8.2.2.1 Backup Storage
All changes in this version
Title
Backup Storage
Control changed
Before · SP 800-57 Part 1 Rev. 4
The backup of keying material on an independent, secure storage media provides a source for key recovery (see Section 8.2.2.2 ). Backup storage is used to store copies of information that are also currently available in normal operational storage during a key’s cryptoperiod (i.e., in the cryptographic module, or on an immediately accessible storage media - see Section 8.2.1.1 ). Not all keys need to be backed up. The storage requirements of Section 6.2.2 apply to keying material that is backed up. Tables 7 and 8 provide guidance about the backup of each type of keying material and other related information. An “OK” indicates that storage is permissible, but not necessarily required. The final determination for backup should be made based on the application in which the keying material is used. A detailed discussion about the backup of each type of key and other cryptographic information is provided in Appendix B.3 . Keying material maintained in backup should remain in storage for at least as long as the same keying material is maintained in storage for normal operational use (see Section 8.2.1 ). When no longer needed for normal operational use, the keying material and other related information should be removed from backup storage. When removed from backup storage, all traces of the information in backup storage shall be destroyed in accordance with Section 8.3.4 . A discussion of backup and recovery is provided in [ITLBulletin] . Table 7: Backup of keys
Type of Key Backup?
Private signature key No (in general); support for non-repudiation would be in question. However, backup may be warranted in some cases − a CA’s private signing key, for example. When required, any backed up keys shall be stored under the owner’s control.
Public signature-verification key OK; its presence in a public-key certificate that is available elsewhere may be sufficient.
Symmetric authentication key OK
Private authentication key OK, if required by an application.
Public authentication key OK; if required by an application.
Symmetric data encryption key OK
Symmetric key-wrapping key OK
Random number generation key Not necessary and may not be desirable, depending on the application.
Symmetric master key OK
Private key-transport key OK
Public key-transport key OK; its presence in a public-key certificate that is available elsewhere may be sufficient.
Symmetric key-agreement key OK
Private static key-agreement key OK
Public static key-agreement key OK; its presence in a public-key certificate that is available elsewhere may be sufficient.
Private ephemeral key-agreement key No
Public ephemeral key-agreement key OK
Symmetric authorization key OK
Private authorization key OK
Public authorization key OK; its presence in a public-key certificate that is available elsewhere may be sufficient. Table 8: Backup of other cryptographic or related information
Type of Keying Material Backup?
Domain parameters OK
Initialization vector OK, if necessary
Shared secret No
RBG seed No
Other public information OK
Other secret information OK
Intermediate results No
Key control information (e.g., IDs, purpose, etc.) OK
Random number Depends on the application or use of the random number.
Passwords OK when used to derive keys or to detect the reuse of passwords; otherwise, No
Audit information OK
After · SP 800-57 Part 1 Rev. 5
The backup of keying material on an independent, secure storage media provides a source for key recovery (see Section 8.2.2.2 ). Backup storage is used to store copies of key information that areis also currently available in normal operational storage during a key’s cryptoperiod (i.e., in the cryptographic module, or on an immediately accessible storage media -; see Section 8.2.1.1 ). Not all keys need to be backed up. The storage requirements of Section 6.2.2 apply to keying material that is backed up. Tables 7 and 8 provide guidance about the backup of each type of keying material and other related information. An “OK” indicates that storage is permissible, but not necessarily required. The final determination for backup should be made based on the application in which the keying material is used. A detailed discussion about the backup of each type of key and other cryptographickey information is provided in Appendix B.3 . Keying material maintained in backup storage should remain in storage for at least as long as the same keying material is maintained in storage for normal operational use (see Section 8.2.1 ). When no longer needed for normal operational use, the keying material and other related information should be removed from backup storage. When removed from backup storage, all traces of the information in backup storage shall be destroyed in accordance with Section 8.3.4 . A discussion of backup and recovery is provided in [ITLBulletin] ITL Bulletin ]. 99
Table 7: Backup of keys
Type of Key Backup?
Private signature key No (in general); support for non-repudiation would be in question. However, backup may be warranted in some cases, −such as a CA’s private signing key, for example. When required, any backed up keys shall be stored under the owner’s control.
Public signature-verification key OK; its presence in a public-key certificate that is available elsewhere may be sufficient.
Symmetric authentication key OK
Private authentication key OK, if required by an application.
99 ITL Bulletin: Techniques for System and Data Recovery . Type of Key Backup?
Public authentication key OK; if required by an application.
Symmetric data encryption key OK
Symmetric key-wrapping key OK
Random number generation key Not necessary and may not be desirable, depending on the application.
Symmetric master/key-derivation key OK
Private key-transport key OK
Public key-transport key OK; its presence in a public-key certificate that is available elsewhere may be sufficient.
Symmetric key-agreement key OK
Private static key-agreement key OK
Public static key-agreement key OK; its presence in a public-key certificate that is available elsewhere may be sufficient.
Private ephemeral key-agreement key No
Public ephemeral key-agreement key OK
Symmetric authorization key OK
Private authorization key OK
Public authorization key OK; its presence in a public-key certificate that is available elsewhere may be sufficient.
Table 8: Backup of other cryptographic or related information
Type of Keying Material Backup?
Domain parameters OK
Initialization vector OK, if necessary
Shared secret No
RBG seed No
Other public information OK
Other secret information OK
Intermediate results NoKey controlKey-control information/metadata (e.g., IDs, purpose, etc.) OK
Passwords OK when used to derive keys or to detect the reuse of passwords; otherwise, No.
Audit information OK