BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.1.5 Key Establishment Function

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
modified 8 Transition: A transition plan should be developed and followed so that the changeover part of 8.1

Title

Key Establishment Function

Control changed

Before · SP 800-57 Part 1 Rev. 4

Key establishment involves the generation and distribution, or the agreement of keying material for communication between entities. All keys shall be generated within a FIPS 140- validated cryptographic module or obtained from another source approved by the U.S. Government for the protection of national security information. During the key-establishment process, some of the keying material may be in transit (i.e., the keying material is being manually distributed or is being distributed using automated protocols). Other keying material may be retained locally. In either case, the keying material shall be protected in accordance with Section 6 . An entity may be an individual (person), organization, device or process. When keying material is generated by an entity for its own use, one or more of the appropriate protection mechanisms for stored information in Section 6.2.2 shall be used. Keying material that is distributed between entities, or among an entity and its sub-entities (e.g., various individuals, devices or processes within an organization), shall be protected during distribution using one or more of the appropriate protection mechanisms specified in Section 6.2.1 . Any keying material that is not distributed (e.g., the private key of a key pair, or one's own copy of a symmetric key) or keying material that is received and subsequently stored shall be protected using one or more of the appropriate protection mechanisms specified in Section 6.2.2 . [SP800-133] discusses the generation of keying material.

After · SP 800-57 Part 1 Rev. 5

Key establishment involves the generation and distribution, or the agreement of keying material for communication between entities. All keys shall be generated within a FIPS 140-140 validated-validated cryptographic module or obtained from another source approved by the U.S. Government for the protection of national security information. Long-term keys shall be inventoried (see Section 9.2 ). During the key-establishment process, some of the keying material may be in transit (i.e., the keying material is being manually distributed or is being distributed using automated protocols). Other keying material may be retained locally rather than distributed. In either case, the keying material shall be protected in accordance with Section 6 . An entity may be an individual (personhuman), organization, device, or process. When keying material is generated by an entity for its own use, one or more of the appropriate protection mechanisms for stored information in Section 6.2.2 shall be used. The “owner” of a key is an entity that is authorized to use the key. When the owner is not a human (i.e., the owner is an organization, device, or process), the owner is often assisted by an authorized human representative or sponsor to obtain and manage keying material (e.g., to obtain and install keys and certificates). Keying material that is distributed between entities, or among an entity and its sub-entities (e.g., various individuals, devices, or processes within an organization), shall be protected during distribution using one or more of the appropriate protection mechanisms specified in Section 6.2.1 . Any keying material that is not distributed (e.g., the private key of a key pair, or one'sone’s own copy of a symmetric key) or keying material that is received and subsequently stored shall be protected using one or more of the appropriate protection mechanisms specified in Section 6.2.2 . [SP800-133]Sections 8.1.5.1 and 8.1.5.2 discuss the generation and distribution of asymmetric and symmetric keys, respectively. SP 800-133 discusses the generation of keying material.