NIST Recommendations for Cryptographic Key Management

[Nytro]

[h=1]NIST Recommendations for Cryptographic Key Management[/h]

Tuesday, July 17, 2012

The proper management of cryptographic keys is essential to the effective use of cryptography for security. Keys are analogous to the combination of a safe.

If a safe combination is known to an adversary, the strongest safe provides no security against penetration. Similarly, poor key management may easily compromise strong algorithms.

Ultimately, the security of information protected by cryptography directly depends on the strength of the keys, the effectiveness of mechanisms and protocols associated with keys, and the protection afforded to the keys.

All keys need to be protected against modification, and secret and private keys need to be protected against unauthorized disclosure. Key management provides the foundation for the secure generation, storage, distribution, use and destruction of keys.

Users and developers are presented with many choices in their use of cryptographic mechanisms. Inappropriate choices may result in an illusion of security, but little or no real security for the protocol or application. This Recommendation (i.e., SP 800-57) provides background information and establishes frameworks to support appropriate decisions when selecting and using cryptographic mechanisms.

This Recommendation does not address implementation details for cryptographic modules that may be used to achieve the security requirements identified. These details are addressed in [FIPS140], the associated implementation guidance and the derived test requirements (available at Bounce to index.html).

This Recommendation is written for several different audiences and is divided into three parts. Part 1, General, contains basic key management guidance. It is intended to advise developers and system administrators on the "best practices" associated with key management.

Cryptographic module developers may benefit from this general guidance by obtaining a greater understanding of the key management features that are required to support specific, intended ranges of applications.

Protocol developers may identify key management characteristics associated with specific suites of algorithms and gain a greater understanding of the security services provided by those algorithms. System administrators may use this document to determine which configuration settings are most appropriate for their information.

Part 1 of the Recommendation:

1. Defines the security services that may be provided and key types that may be employed in using cryptographic mechanisms.

2. Provides background information regarding the cryptographic algorithms that use cryptographic keying material.

3. Classifies the different types of keys and other cryptographic information according to their functions, specifies the protection that each type of information requires and identifies methods for providing this protection.

4. Identifies the states in which a cryptographic key may exist during its lifetime.

5. Identifies the multitude of functions involved in key management.

6. Discusses a variety of key management issues related to the keying material. Topics discussed include key usage, cryptoperiod length, domain-parameter validation, publickey validation, accountability, audit, key management system survivability, and guidance for cryptographic algorithm and key size selection.

Part 2, General Organization and Management Requirements, is intended primarily to address the needs of system owners and managers. It provides a framework and general guidance to support establishing cryptographic key management within an organization and a basis for satisfying key management aspects of statutory and policy security planning requirements for Federal government organizations.

Part 3, Implementation-Specific Key Management Guidance, is intended to address the key management issues associated with currently available implementations.

The NIST Recommendations for Cryptographic Key Management can be downloaded here:

NIST Recommendations for Cryptographic Key Management.pdf

Sursa: NIST Recommendations for Cryptographic Key Management