Part 1: General - Computer Security Resource Center - National ...

Guide to Table 6:
March, 2007
a. Column 1 (Cryptographic Information Type) identifies the type of cryptographic
information.
b. Column 2 (Security Service) indicates the type of security service provided by the
cryptographic information.
c. Column 3 (Security Protection) indicates the type of security protection for the
cryptographic information.
d. Column 4 (Association Protection) indicates the relevant types of associations for each
type of cryptographic information.
e. Column 5 (Assurance of Domain Parameter Validity) indicates the cryptographic
information for which assurance shall be obtained as defined in [SP800-56] and
[FIPS186-3] and in Section 5.4 of this recommendation. Assurance of domain parameter
validity gives confidence that domain parameters are arithmetically correct.
f. Column 6 (Period of Protection) indicates the length of time that the integrity and/or
confidentiality of the cryptographic information needs to be maintained. The
cryptographic information shall be destroyed at the end of the period of protection (see
Sections 8.3.4).
Table 6: Protection requirements for other cryptographic or related material
Crypto.
Information
Type
Domain
parameters
Initialization
vectors
Security
Service
Depends on
key assoc. with
the parameters
Depends on
algorithm
Security
Protection
Archive;
Integrity
Archive;
Integrity 26
Shared secrets Support Confidentiality,
Integrity
Association
Protection
Usage or application;
Private and public
keys
Assurance
of Domain
Parameter
Validity
Period of Protection
Yes From generation until no
longer needed to generate
keys, or verify signatures
Protected data From generation until no
longer needed to process the
protected data
From generation until end of
transaction.
The shared secret shall be
destroyed at the end of the
period of protection
26 IVs are not generally protected during transmission; however, the decryption system may be designed to detect or
minimize the effect of unauthorized substitutions and modifications to transmitted IVs. In this case the decryption
system forms the data integrity mechanism.
77