Part 1: General - Computer Security Resource Center - National ...

6.2.2.5 Association with the Other Entities
March, 2007
Some cryptographic information needs to be correctly associated with another entity (e.g., the
key source), and the integrity of this association shall be maintained. For example, a symmetric
(secret) key used for the encryption of information, or keys used for the computation of a MAC
needs to be associated with the other entity(ies) that shares the key. Public keys need to be
correctly associated (bound) with the owner of the key pair (e.g., using public key certificates).
The cryptographic information shall retain its association during storage by separating the
information by “entity” or application, or by properly labeling of the information. Section 6.2.3
addresses the labeling of cryptographic information.
6.2.2.6 Association with Other Related Information
An association may need to be maintained between protected information and the keying
material that protected that information. In addition, keys may require association with other
keying material (see Section 6.2.1.6).
The association is accomplished by storing the information together or providing some linkage
or pointer between the information. Typically, the linkage between a key and the information it
protects is accomplished by providing an identifier for a key, storing the identifier with the key
in an identification/label, and storing the key’s identifier with the protected information. The
association shall be maintained for as long as the protected information needs to be processed.
Section 6.2.3 addresses the labeling of cryptographic information.
6.2.3 Labeling of Cryptographic Information
Labels may be used with cryptographic information to define the use of that information or to
provide a linkage between cryptographic information.
6.2.3.1 Labels for Keys
A label may be used to identify attributes, parameters, or the intended use of a key. Different
applications may require different labels for the same key type, and different labels may be
required for different key types. It is the responsibility of an implementer to select a suitable
label for a key. When labels are used, the label should accompany a key (i.e., is typically stored
or transmitted with a key). Some examples of label contents are:
1. Key identifier
2. Information identifying associated keys (e.g., the association between a public and
private key)
3. Identity of the key’s owner or the sharing entity
4. Cryptoperiod (e.g., start date and end date)
5. Key type (e.g., signing private key, encryption key, master key)
6. Application (e.g., purchasing, email)
7. Counter 27
27 Used to detect the playback of a previously transmitted key package
83