Part 1: General - Computer Security Resource Center - National ...

Security life of data up to 4 years
2010 2027 2031
Algorithm originator
usage period
Algorithm security life
Figure 2: Algorithm Originator Usage Period Example
March, 2007
When initiating cryptographic protections for information, the strongest algorithm and key size
that is appropriate for providing the protection should be used in order to minimize costly
transitions. However, it should be noted that selecting some algorithms or key sizes that are
unnecessarily large may have adverse performance affects (e.g., the algorithm may be
unacceptably slow).
The process of transitioning to a new algorithm or a new key size may be as simple as selecting a
more secure option in the security suites offered by the current system, or it can be as complex as
building a whole new system. However, given that it is necessary to develop a new algorithm
suite for a system, the following issues should be considered.
1. Sensitivity of information and system lifetime: The sensitivity of the information
that will need to be protected by the system for the lifetime of the new algorithm(s)
should be evaluated in order to determine the minimum security requirement for the
system. Care should be taken not to underestimate the lifetime of the system or the
sensitivity of information that it may need to protect. Many decisions that were
initially thought of as temporary or interim decisions have lasted well beyond their
expected lifetimes.
2. Algorithm selection: The new algorithms should be carefully selected to insure that
they meet or exceed the minimum security requirement of the system. In general, it is
relatively easy to select cryptographic algorithms and key sizes that offer high
security. However, it is wise for the amateur to consult a cryptographic expert when
70