NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 4 → SP 800-57 Part 1 Rev. 5
Published 2020-05-04
Snapshot taken 2026-10-19 23:50 · sp-800-57-pt1 source
Snapshot taken 2026-10-19 23:50 · sp-800-57-pt1 source
+ 13 added: 9.1, 9.2, 9.2.1, 9.2.2, 9.3, 9.4, 9.5, 9.5.1, 9.5.2, 9.5.3…
− 53 removed: 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 4.1, 4.2, 4.2.1…
~ 45 revised: 1, 2, 3, 4, 5, 6, 7, 8, 8.1.1, 8.1.2…
Why this release
No stated reason was captured with this release. Check the publisher's release notes.
All · 1111 The unauthorized disclosure of a key means that another entity (an unauthorized entity) · 12 A compromise of the integrity of a key means that the key is incorrect − either that the key · 13 A compromise of a key’s usage or application association means that the key could be used · 13 Security Services · 74 A compromise of a key’s association with the owner or other entity means that the identity · 14 Cryptographic Algorithms · 195 A compromise of a key’s association with other information means that there is no · 16 Establishing an accountability system that keeps track of each access to secret symmetric · 16 Training: If the new system requires that new or different tasks (e.g., key · 217 Key States and Transitions · 67 Providing a cryptographic integrity check on the key (e.g., using a MAC or a digital · 18 Transition: A transition plan should be developed and followed so that the changeover · 379 Additional Considerations · 14
Controls added, removed or revised 111
| Control | Title | Change |
|---|---|---|
| 1 | The unauthorized disclosure of a key means that another entity (an unauthorized entity) | Control text, Title |
| 2 | A compromise of the integrity of a key means that the key is incorrect − either that the key | Control text, Title |
| 3 | A compromise of a key’s usage or application association means that the key could be used | Control text, Title |
| 3.1 | Confidentiality | removed |
| 3.2 | Data Integrity | removed |
| 3.3 | Authentication | removed |
| 3.4 | Authorization | removed |
| 3.5 | Non-repudiation | removed |
| 3.6 | Support Services | removed |
| 3.7 | Combining Services | removed |
| 4 | A compromise of a key’s association with the owner or other entity means that the identity | Control text, Title |
| 4.1 | Classes of Cryptographic Algorithms | removed |
| 4.2 | Cryptographic Algorithm Functionality | removed |
| 4.2.1 | Hash Functions | removed |
| 4.2.2 | Symmetric-Key Algorithms used for Encryption and Decryption | removed |
| 4.2.2.1 | Advanced Encryption Standard (AES) | removed |
| 4.2.2.2 | Triple DEA (TDEA) | removed |
| 4.2.2.3 | Modes of Operation | removed |
| 4.2.3 | Message Authentication Codes (MACs) | removed |
| 4.2.3.1 | MACs Using Block Cipher Algorithms | removed |
| 4.2.3.2 | MACs Using Hash Functions | removed |
| 4.2.4 | Digital Signature Algorithms | removed |
| 4.2.5 | Key Establishment Schemes | removed |
| 4.2.5.1 | Discrete-Log Key-Agreement Schemes | removed |
| 4.2.5.2 | Key Establishment Using Integer-Factorization Schemes | removed |
| 4.2.5.3 | Security Properties of the Key-Establishment Schemes | removed |
| 4.2.5.4 | Key Encryption and Key Wrapping | removed |
| 4.2.5.5 | Key Confirmation | removed |
| 4.2.6 | Key Establishment Protocols | removed |
| 4.2.7 | Random Bit Generation | removed |
| 5 | A compromise of a key’s association with other information means that there is no | Control text, Title |
| 6 | Establishing an accountability system that keeps track of each access to secret symmetric | Control text, Title |
| 6.1 | Protection and Assurance Requirements | removed |
| 6.1.1 | Summary of Protection and Assurance Requirements for Cryptographic Keys | removed |
| 6.1.2 | Summary of Protection Requirements for Other Cryptographic or Related | removed |
| 6.2 | Protection Mechanisms | removed |
| 6.2.1 | Protection Mechanisms for Cryptographic Information in Transit | removed |
| 6.2.1.1 | Availability | removed |
| 6.2.1.2 | Integrity | removed |
| 6.2.1.3 | Confidentiality | removed |
| 6.2.1.4 | Association with Usage or Application | removed |
| 6.2.1.5 | Association with Other Entities | removed |
| 6.2.1.6 | Association with Other Related Information | removed |
| 6.2.2 | Protection Mechanisms for Information in Storage | removed |
| 6.2.2.1 | Availability | removed |
| 6.2.2.2 | Integrity | removed |
| 6.2.2.3 | Confidentiality | removed |
| 6.2.2.4 | Association with Usage or Application | removed |
| 6.2.2.5 | Association with the Other Entities | removed |
| 6.2.2.6 | Association with Other Related Information | removed |
| 6.2.3 | Metadata Associated with Cryptographic Information | removed |
| 6.2.3.1 | Metadata for Keys | removed |
| 6.2.3.2 | Metadata for Related Cryptographic Information | removed |
| 7 | Providing a cryptographic integrity check on the key (e.g., using a MAC or a digital | Control text, Title |
| 7.1 | Pre-activation State | removed |
| 7.2 | Active State | removed |
| 7.3 | Suspended State | removed |
| 7.4 | Deactivated State | removed |
| 7.5 | Compromised State | removed |
| 7.6 | Destroyed State | removed |
| 8 | Transition: A transition plan should be developed and followed so that the changeover | Control text, Title |
| 8.1.1 | Entity Registration Function | Control text, Title |
| 8.1.2 | System Initialization Function | Control text |
| 8.1.3 | Initialization Function | Control text, Title |
| 8.1.4 | Keying-Material Installation Function | Control text |
| 8.1.5 | Key Establishment Function | Control text |
| 8.1.5.1 | Generation and Distribution of Asymmetric Key Pairs | Control text |
| 8.1.5.1.1 | Distribution of Public Keys | Control text, Title |
| 8.1.5.1.2 | Distribution of Ephemeral Public Keys | Control text |
| 8.1.5.1.3 | Distribution of Centrally Generated Key Pairs | Control text |
| 8.1.5.2 | Generation and Distribution of Symmetric Keys | Control text |
| 8.1.5.2.1 | Key Generation | Control text |
| 8.1.5.2.2 | Key Distribution | Control text |
| 8.1.5.2.3 | Key Agreement | Control text |
| 8.1.5.3.1 | Domain Parameters | Control text |
| 8.1.5.3.2 | Initialization Vectors | Control text |
| 8.1.5.3.3 | Shared Secrets | Control text |
| 8.1.5.3.4 | RBG Seeds | Control text |
| 8.1.5.3.5 | Other Public and Secret Information | Control text |
| 8.1.5.3.7 | Random Bits/Numbers | Control text |
| 8.1.5.3.8 | Passwords | Control text |
| 8.1.6 | Key Registration Function | Control text |
| 8.2 | Operational Phase | Control text |
| 8.2.1 | Normal Operational Storage Function | Control text |
| 8.2.1.1 | Cryptographic Module Storage | Control text |
| 8.2.2 | Continuity of Operations Function | Control text |
| 8.2.2.1 | Backup Storage | Control text |
| 8.2.3 | Key Change Function | Control text |
| 8.2.3.1 | Re-keying | Control text |
| 8.2.3.2 | Key Update Function | Control text |
| 8.2.4 | Key Derivation Methods | Control text |
| 8.3.1 | Key Archive and Key Recovery Functions | Control text, Title |
| 8.3.2 | Entity De-registration Function | Control text |
| 8.3.3 | Key De-registration Function | Control text |
| 8.3.4 | Key Destruction Function | Control text |
| 8.3.5 | Key Revocation Function | Control text |
| 8.4 | Destroyed Phase | Control text |
| 9 | Additional Considerations | Control text, Title |
| 9.1 | Access Control and Identity Authentication | added |
| 9.2 | Inventory Management | added |
| 9.2.1 | Key Inventories | added |
| 9.2.2 | Certificate Inventories | added |
| 9.3 | Accountability | added |
| 9.4 | Audit | added |
| 9.5 | Key-Management System Survivability | added |
| 9.5.1 | Backed Up and Archived Key | added |
| 9.5.2 | Key Recovery | added |
| 9.5.3 | System Redundancy/Contingency Planning | added |
| 9.5.3.1 | General Principles | added |
| 9.5.3.2 | Cryptography and Key-Management-Specific Recovery Issues | added |
| 9.5.4 | Compromise Recovery | added |
Read every requirement in this version · All versions of NIST platform security: roots of trust, firmware and secure enclaves