Part 1: General - Computer Security Resource Center - National ...

March, 2007
8.1 Pre-operational Phase
During the pre-operational phase of key management, keying material is not yet available for
normal cryptographic operations.
8.1.1 User Registration Function
During user registration, an entity interacts with a registration authority to become an authorized
member of a security domain. In this phase, a user identifier or device name may be established
to identify the member during future transactions. In particular, security infrastructures may
associate the identification information with the entity’s keys (see Sections 8.1.5 and 8.1.6). The
entity may also establish various attributes during the registration function, such as email
addresses or role/authorization information. As with identity information, these attributes may be
associated with the entity’s keys by the infrastructure to support secure application-level security
services.
Since applications will depend upon the identity established during this process, it is crucial that
the registration authority establish appropriate procedures for the validation of identity. Identity
may be established through an in-person appearance at a registration authority, or may be
established entirely out-of-band. The strength (or weakness) of a security infrastructure will
often depend upon the identification process.
User and key registration (see Section 8.1.6) may be performed separately, or in concert. If
performed separately, the user registration process will generally establish a secret value (e.g., a
password, PIN, or HMAC key); the secret value may be used to authenticate the user during the
key registration step. If performed in concert, the user establishes an identity and performs key
registration in the same process, so the secret value is not required.
8.1.2 System Initialization Function
System initialization involves setting up or configuring a system for secure operation. This may
include algorithm preferences, the identification of trusted parties, and the definition of domain
parameter policies and any trusted parameters (e.g., recognized certificate policies).
8.1.3 User Initialization Function
User initialization consists of an entity initializing its cryptographic application (e.g., installing
and initializing software or hardware). This involves the use or installation (see Section 8.1.4) of
the initial keying material that may be obtained during user registration. Examples include the
installation of a key at a CA, trust parameters, policies, trusted parties, and algorithm
preferences.
8.1.4 Keying Material Installation Function
The security of keying material installation is crucial to the security of a system. For this
function, keying material is installed for operational use within an entity’s software, hardware,
system, application, cryptomodule, or device using a variety of techniques. Keying material is
installed when the software, hardware, system, application, cryptomodule, or device is initially
set up, when new keying material is added to the existing keying material, and when existing
keying material is replaced (via re-keying, key update, or key derivation - see Section 8.2.3 and
Section 8.2.4).
92