algorithm
originator usage period. The algorithm security life = (the algorithm usage period + the security
life of the data).
68