7 Providing a cryptographic integrity check on the key (e.g., using a MAC or a digital (was: Key States and Transitions)
All changes in this version
Title changed
Before · SP 800-57 Part 1 Rev. 4
Key States and Transitions
After · SP 800-57 Part 1 Rev. 5
KeyProviding Statesa andcryptographic Transitionsintegrity check on the key (e.g., using a MAC or a digital
Control changed
Before · SP 800-57 Part 1 Rev. 4
A key may pass through several states between its generation and its destruction. Figure 3 depicts an example of the key states that a key could assume and the transitions among them.
Figure 3: Key state and transition example.
A key is used differently, depending upon its state in the key’s lifecycle. Key states are defined from a system point-of-view, as opposed to the point-of-view of a single cryptographic module. The following sections discuss the states that an operational or backed-up key may assume, along with transitions to other states, as shown in Figure 3 . Additional states may be applicable for some systems (e.g., a destroyed compromised state, which was depicted in the example provided in a previous version of this Recommendation), and some of the identified states may not be needed for other systems (e.g., if keys are to be activated immediately after generation, the pre-activation state may not be needed, or a decision could be made that the suspended state will not be used). Transitioning between states often requires recording the event. Suitable places for such recordings are audit logs and the key's metadata (see Section 6.2.3.1 ). [SP800-152] also discusses the logging of these events. The following sections discuss the example provided in Figure 3.
After · SP 800-57 Part 1 Rev. 5
Asignature); key8. mayUsing passtrusted throughtimestamps severalfor statessigned betweendata; its9. generationDestroying andkeys itsas destructionsoon as they are no longer needed; and 10. FigureCreating 3a depictscompromise-recovery anplan, exampleespecially in the case of the compromise of a CA key. statesThe worst form of key compromise is one that is not detected. Nevertheless, even in this case, certain protective measures can be taken. A key management system should be designed to mitigate the negative effects of a key couldcompromise; assumethe andsystem should be designed so that the transitionscompromise amongof them.a
Figure3:single Keykey statecompromises andas transitionlittle exampledata as possible (see SP 800-152 ).
Aiscould be used differentlyto protect the data of only a single human entity or a limited number of such entities. Often, dependingsystems uponhave itsalternative statemethods into authenticate communicating entities that do not rely solely on the key’spossession lifecycleof keys. KeyThe statesintent areis definedto fromavoid building a system point-of-view,with ascatastrophic opposedweaknesses. toA compromise-recovery plan is essential for restoring cryptographic security services in the point-of-viewevent of a singlekey cryptographiccompromise. moduleA compromise-recovery plan shall be documented and easily accessible. The followingplan sectionsmay discussbe included in a Key-Management Practices Statement (see SP 800-57, Part 2 ). If not, the statesKey-Management Practices Statement should reference the compromise-recovery plan. Although compromise recovery is primarily a local action, the entire community that anuses operationalthe system or backed-upequipment keyis mayaffected assumeby the repercussions. Therefore, alongcompromise-recovery withprocedures transitionsshould toinclude otherthe statescommunity at large. For example, asrecovery shownfrom inthe Figurecompromise 3of a root CA’s private signature key requires that all entities using the infrastructure obtain and install a new trust anchor certificate. AdditionalTypically, statesthis involves physical procedures that are expensive to implement. To avoid these expensive procedures, elaborate precautions to avoid compromise may be applicablejustified. forThe somecompromise-recovery systemsplan should contain: a. An identification of the personnel to notify and what the notification should contain (e.g., athe destroyedscope of the compromise − whether specific keys were compromised state,or whichthe certificate- generation process was depictedcompromised); inb. An identification of the examplepersonnel providedto inperform the recovery actions; c. The method for obtaining a previousnew versionkey (i.e., re-keying); d. An inventory of thisall Recommendation)cryptographic keys (e.g., the location of all keys and somecertificates in a system); e. The education of all appropriate personnel on the identifiedcompromise-recovery statesprocedures; mayf. notAn beidentification of all personnel needed to support the compromise-recovery procedures; g. Policies requiring that key-revocation checking be performed (to minimize the effect of a compromise); h. The monitoring of the re-keying operations (to ensure that all required operations are performed for all affected keys); and i. Any other systemscompromise-recovery (eprocedures.g Other compromise-recovery procedures may include: j. A physical inspection of the equipment; k. An identification of all information that may be compromised as a result of the incident; l. An identification of all signatures that may be invalid due to the compromise of a signing key; and m. The distribution of new keying material, if required. 5.6 Guidance for Cryptographic Algorithm and Key-Size Selection Cryptographic algorithms that provide the security services identified in Section 3 are specified or adopted in FIPS and NIST Recommendations. Some of these algorithms are defined for several key sizes. This section provides guidance for the selection of appropriate algorithms and key sizes to provide adequate protection for 1) the expected lifetime of a system and 2) any sensitive data protected by that system during the expected lifetime of the data. 5.6.1 Comparable Algorithm Strengths Cryptographic algorithms can provide different “strengths” of security, depending on the algorithm and the key size used (when keys are required by the algorithm). A security strength is a number associated with the amount of work (i.e., the number of operations) that is required to bebreak activateda immediatelycryptographic afteralgorithm generationor system . Sections 5.6.1.1 and 5.6.1.2 provide the estimated maximum security strengths of the approved cryptographic algorithms for commonly used security strengths: 80, 112, 128, 192, and 256 bits. Note that a security strength of 80 bits is no longer considered adequate. The comparable security strengths provided below are based on accepted estimates as of the pre-activationpublication stateof this Recommendation using currently known methods. Advances in factoring algorithms, general discrete-logarithm attacks, elliptic-curve discrete-logarithm attacks, and other algorithmic advances as well as quantum computing may notaffect these equivalencies in the future. New or improved attacks or technologies may be neededdeveloped that leave some of the current algorithms completely insecure. Important note: When large-scale quantum computers become available, they will threaten the security of the approved public-key algorithms. In particular, the digital signature schemes, key-agreement schemes using Diffie-Hellman and MQV, 67 and the key-agreement and key-transport schemes using RSA may need to be replaced with secure quantum-resistant (or “post-quantum”) counterparts. At the time that this revision of the Recommendation was published, NIST was undergoing a decisionprocess couldto select post-quantum cryptographic algorithms for standardization. This process is a multi-year project; when these new standards are available, this Recommendation will be madeupdated with the appropriate guidance. Information on the post-quantum project is available at https://csrc.nist.gov/projects/post-quantum- cryptography . The use of strong cryptographic algorithms is critical for cryptographic security. However, their implementation and use are also of vital concern since algorithms may unintentionally be implemented in a manner that leaks small amounts of information about the suspendedkey. stateIn this case, a larger key may reduce the likelihood that this leaked information will noteventually becompromise usedthat key. 5.6.1.1 Security Strengths of Symmetric Block Cipher and Asymmetric-Key Algorithms The approved symmetric-key block ciphers (e.g., AES) and public-key (i.e., Transitioningasymmetric-key) betweenalgorithms statesrequire oftenthe requiresuse recordingof cryptographic keys. Security-strength estimates were made under the eventassumption that the keys are a specified length and are generated and handled in accordance with specific rules (e.g., Suitablethe placeskeys forare suchgenerated recordingsusing RBGs that were seeded with sufficient entropy and meet certain criteria). However, these rules are auditoften logsnot followed, and the key'ssecurity metadataprovided to the data protected by those keys may be somewhat less than the security-strength estimates provided (see Section 5.6.2 ).3 Two algorithms are considered to be of comparable strength for the given key sizes ( X and Y ) if the amount of work needed to “break the algorithms” or determine the keys (with the given key sizes and sufficient entropy) is approximately the same using a given resource.1 The security strength of an algorithm for a given key size is traditionally described in terms of the amount of work it takes to try all keys for a symmetric-key algorithm with a key size of “ X ” that has no shortcut attacks (i.e., the most efficient attack is to try all possible keys). [SP800-152]In alsothis discussescase, the loggingbest attack is said to be an exhaustion attack. An algorithm that has a Y -bit key and an estimated maximum security strength that is comparable to a symmetric-key algorithm with an X -bit key is said to have an “estimated maximum security strength of theseX eventsbits” or to be able to provide “ X bits of security.” Given a few plaintext blocks and the corresponding ciphertext, an algorithm that can provide X bits of security would, on average, take 2 X -1 T units of time to attack, where T is the amount of time that is required to perform one encryption of a plaintext value and compare the result against the corresponding ciphertext value. Determining the security strength of an algorithm can be nontrivial. The followingstrength sectionsdepends discusson many factors, including the exampleattacker’s capabilities, the key lengths, the amount of data processed using the same key, and how closely keys are related. The attacker's capabilities could include the cryptanalysis techniques used to reduce the time to attack an algorithm, the processing power available to the attacker, and the advent of new types of computing systems (e.g., quantum computers).
67 Both finite field and elliptic curve versions. Table 2 provides estimated, comparable, maximum-security strengths for the approved symmetric block cipher and asymmetric-key algorithms and key lengths. 1. Column 1 indicates the estimated maximum-security strength (in bits) provided by the algorithms and key lengths listed in Figurea 3particular row. Note that the security strength is not necessarily the same as the length of the key due to attacks on those algorithms that provide computational advantages.