BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.1.6 Key Registration Function

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
modified 8 Transition: A transition plan should be developed and followed so that the changeover part of 8.1

Title

Key Registration Function

Control changed

Before · SP 800-57 Part 1 Rev. 4

Key registration results in the binding of keying material to information associated with a particular entity. Keys that would be registered include the public key of an asymmetric key pair and the symmetric key used to bootstrap an entity into a system. Normally, keys generated during communications (e.g., using key-agreement schemes or key derivation functions) would

41 Assurance that a valid data transmission is not maliciously or fraudulently repeated or delayed. 42 Authentication by each party in a transaction of the identity of the other party. not be registered. Information provided during registration typically includes the identifier of the entity associated with the keying material and the intended use of the keying material (e.g., as a signing key, data-encryption key, etc.). Additional information may include authorization information or specify a level of trust. The binding is performed after the entity’s identity has been authenticated by a means that is consistent with the system policy (see Section 8.1.1 ). The binding provides assurance to the community-at-large that the keying material is used by the correct entity in the correct application. The binding is often cryptographic, which creates a strong association between the keying material and the entity. A trusted third party performs the binding. Examples of a trusted third party include a Kerberos realm server or a PKI certification authority (CA). Identifiers issued by a trusted third party shall be unique to that party. When a Kerberos realm server performs the binding, a symmetric key is stored on the server with the corresponding metadata. In this case, the registered keying material is maintained in secure storage (i.e., the keys are provided with confidentiality and integrity protection). When a CA performs the binding, the public key and associated information (often called attributes ) are placed in a public-key certificate, which is digitally signed by the CA. In this case, the registered keying material may be made publicly available. When a CA provides a certificate for a public key, the public key shall be verified to ensure that it is associated with the private key known by the purported owner of the public key. This provides assurance of possession. When POP is used to obtain assurance of possession, the assurance shall be accomplished as specified in Section 8.1.5.1.1.2 .

After · SP 800-57 Part 1 Rev. 5

Key registration results in the binding of keying material to information associated with a particular entity. Keys that would be registered include the public key of an asymmetric key pair and the symmetric key used to bootstrap an entity into a system. Normally, keys generated during communications (e.g., using key-agreement schemes or key derivation functions) would

41 Assurance that a valid data transmission is not maliciously or fraudulently repeated or delayed. 42 Authentication by each party in a transaction of the identity of the other party. not be registered. Information provided during registration typically includes the identifier of the entity associated with the keying material (the owner) and the intended use of the keying material (e.g., as a signing key, data-encryption key, etc.). Additional information may include authorization information or, specify a level of trust, or indicate where the key is stored (e.g., its physical location, internet address, or device identity). The binding is performed after the entity’s identity has been authenticated by a means that is consistent with the system policy (see Section 8.1.1 ). The binding provides assurance to the community-at-largecommunity at large that the keying material is used by the correct entity in the correct application. The binding is often cryptographic, whichto createscreate a strong association between the keying material and the entity. A trusted third party performs the binding. Examples of a trusted third party include a Kerberos realm server or a PKI certification authority (CA). Identifiers issued by a trusted third party shall be unique to that party. When a Kerberos realm server performs the binding, a symmetric key is stored on the server with the corresponding metadata. In this case, the registered keying material is maintained in secure storage (i.e., the keys are provided with confidentiality and integrity protection). When a CA performs the binding, the public key and associated information (e.g., domain parameters and some metadata, often called attributes ) are placed in a public-key certificate, whichthat is digitally signed by the CA. In this case, the registered keying material may be made publicly available. When a CA provides a certificate for a public key, the public key shall be verified to ensure that it is associated with the private key known by the purported owner of the public key. This provides assurance of possession, also known as proof of possession (POP). When POP is used to obtain assurance of possession, the assurance shall be accomplished as specified in Section 8.1.5.1.1.2 . Registered keys and certificates shall be included in an inventory (see Section 9.2 ).