BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.3.1 Archive Storage and Key Recovery Functions

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 4
All changes in this version
first version loaded 8 Key-Management Phases and Functions part of 8.3

Title

Archive Storage and Key Recovery Functions

Control

A key archive is a repository containing keying material and other related information for recovery beyond the cryptoperiod of the keys. Not all keying material needs to be archived. An organization’s security plan should indicate the types of information that are to be archived (see [ SP800-57, Part 2 ]). The archive shall continue to provide the appropriate protections for each key and any other related information in the archive, as specified in Section 6.2.2 . The archive will require a strong access-control mechanism to limit access to only authorized entities. When keying material is entered into the archive, it is often time-stamped so that the date-of-entry can be determined. This date may itself be cryptographically protected so that it cannot be changed without detection. If keying material needs to be recoverable (e.g., after the end of its cryptoperiod), either the keying material shall be archived, or the system shall be designed to allow reconstruction (e.g., re-derivation) of the keying material from archived information. Retrieving the keying material from archive storage or by reconstruction is commonly known as key recovery. The archive shall be maintained by a trusted party (e.g., the organization associated with the keying material or a trusted third party). While in storage, archived information may be either static (i.e., never changing) or may need to be re-encrypted under a new archive-encryption key from time-to-time. Archived data should be stored separately from operational data, and multiple copies of archived cryptographic information should be provided in physically separate locations (i.e., it is recommended that the key archive be backed up). For critical information that is encrypted under archived keys, it may be necessary to back up the archived keys and to store multiple copies of these archived keys in separate locations. When archived, keying material should be archived prior to the end of the cryptoperiod of the key. For example, it may be prudent to archive the keying material during key activation. When no longer required, the keying material shall be destroyed in accordance with Section 8.3.4 . The confidentiality of archived information is provided by an archive-encryption key (one or more encryption keys that are used exclusively for the encryption of archived information), by another key that has been archived, or by a key that may be derived from an archived key. Note that the algorithm with which the archive-encryption key is used may also provide integrity protection for the encrypted information. When encrypted by the archive-encryption key, the encrypted keying material shall be re-encrypted by any new archive-encryption key at the end of the cryptoperiod of the old archive-encryption key. When the keying material is re- encrypted, integrity values on that keying material shall be recomputed. This may impose a significant burden; therefore, the strength of the cryptographic algorithm and archive- encryption key shall be selected to minimize the need for re-encryption. When the archive-encryption key and its associated algorithm do not also provide integrity protection for the encrypted information, integrity protection shall be provided by a separate archive-integrity key (i.e., one or more authentication or digital-signature keys that are used exclusively for the archive) or by another key that has been archived. If integrity protection is to be maintained at the end of the cryptoperiod of the archive-integrity key, new integrity values shall be computed on the archived information on which the old archive-integrity key was applied. When the confidentiality and integrity protection of the archived information is provided using separate processes, the archive-encryption key and archive-integrity key (when used) shall be different from each other (e.g., independently generated), and shall be protected in the same manner as their key type (see Section 6 ). Note that these two services can also be provided using authenticated encryption, which uses a single cryptographic algorithm operation and a single key. Tables 9 and 10 indicate the appropriateness of archiving keys and other cryptographically related information. An “OK” in column 2 (Archive?) indicates that archival is permissible, but not necessarily required. Column 3 (Retention period) indicates the minimum time that the key should be retained in the archive. Additional advice on the storage of keying material in archive storage is provided in Appendix B.3 . Table 9: Archive of keys

Type of Key Archive? Retention period (minimum)

Private signature key No

Public signature-verification key OK Until no longer required to verify data signed with the associated private key

Symmetric authentication key OK Until no longer needed to authenticate data or an identity.

Private authentication key No

Public authentication key OK

Symmetric data-encryption key OK Until no longer needed to decrypt data encrypted by this key

Symmetric key-wrapping key OK Until no longer needed to decrypt keys encrypted by this key

Symmetric random number generator key No

Symmetric master key OK, if needed to derive other keys for archived data Until no longer needed to derive other keys

Private key-transport key OK Until no longer needed to decrypt keys encrypted by this key

Public key-transport key OK

Symmetric key-agreement key OK

Private static key-agreement key OK

Public static key-agreement key OK Until no longer needed to reconstruct keying material. Type of Key Archive? Retention period (minimum)

Private ephemeral key- agreement key No

Public ephemeral key- agreement key OK

Symmetric authorization key No

Private authorization key No

Public authorization key OK

Table 10: Archive of other cryptographic related information

Type of Key Archive? Retention period (minimum)

Domain parameters OK Until all keying material, signatures and signed data using the domain parameters are removed from archives

Initialization vector OK; normally stored with the protected information Until no longer needed to process the protected data

Shared secret No

RBG seed No

Other public information OK Until no longer needed to process data using the public information

Other secret information OK Until no longer needed to process data using the secret information

Intermediate result No

Key control information (e.g., IDs, purpose) OK Until the associated key is removed from the archive

Random number Depends on the application or use of the random number

Password OK when used to derive keys or to detect the reuse of passwords; otherwise, No Until no longer needed to (re-)derive keys or to detect password reuse

Audit information OK Until no longer needed The recovery of archived keying material may be required to remove (e.g., decrypt) or check (e.g., verify a digital signature or a MAC) the cryptographic protections on other archived data; recovered keys shall not be used to apply cryptographic protection. The key recovery process results in retrieving or reconstructing the desired keying material from archive storage in order to perform the required cryptographic operation. Immediately after completing this operation, the keying material shall be erased from the cryptographic process 44 for which it was recovered (i.e., it shall not be used for normal operational activities). However, the key shall be retained in the archive (see Section 8.3.4 ) as long as needed. Further advice on key recovery issues is provided in Appendix B .