BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

1 The unauthorized disclosure of a key means that another entity (an unauthorized entity) (was: Verify a digital signature that is signed by the corresponding)

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
modified 1 The unauthorized disclosure of a key means that another entity (an unauthorized entity)

Title changed

Before · SP 800-57 Part 1 Rev. 4

Verify a digital signature that is signed by the corresponding

After · SP 800-57 Part 1 Rev. 5

VerifyThe unauthorized disclosure of a digitalkey signaturemeans that isanother signedentity by(an theunauthorized correspondingentity)

Control changed

Before · SP 800-57 Part 1 Rev. 4

private key,

After · SP 800-57 Part 1 Rev. 5

may know the key and be able to use that key to perform computations requiring the use of the key. In general, the unauthorized disclosure of a key that is used to provide confidentiality protection 65 (i.e., via encryption) means that all information encrypted by that key could be determined by unauthorized entities. For example, if a symmetric data-encryption key is compromised, an unauthorized entity might use the key to decrypt past or future encrypted information (i.e., the information is no longer confidential between the authorized entities). In addition, a compromised key could be used by an adversary to encrypt information of the adversary’s choosing, thus providing false information. The unauthorized disclosure of a private signature key means that the integrity and non- repudiation qualities of all data signed by that key are suspect. An unauthorized party in

65 As opposed to the confidentiality of a key that could, for example, be used as a signing private key. possession of the private key could sign false information and make it appear to be valid. In cases where it can be shown that the signed data was protected by other mechanisms (e.g., physical security) from a time before the compromise, the signature may still have some value. For example, if a signed message was received on day 1 and it was later determined that the private signing key was compromised on day 15, the receiver may still have confidence that the message is valid because it was maintained in the receiver’s possession before day 15. Note that cryptographic timestamping may also provide protection for messages signed before the private signature key was compromised. However, the security provided by these other mechanisms is now critical to the security of the signature. In addition, the authenticity of the signed message may be questioned since the private signature key may have been disclosed to the message receiver or some other entity who then altered the message in some way. The disclosure of a CA’s private signature key means that an adversary can create fraudulent certificates and Certificate Revocation Lists (CRLs).