Part 1: General - Computer Security Resource Center - National ...

March, 2007
8 Key Management Phases and Functions
The cryptographic key management life cycle can be divided into four phases. During each
phase, the keys may be in certain specific states as defined in Section 7. In addition, within each
phase, certain key management functions are typically performed. These functions are necessary
for the management of the keys and their associated attributes.
Key management information is characterized by attributes. The attributes required for key
management might include the identity of a person or system associated with that key or the
types of information that person is authorized to access. Attributes are leveraged by applications
to select the appropriate cryptographic key(s) for a particular service. While these attributes do
not appear in cryptographic algorithms, they are crucial to the implementation of applications
and application protocols.
The four phases of key management are specified below.
1. Pre-operational phase: The keying material is not yet available for normal
cryptographic operations. Keys may not yet be generated, or may be in the pre-activation
state. System or enterprise attributes are established during this phase as well.
2. Operational phase: The keying material is available and in normal use. Keys are in the
active state. Keys may be designated as protect only, process only, or protect and process.
3. Post-operational phase: The keying material is no longer in normal use, but access to
the keying material is possible and the keying material may be used for process only in
certain circumstances. Keys are in the deactivated or compromised states. Keys in the
post-operational phase are archived (see section 8.3.1) when not processing data.
4. Destroyed phase: Keys are no longer available. All records of their existence may have
been deleted. Keys are in the destroyed or destroyed compromised states. Although the
keys themselves are destroyed, the key attributes (e.g., key name, type, cryptoperiod, and
usage period) may be retained (see Section 8.4).
A flow diagram for the key management phases is presented as Figure 4. Seven phase transitions
are identified in the diagram. A key shall not be able to transfer back to any previous phase.
89