BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.1.5.1 Generation and Distribution of Asymmetric Key Pairs

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
modified 8 Transition: A transition plan should be developed and followed so that the changeover part of 8.1.5

Title

Generation and Distribution of Asymmetric Key Pairs

Control changed

Before · SP 800-57 Part 1 Rev. 4

Key pairs shall be generated in accordance with the mathematical specifications of the appropriate approved FIPS or NIST Recommendation. A static key pair shall be generated by the entity that “owns” the key pair (i.e., the entity that uses the private key in the cryptographic computations), by a facility that distributes the key pair in accordance with Section 8.1.5.1.3 , or by the user and facility in a cooperative process. When generated by the entity that owns the key pair, a signing private key shall not be distributed to other entities. In the case of a public signature-verification key and its associated private key, the owner should generate the keying material, rather than any other entity generating the keying material for that owner; this will facilitate the support for non- repudiation. However, when the owner is an organization, it is acceptable to distribute the keying material to the organization's sub-entities (e.g., employees or devices); in this case, the organization is the true owner, and the sub-entities represent the owner. Ephemeral keys are often used for key establishment (see [SP800-56A] ). They are generated for each new key-establishment transaction (e.g., unique to each message or session) by the owner. The generated key pairs shall be protected in accordance with Section 6.1.1 .

After · SP 800-57 Part 1 Rev. 5

Key pairs shall be generated in accordance with the mathematical specifications of the appropriate approved FIPS or NIST Recommendation. A static key pair shall be generated by either: 1) the entity that “owns” the key pair (i.e., the entity that uses the private key in the cryptographic computations), by2) a facility that distributes the key pair in accordance with Section 8.1.5.1.3 , or by3) the userowner and facility in a cooperative process. When generated by the entity that ownsIn the keycase pair,of a signingdigital privatesignature key shall not be distributed to other entities. In the case ofpair (a public signature-verification key and its associated private key), the owner of the static key pair should generate the keying material, rather than any other entity generating the keying material for that owner; this will facilitate the support for non- repudiation. When generated by the entity that owns the key pair, a private signature key shall not be distributed to other entities. However, when the owner is an organization, it is acceptable to distribute the keying material to the organization'sorganization’s sub-entities (e.g., employees or devices); in this case, the organization is the true owner, and the sub-entities represent the owner. Ephemeral keys are often used for key establishmentagreement instead of or in addition to the use of static keys (see [SP800-56A]SP 800-56A ). TheyEphemeral key pairs are generated for each new key-establishment transaction (e.g., unique to each message or session) by the owner. The generated key pairs shall be protected in accordance with Section 6.1.1 .