BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.1.5.2.1 Key Generation

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
modified 8 Transition: A transition plan should be developed and followed so that the changeover part of 8.1.5.2

Title

Key Generation

Control changed

Before · SP 800-57 Part 1 Rev. 4

Symmetric keys determined by key generation methods shall be either generated by an approved method (e.g., using an approved random number generator), or derived from a master key (see Section 8.2.4 ) using an approved key-derivation function (see [SP800-108] ). Also, see [SP800-133] . When split-knowledge procedures are used, the key shall exist outside of a [FIPS140] cryptographic module as multiple key components. The keying material may be created within a cryptographic module and then split into components for export from the module, or may be created as separate components. Each key component shall provide no knowledge of the key value (e.g., each key component must appear to be generated randomly). If knowledge of k components is required to construct the original key, then knowledge of any k -1 key components shall provide no information about the original key other than, possibly, its length. Note: A suitable combination function is not provided by simple concatenation; e.g., it is not acceptable to form a 128-bit key by concatenating two 64-bit key components. All keys and key components shall be generated within a FIPS 140-validated cryptographic module or obtained from another source approved by the U.S. Government for the protection of national security information.

After · SP 800-57 Part 1 Rev. 5

Symmetric keys determined by key generation methods shall be either generated by an approved method (e.g., using an approved random number generator; see SP 800-133 ), or derived from a master key/key-derivation key (see Section 8.2.4 ) using an approved key-derivation function (see [SP800-108]SP 800-108 ). AlsoSymmetric keys may also be generated using key-agreement techniques (see Section 8.1.5.2.3 ); in this case, a separate key-distribution process is not required (e.g., see [SP800-133]SP 800-56A and SP 800-56B ). When split-knowledge procedures are used, the key shall only exist outside of a [FIPS140]FIPS 140 cryptographic module as multiple key componentsshares. The keying materialkey may be created within a cryptographic module and then split into componentsshares for export from the module, or may be created as separate componentsshares. Each key componentshare shall provide no knowledge of the key value (e.g., each key componentshare must appear to be generated randomly). If knowledge of k componentsshares is required to construct the original key, then knowledge of any k -1− 1 key componentsshares shall provide no information about the original key other than, possibly, its length. Note: A suitable combination function is not provided by simple concatenation; (e.g., it is not acceptable to form a 128-bit key by concatenating two 64-bit key componentsshares). All keys and key componentsshares shall be generated within a FIPS 140-validated140 -validated cryptographic module or obtained from another source approved by the U.S. Government for the protection of national security information.