Part 1: General - Computer Security Resource Center - National ...

March, 2007
Assurance of private key possession provides assurance that the owner of a public key
actually possesses the corresponding private key (see Section 5.4.4).
The period of protection for cryptographic keys, associated key information, and
cryptographic parameters (e.g. initialization vectors) depends on the type of key, the
associated cryptographic service, and the length of time for which the cryptographic
service is required. The period of protection includes the cryptoperiod of the key (see
Section 5.3). The period of protection is not necessarily the same for integrity as it is for
confidentiality. Integrity protection may be required until a key is no longer used, but
confidentiality protection may be required until the key is destroyed.
6.1.1 Summary of Protection Requirements for Cryptographic Keys
Table 5 provides a summary of the protection requirements for keys during distribution and
storage. Methods for providing the necessary protection are discussed in Section 6.2.
Guide to Table 5:
a. Column 1 (Key Type) identifies the key types.
b. Column 2 (Security Service) indicates the type of security service that is provided by the
key in conjunction with a cryptographic technique.
c. Column 3 (Security Protection) indicates the type of protection required for the key
(archive, integrity, and confidentiality).
d. Column 4 (Association Protection) indicates the types of associations that need to be
protected for that key, such as associating the key with the usage or application, the
authorized communications participants or other indicated information. The association
with domain parameters applies only to algorithms where they are used.
e. Column 5 (Assurances Required) indicates whether assurance of public key validity
and/or assurance of private key possession needs to be obtained as defined in [SP800-56],
[FIPS186-3] and this recommendation. Assurance of public key validity provides a
degree of confidence that a key is arithmetically correct. See Section 5.4.3 for further
details. Assurance of private key possession provides a degree of confidence that the
entity providing a public key actually possessed the associated private key at some time.
See Section 5.4.4 for further details.
f. Column 6 (Period of Protection) indicates the length of time that the integrity and/or
confidentiality of the key need to be maintained (see Section 5.3). Symmetric keys and
private keys shall be destroyed at the end of their period of protection (see Sections 8.3.4
and 9.3).
73