BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.1.5.2.2 Key Distribution

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
modified 8 Transition: A transition plan should be developed and followed so that the changeover part of 8.1.5.2

Title

Key Distribution

Control changed

Before · SP 800-57 Part 1 Rev. 4

Keys generated in accordance with Section 8.1.5.2.1 as key-wrapping keys (i.e., key- encrypting keys), as master keys to be used for key derivation, or for the protection of communicated information are distributed manually (manual key transport) or using an automated key-transport protocol (automated key transport). Keys used only for the storage of information (i.e., data or keying material) shall not be distributed except for backup or to other authorized entities that may require access to the stored information protected by the keys. 8.1.5.2.2.1 Manual Key Distribution Keys distributed manually (i.e., by other than an automated key-transport protocol) shall be protected throughout the distribution process. During manual distribution, secret or private keys shall either be wrapped (i.e., encrypted) or be distributed using appropriate physical security procedures. If multi-party control is desired, split-knowledge procedures may be used as well. The manual distribution process shall assure that: 1. The distribution of the keys is from an authorized source, 2. Any entity distributing plaintext keys is trusted by both the entity that generates the keys and the entity(ies) that receives the keys, 3. The keys are protected in accordance with Section 6 , and 4. The keys are received by the authorized recipient. When distributed in encrypted form, the key shall be encrypted by an approved key-wrapping scheme using a key-wrapping key that is used only for key wrapping, or by an approved key- transport scheme using a public key-transport key owned by the intended recipient. The key- wrapping key or public key-transport key shall have been distributed as specified in this Recommendation. When using split-knowledge procedures, each key component shall be either encrypted or distributed separately to each individual. Appropriate physical security procedures shall be used to protect each key component as sensitive information. Physical security procedures may be used for all forms of manual key distribution. However, these procedures are particularly critical when the keys are distributed in plaintext form. In addition to the assurances listed above, accountability and auditing of the distribution process (see Sections 9.1 and 9.2 ) should be used. 8.1.5.2.2.2 Automated Key Distribution/Key Transport/Key Wrapping Automated key distribution, also known as key transport or key wrapping, is used to distribute keys via a communication channel (e.g., the Internet or a satellite transmission). This requires the prior distribution of a key-wrapping key (i.e., a key-encryption key) or a public key- transport key as follows:

After · SP 800-57 Part 1 Rev. 5

Keys generated in accordance with Section 8.1.5.2.1 as key-wrapping keys (i.e., key- encryptingkey-encrypting keys), as master/key-derivation keys to be used for key derivation, or for the protection of communicated information are distributed manually (manual key transport) or using an automated key-transport protocol (automated key transport). Keys used only for the storage of information (i.e., data or keying material) shall not be distributed except for backup or to other authorized entities that may require access to the stored information protected by the keys. 8.1.5.2.2.1 Manual Key Distribution Keys and key shares that are distributed manually (i.e., by other than an automated key-transport protocol) shall be protected throughout the distribution process. During manual distribution, secret orkeys, private keys, and key shares shall either be wrapped (i.e., encrypted with integrity protection) or be distributed using appropriate physical security procedures. If multi-party control is desired, split-knowledge procedures may beare used as well. The manual distribution process shall assure that: 1.for Thekey distribution of the keys is from an authorized source, 2. Any entity distributing plaintext keys is trusted by both the entity that generates the keys and the entity(ies) that receives the keys, 3. The keys are protected in accordance with Section 6 , and 4i. The keys are received by the authorized recipiente. When distributed in encrypted form, the key shall be encrypted by an approved key-wrapping scheme using a key-wrapping key that is used only for key wrapping, or by an approved key- transport scheme using a publicdistributed key-transportas key owned byshares; thesee intendedSection recipient8. The key- wrapping key or public key-transport key shall have been distributed as specified in this Recommendation1. When using split-knowledge5.2.1 procedures), each key componentshare shall be either encrypted or distributed separately to each individual. Appropriate physical security procedures shall be used to protect each key component asits sensitiveintended informationrecipient. Physical security procedures may beThe usedprocess for all forms ofthe manual key distribution. However, these procedures are particularly critical whenof thesecret keys are distributed in plaintext form. In addition to the assurances listed above, accountability and auditing of the distribution process (see Sections 9.1 and 9.2 ) should be used. 8.1.5.2.2.2 Automated Key Distribution/Key Transport/Key Wrapping Automated keyprivate distributionkeys, also known as key transport orand key wrapping, is used to distribute keys via a communication channelshares (ei.ge., the Internet or asecret satellitekeying transmissionmaterial). This requires the prior distribution of ashall key-wrappingassure keythat: (i.e1., a key-encryption key)The orkeying amaterial publicis key-distributed transportby keyan asauthorized follows:source,