BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

7.1 Pre-activation State

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
removed 7 Key States and Transitions part of 7

Title changed

Before · SP 800-57 Part 1 Rev. 4

Pre-activation State

After · SP 800-57 Part 1 Rev. 5

Pre-activation State

Control changed

Before · SP 800-57 Part 1 Rev. 4

The key has been generated, but has not been authorized for use. In this state, the key may only be used to perform proof-of-possession ( Section 8.1.5.1.1.2 ) or key confirmation ( Section 4.2.5.5 ). Other than for proof-of-possession or key-confirmation purposes, a key shall not be used to apply cryptographic protection to information (e.g., encrypt or sign information to be transmitted or stored) or to process cryptographically protected information (e.g., decrypt ciphertext or verify a digital signature) while in this state. Transition 1: A key enters the pre-activation state immediately upon generation. Transition 2: If a key is in the pre-activation state, and it has been determined that the key will not be needed in the future, the key shall transition directly from the pre- activation state to the destroyed state. In the case of asymmetric keys, both keys of the key pair shall transition to the destroyed state. The date and time of the transition shall be recorded. Transition 3: When a key is in the pre-activation state, and the integrity of the key or the confidentiality of a key requiring confidentiality protection becomes suspect, then the key shall transition from the pre-activation state to the compromised state. In the case of asymmetric keys, both keys of the key pair shall transition to the compromised state. The date and time of the transition shall be recorded. If the key is known by multiple entities, a revocation notice shall be generated. Transition 4: Keys shall transition from the pre-activation state to the active state when the key becomes available for use. This transition may occur upon reaching an activation date or may occur because of an external event. In the case where keys are generated for immediate use, this transition occurs immediately after entering the pre-activation state. For asymmetric keys associated with a certificate, both keys of the key pair become active upon the notBefore date in the first certificate issued for the public key of the key pair. The date and time of the transition should be recorded. This transition marks the beginning of the cryptoperiod of a symmetric key or both keys of an asymmetric key pair (see Section 5.3 ).

After · SP 800-57 Part 1 Rev. 5

The key has been generated, but has not been authorized for use. In this state, the key may only be used to perform proof-of-possession ( Section 8.1.5.1.1.2 ) or key confirmation ( Section 4.2.5.5 ). Other than for proof-of-possession or key-confirmation purposes, a key shall not be used to apply cryptographic protection to information (e.g., encrypt or sign information to be transmitted or stored) or to process cryptographically protected information (e.g., decrypt ciphertext or verify a digital signature) while in this state. Transition 1: A key enters the pre-activation state immediately upon generation. Transition 2: If a key is in the pre-activation state, and it has been determined that the key will not be needed in the future, the key shall transition directly from the pre- activation state to the destroyed state. In the case of asymmetric keys, both keys of the key pair shall transition to the destroyed state. The date and time of the transition shall be recorded. Transition 3: When a key is in the pre-activation state, and the integrity of the key or the confidentiality of a key requiring confidentiality protection becomes suspect, then the key shall transition from the pre-activation state to the compromised state. In the case of asymmetric keys, both keys of the key pair shall transition to the compromised state. The date and time of the transition shall be recorded. If the key is known by multiple entities, a revocation notice shall be generated. Transition 4: Keys shall transition from the pre-activation state to the active state when the key becomes available for use. This transition may occur upon reaching an activation date or may occur because of an external event. In the case where keys are generated for immediate use, this transition occurs immediately after entering the pre-activation state. For asymmetric keys associated with a certificate, both keys of the key pair become active upon the notBefore date in the first certificate issued for the public key of the key pair. The date and time of the transition should be recorded. This transition marks the beginning of the cryptoperiod of a symmetric key or both keys of an asymmetric key pair (see Section 5.3 ).