8 Transition: A transition plan should be developed and followed so that the changeover (was: Key-Management Phases and Functions)
All changes in this version
Title changed
Before · SP 800-57 Part 1 Rev. 4
Key-Management Phases and Functions
After · SP 800-57 Part 1 Rev. 5
Key-ManagementTransition: PhasesA transition plan should be developed and Functionsfollowed so that the changeover
Control changed
Before · SP 800-57 Part 1 Rev. 4
The cryptographic key-management lifecycle can be divided into four phases. During each phase, the keys are in certain specific key states as discussed in Section 7 . In addition, within each phase, certain key-management functions are typically performed. These functions are necessary for the management of the keys and their associated metadata. Key-management information is called metadata. The metadata required for key management might include the identity of a person or system associated with that key or the types of information that person is authorized to access. Metadata is used by applications to select the appropriate cryptographic key(s) for a particular service. While the metadata does not appear in cryptographic algorithms, it is crucial to the implementation of applications and application protocols. The four phases of key management are:
After · SP 800-57 Part 1 Rev. 5
from the old to the new system runs as smoothly as possible. 9. Post-implementation evaluation: The cryptographicsystem key-managementshould lifecyclebe canevaluated to verify that the implemented system meets the system’s security requirements. 5.6.5 Decrease of Security Strength Over Time At some time, the security strength provided by an algorithm or key may be dividedreduced intoor fourlost phasescompletely. DuringFor eachexample, phasethe algorithm or key length used may no longer offer adequate security because of improvements in computational capability or cryptanalysis. In this case, applying protection to “new” information can be performed using stronger algorithms or keys. However, information that was previously protected using these now-inadequate algorithms and keys may no longer be secure. This information may include other keys or sensitive information protected by the keys. areA reduction in certainthe specificsecurity strength provided by an algorithm or key stateshas asthe discussedfollowing implications:
• Encrypted information: The security of encrypted information that was available at any time to unauthorized entities in Sectionits 7encrypted form should be considered suspect. InFor additionexample, withinkeys eachthat phasewere transmitted in encrypted form (e.g., certainusing key-managementa functionskey-wrapping arekey typicallyor performed.key-transport Thesekey functionsand arean necessaryalgorithm foror key length that is later broken) may need to be considered compromised since an adversary could have saved the managementencrypted form of the keys andfor theirlater associateddecryption metadatain case methods for breaking the algorithm are eventually found (see Section 5.5 Key-managementfor informationa isdiscussion calledof metadatakey compromise). TheEven metadataif requiredthe transmitted, encrypted information is subsequently re-encrypted for storage using a different key managementor mightalgorithm, includethe information may already be compromised because of the identityweakness of athe persontransmission algorithm or systemkey. associatedEncrypted withinformation that keywas not “exposed” in this manner (e.g., not transmitted) may still be secure even though the encryption algorithm or key length no longer provides the typesinitially required amount of protection. For example, if the encrypted form of the keys and the information thatprotected personby isthose authorizedkeys towas accessnever transmitted, then the information may still be confidential. MetadataThe islessons to be learned are that an encryption mechanism used byfor applicationsinformation that will be available to selectunauthorized entities in its encrypted form (e.g., via transmission) should provide a high level of security protection, and the appropriateuse cryptographicof each key should be limited (si.e., the cryptoperiod should be short) so that a compromised key cannot be used to reveal very much information. If the algorithm itself is broken, 75 an adversary is forced to perform more work to decrypt all of the information when each key is used to encrypt a very limited amount of information. See Section 5.3.6 for a particulardiscussion serviceabout cryptoperiods.
• WhileDigital signatures on stored data that was originally transmitted: 76 Digital signatures may be computed on data prior to transmission and subsequent storage. In this case, both the metadatasigned doesdata notand appearthe digital signature would be stored. If the security strength of the signature is later reduced (e.g., because of a break of the algorithm or because an adversary determined the key), the signature may still be valid if the stored data and its associated digital signature have been adequately protected from modification since a time prior to the decrease in strength (e.g., by applying a digital signature using a stronger algorithm or key). See Section 5.5 , item 1 for further discussion. Storage capabilities are being developed that employ cryptographic algorithmstimestamps to store digitally signed data beyond the normal security life of the original signature mechanism or its keys.
75 For example, it is crucialeasier to recover a key than to conduct an exhaustive search. 76 Digital signatures on data that is transmitted but not stored are not considered since their value is considered to be short-lived (e.g., the implementationdigital ofsignature applicationswas intended to be used to detect errors introduced only during transmission).
• Symmetric authentication codes on stored data that was originally transmitted: 77 Like digital signatures, symmetric authentication codes (i.e., MACs) may be computed on data prior to transmission and/or applicationsubsequent protocolsstorage. TheIf fourthe phasesreceived data and authentication code are stored as received, and the security strength of the authentication algorithm or key managementis later reduced (e.g., because of a break of the algorithm), the authentication code may still be valid if the stored data and its associated authentication code have been adequately protected from modification since a time prior to the decrease in strength (e.g., by applying another authentication code using a stronger algorithm or key). See Section 5.5 , item 1 for further discussion. Storage capabilities are: being developed that employ cryptographic timestamps to store authenticated data beyond the normal security life of the original authentication mechanism or its keys.
77 Symmetric authentication codes on data that is transmitted but not stored are not considered since their value is considered to be short-lived.