Part 1: General - Computer Security Resource Center - National ...

March, 2007
Crypto. Security Security Association Assurance Period of Protection
Information Service Protection Protection of Domain
Type Parameter
Validity
RNG Seeds Support Confidentiality;
Integrity
Usage or application Used once and destroyed
From generation until no
longer needed for
subsequent reseeding.
The RNG seed shall be
destroyed at the end of the
period of protection
Other public Support Archive; Usage or application; From generation until no
information
Integrity; Other authorized
entities;
Data processed using
the nonce
longer needed to process
data using the public
information
Intermediate
results
Key control
information
(e.g., IDs,
purpose)
Random
number
Support Confidentiality;
Integrity
Support Archive;
Integrity
Support Integrity;
Confidentiality
(depends on
usage)
Password Authentication Integrity;
Confidentiality
Usage or application From generation until no
longer needed and the
intermediate results are
destroyed
Key From generation until the
associated key is destroyed
Usage or application;
Owning entity
From generation until no
longer needed, and the
random number is destroyed
From generation until
replaced or no longer needed
to authenticate the entity
Audit Support Archive; Audited events; From generation until no
information
Integrity; Key control
longer needed
Access
authorization
information
6.2 Protection Mechanisms
During the lifetime of cryptographic information, the information is either “in transit” (e.g., is in
the process of being manually or electronically distributed to the authorized communications
participants for use by those entities) or is “at rest” (e.g., the information is in storage). In either
case, the keying material shall be protected in accordance with Section 6.1. However, the choice
of protection mechanisms may vary. Although several methods of protection are provided in the
following subsections, not all methods provide equal security. The method should be carefully
selected. In addition, the mechanisms prescribed do not, by themselves, guarantee protection.
78