BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.1.5.1.3 Distribution of Centrally Generated Key Pairs

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
modified 8 Transition: A transition plan should be developed and followed so that the changeover part of 8.1.5.1

Title

Distribution of Centrally Generated Key Pairs

Control changed

Before · SP 800-57 Part 1 Rev. 4

When a static key pair is centrally generated, the key pair shall be generated within a FIPS 140-validated cryptographic module or obtained from another source approved by the U.S. government for protecting national security information for subsequent delivery to the intended owner of the key pair. A signing key pair generated by a central key-generation facility for its subscribers will not provide strong support for non-repudiation for those individual subscribers; therefore, when support for non-repudiation is required by those subscribers, the subscribers should generate their own signing key pairs. However, if the central key- generation facility generates signing key pairs for its own organization and distributes them to members of the organization, then support for non-repudiation may be provided at an organizational level (but not an individual level). The private key of a key pair generated at a central facility shall only be distributed to the intended owner of the key pair. The confidentiality of the centrally generated private key shall be protected, and the procedures for distribution shall include an authentication of the recipient's identity as established during user registration (see Section 8.1.1 ). The key pair may be distributed to the intended owner using an appropriate manual method (e.g., courier, mail or other method specified by the key-generation facility) or secure automated method (e.g., a secure communication protocol). The private key shall be distributed in the same manner as a symmetric key (see Section 8.1.5.2.2 ). During the distribution process, each key of the key pair shall be provided with the appropriate protections for that key (see Section 6.1 ). When split-knowledge procedures are used for the manual distribution of the private key, the key shall be split into multiple key components that have the same security properties as the original key (e.g., randomness); each key component shall provide no knowledge of the value of the original key (e.g., each key component shall appear to be generated randomly). Upon receipt of the key pair, the owner shall obtain assurance of the validity of the public key (see [SP800-56A] , [SP800-56B] and [SP800-89 ]). The owner shall obtain assurance that the public and private keys of the key pair are correctly associated (i.e., check that they are a consistent pair, for example, by checking that a key encrypted under a public key-transport key can be decrypted by the corresponding private key-transport key).

After · SP 800-57 Part 1 Rev. 5

When a static key pair is centrally generated, the key pair shall be generated within a FIPS 140-validated140 - validated cryptographic module or obtained from another source approved by the U.S. governmentGovernment for protecting national security information for subsequent delivery to the intended owner of the key pair. A signing key pair generated by a central key-generation facility for its subscribers will not provide strong support for non-repudiation for those individual subscribers; therefore, when support for non-repudiation is required by those subscribers, the subscribers should generate their own signing key pairs. However, if the central key- generationkey-generation facility generates signing key pairs for its own organization and distributes them to members of the organization, then support for non-repudiationnon- repudiation may be provided at an organizational level (but not an individual level). The private key of a key pair generated at a central facility shall only be distributed to the intended owner of the key pair or to the owner’s representative for subsequent installation. The confidentiality of the centrally generated private key shall be protected, and the procedures for distribution shall include an authentication of the recipient'srecipient’s identity and authorization as established during userentity registration (see Section 8.1.1 ). The key pair may be distributed to the intended owner or owner’s representative using an appropriate manual method (e.g., courier, mail, or other method specified by the key-generation facility) or secure automated method (e.g., a secure communication protocol). The private key shall be distributed in the same manner as a symmetric key (see Section 8.1.5.2.2 ). During theThe distribution process,of eachthe public key of thea key pair shall be provided with the appropriate protections for thatis keydiscussed (seein Section 68.1 ). When split-knowledge procedures are5.1.1.3 used. forDuring the manual distribution of the private keyprocess, the key shall be split into multipleeach key components that have the same security properties asof the original key (e.g., randomness); each key componentpair shall provide nobe knowledgeprovided ofwith the valueappropriate ofprotections thefor originalthat key (e.g., each key component shall appear tosee beSection generated6.1 randomly). Upon receipt of the key pair, the owner shall obtain assurance of the validity of the public key (see [SP800-56A]SP 800-56A , [SP800-56B]SP 800-56B , and [SP800-89SP ]800-89 ). The owner shall obtain assurance that the public and private keys of the key pair are correctly associated (i.e., check that they are a consistent pair, for example, by checking that a key encrypted under a public key-transport key can be decrypted by the corresponding private key-transport key).