BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

6.1.2 Summary of Protection Requirements for Other Cryptographic or Related

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 4
All changes in this version
first version loaded 6 Training: If the new system requires that new or different tasks (e.g., key part of 6.1

Title

Summary of Protection Requirements for Other Cryptographic or Related

Control

Information Table 6 provides a summary of the protection requirements for other cryptographic information during distribution and storage. Mechanisms for providing the necessary protection are discussed in Section 6.2 . Guide to Table 6 : a. Column 1 (Cryptographic Information Type) identifies the type of cryptographic information. b. Column 2 (Security Service) indicates the type of security service provided by the cryptographic information. c. Column 3 (Security Protection) indicates the type of security protection for the cryptographic information. d. Column 4 (Association Protection) indicates the relevant types of associations for each type of cryptographic information. e. Column 5 (Assurance of Domain Parameter Validity) indicates the cryptographic information for which assurance shall be obtained as defined in [SP800-56A] and [SP800-89] and in Section 5.4 of this Recommendation. Assurance of domain- parameter validity gives confidence that domain parameters are arithmetically correct. f. Column 6 (Period of Protection) indicates the length of time that the integrity and/or confidentiality of the cryptographic information needs to be maintained. The cryptographic information shall be destroyed at the end of the period of protection (see Section 8.3.4 ). Table 6: Protection requirements for other cryptographic or related material

Crypto. Information Type Security Service Security Protection Association Protection Assurance of Domain Parameter Validity Period of Protection

Domain parameters Depends on the key assoc. with the parameters Integrity Usage or application Private and public keys Yes From generation until no longer needed to generate keys or verify signatures Initialization vectors Depends on the algorithm Integrity 32 Protected data From generation until no longer needed to process the protected data

32 IVs are not generally protected during transmission; however, the decryption system may be designed to detect or minimize the effect of unauthorized substitutions and modifications to transmitted IVs. In this case the decryption system is the data-integrity mechanism. Crypto. Information Type Security Service Security Protection Association Protection Assurance of Domain Parameter Validity Period of Protection

Shared secrets Support Confidentiality Integrity From generation until the end of the transaction. The shared secret shall be destroyed at the end of the period of protection RBG Seeds Support Confidentiality Integrity Usage or application Used once and destroyed immediately after use Other public information Support Integrity Usage or application Other authorized entities Data processed using the nonce From generation until no longer needed to process data using the public information

Other secret information Support Confidentiality Integrity Usage or application Other authorized entities Data processed using the secret information From generation until no longer needed to process data using the secret information

Intermediate results Support Confidentiality Integrity Usage or application From generation until no longer needed and the intermediate results are destroyed Key-control information (e.g., IDs, purpose) Support Integrity Key From generation until the associated key is destroyed

Random number Support Integrity Confidentiality (depends on usage) From generation until no longer needed, and the random number is destroyed

Password Source authentication; Key derivation Integrity Confidentiality Usage or application Owning entity From generation until replaced or no longer needed to authenticate the entity or to derive keys Audit information Support Integrity Access authorization Audited events Key control information From generation until no longer needed