BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.1.1 User Registration Function

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 4
All changes in this version
first version loaded 8 Key-Management Phases and Functions part of 8.1

Title

User Registration Function

Control

During user registration, an entity interacts with a registration authority to become an authorized member of a security domain. In this phase, a user identifier or device name may be established to identify the member during future transactions. In particular, security infrastructures may associate the identification information with the entity’s keys (see Sections 8.1.5 and 8.1.6 ). The entity may also establish various information during the registration function, such as email addresses, or role and authorization information. As with identity information, this information may be associated with the entity’s keys by the infrastructure to support secure application-level security services. Since applications will depend upon the identity established during this process, it is crucial that the registration authority establish appropriate procedures for the validation of identity. Identity may be established through an in-person appearance at a registration authority, or may be established entirely out-of-band. Human entities are usually required to provide credentials (e.g., an identification card or birth certificate), while system entities are vouched for by those individuals responsible for system operation. The strength (or weakness) of a security infrastructure will often depend upon the identification process. [ FIPS201 ] and [ SP800-63 ] address requirements for establishing identity. User and key registration (see Section 8.1.6 ) may be performed separately, or in concert. If performed separately, the user registration process will generally establish a secret value (e.g., a password, PIN, or HMAC key); the secret value may be used to authenticate the user's identity during the key registration step. If performed in concert, the user establishes an identity and performs key registration in the same process, so the secret value is not required.