6 Training: If the new system requires that new or different tasks (e.g., key
All changes in this version
Title
Training: If the new system requires that new or different tasks (e.g., key
Control
management procedures) be performed, then the individuals who will perform those tasks should be properly trained. Features that are thought to be improvements may be viewed as annoyances by an untrained user. 7. System implementation and transition: Care should be taken to implement the system as closely as possible to the design. Exceptions should be noted. 8. Transition: A transition plan should be developed and followed so that the changeover from the old to the new system runs as smoothly as possible. 9. Post-implementation evaluation : The system should be evaluated to verify that the implemented system meets the minimum security requirements. 5.6.5 Security Strength Reduction At some time, the security strength provided by an algorithm or key may be reduced or lost completely. For example, the algorithm or key length used may no longer offer adequate security because of improvements in computational capability or cryptanalysis. In this case, applying protection to “new” information can be performed using stronger algorithms or keys. However, information that was previously protected using these now-inadequate algorithms and keys may no longer be secure. This information may include other keys, or other sensitive data protected by the keys. A reduction in the security strength provided by an algorithm or key has the following implications:
• Encrypted information: The security of encrypted information that was available at any time to unauthorized entities in its encrypted form should be considered suspect. For example, keys that were transmitted in encrypted form (e.g., using a key-wrapping key or key-transport key and an algorithm or key length that is later broken) may need to be considered as compromised, since an adversary could have saved the encrypted form of the keys for later decryption in case methods for breaking the algorithm would eventually be found (see Section 5.5 for a discussion of key compromise). Even if the transmitted, encrypted information is subsequently re-encrypted for storage using a different key or algorithm, the information may already be compromised because of the weakness of the transmission algorithm or key. Encrypted information that was not “exposed” in this manner (e.g., not transmitted) may still be secure, even though the encryption algorithm or key length no longer provides adequate protection. For example, if the encrypted form of the keys and the information protected by those keys was never transmitted, then the information may still be confidential. The lessons to be learned are that an encryption mechanism used for information that will be available to unauthorized entities in its encrypted form (e.g., via transmission) should provide a high level of security protection, and the use of each key should be limited (i.e., the cryptoperiod should be short) so that a compromised key cannot be used to reveal very much information. If the algorithm itself is broken 27 , an adversary is forced to perform more work when each key is used to encrypt a very limited amount of information in order to decrypt all of the information. See Section 5.3.6 for a discussion about cryptoperiods.
• Digital signatures on stored data 28 : Digital signatures may be computed on data prior to transmission and subsequent storage. In this case, both the signed data and the digital signature would be stored. If the security strength of the signature is later reduced (e.g., because of a break of the algorithm), the signature may still be valid if the stored data and its associated digital signature have been adequately protected from modification since a time prior to the reduction in strength (e.g., by applying a digital signature using a stronger algorithm or key). See Section 5.5 , item 1 for further discussion. Storage capabilities are being developed that employ cryptographic timestamps to store digitally signed data beyond the normal security life of the original signature mechanism or its keys.
• Symmetric authentication codes on stored data 29 : Like digital signatures, symmetric authentication codes (i.e., MACs) may be computed on data prior to transmission and subsequent storage. If the received data and authentication code are stored as received, and the security strength of the authentication algorithm or key is later reduced (e.g., because of a break of the algorithm), the authentication code may still be valid if the stored data and its associated authentication code have been adequately protected from modification since a time prior to the reduction in strength (e.g., by applying another authentication code using a stronger algorithm or key). See Section 5.5 , item 1 for further discussion. Storage capabilities are being developed that employ cryptographic timestamps to store authenticated data beyond the normal security life of the original authentication mechanism or its keys.
27 It is easier to recover a key than exhaustive search. 28 Digital signatures on data that is transmitted, but not stored are not considered, as their value is considered to be short-lived, e.g., the digital signature was intended to be used to detect errors introduced only during transmission. 29 Symmetric authentication codes on data that is transmitted, but not stored are not considered, as their value is considered to be short-lived.