8.3.1 Key Archive and Key Recovery Functions (was: Archive Storage and Key Recovery Functions)
All changes in this version
Title changed
Before · SP 800-57 Part 1 Rev. 4
Archive Storage and Key Recovery Functions
After · SP 800-57 Part 1 Rev. 5
ArchiveKey StorageArchive and Key Recovery Functions
Control changed
Before · SP 800-57 Part 1 Rev. 4
A key archive is a repository containing keying material and other related information for recovery beyond the cryptoperiod of the keys. Not all keying material needs to be archived. An organization’s security plan should indicate the types of information that are to be archived (see [ SP800-57, Part 2 ]). The archive shall continue to provide the appropriate protections for each key and any other related information in the archive, as specified in Section 6.2.2 . The archive will require a strong access-control mechanism to limit access to only authorized entities. When keying material is entered into the archive, it is often time-stamped so that the date-of-entry can be determined. This date may itself be cryptographically protected so that it cannot be changed without detection. If keying material needs to be recoverable (e.g., after the end of its cryptoperiod), either the keying material shall be archived, or the system shall be designed to allow reconstruction (e.g., re-derivation) of the keying material from archived information. Retrieving the keying material from archive storage or by reconstruction is commonly known as key recovery. The archive shall be maintained by a trusted party (e.g., the organization associated with the keying material or a trusted third party). While in storage, archived information may be either static (i.e., never changing) or may need to be re-encrypted under a new archive-encryption key from time-to-time. Archived data should be stored separately from operational data, and multiple copies of archived cryptographic information should be provided in physically separate locations (i.e., it is recommended that the key archive be backed up). For critical information that is encrypted under archived keys, it may be necessary to back up the archived keys and to store multiple copies of these archived keys in separate locations. When archived, keying material should be archived prior to the end of the cryptoperiod of the key. For example, it may be prudent to archive the keying material during key activation. When no longer required, the keying material shall be destroyed in accordance with Section 8.3.4 . The confidentiality of archived information is provided by an archive-encryption key (one or more encryption keys that are used exclusively for the encryption of archived information), by another key that has been archived, or by a key that may be derived from an archived key. Note that the algorithm with which the archive-encryption key is used may also provide integrity protection for the encrypted information. When encrypted by the archive-encryption key, the encrypted keying material shall be re-encrypted by any new archive-encryption key at the end of the cryptoperiod of the old archive-encryption key. When the keying material is re- encrypted, integrity values on that keying material shall be recomputed. This may impose a significant burden; therefore, the strength of the cryptographic algorithm and archive- encryption key shall be selected to minimize the need for re-encryption. When the archive-encryption key and its associated algorithm do not also provide integrity protection for the encrypted information, integrity protection shall be provided by a separate archive-integrity key (i.e., one or more authentication or digital-signature keys that are used exclusively for the archive) or by another key that has been archived. If integrity protection is to be maintained at the end of the cryptoperiod of the archive-integrity key, new integrity values shall be computed on the archived information on which the old archive-integrity key was applied. When the confidentiality and integrity protection of the archived information is provided using separate processes, the archive-encryption key and archive-integrity key (when used) shall be different from each other (e.g., independently generated), and shall be protected in the same manner as their key type (see Section 6 ). Note that these two services can also be provided using authenticated encryption, which uses a single cryptographic algorithm operation and a single key. Tables 9 and 10 indicate the appropriateness of archiving keys and other cryptographically related information. An “OK” in column 2 (Archive?) indicates that archival is permissible, but not necessarily required. Column 3 (Retention period) indicates the minimum time that the key should be retained in the archive. Additional advice on the storage of keying material in archive storage is provided in Appendix B.3 . Table 9: Archive of keys
Type of Key Archive? Retention period (minimum)
Private signature key No
Public signature-verification key OK Until no longer required to verify data signed with the associated private key
Symmetric authentication key OK Until no longer needed to authenticate data or an identity.
Private authentication key No
Public authentication key OK
Symmetric data-encryption key OK Until no longer needed to decrypt data encrypted by this key
Symmetric key-wrapping key OK Until no longer needed to decrypt keys encrypted by this key
Symmetric random number generator key No
Symmetric master key OK, if needed to derive other keys for archived data Until no longer needed to derive other keys
Private key-transport key OK Until no longer needed to decrypt keys encrypted by this key
Public key-transport key OK
Symmetric key-agreement key OK
Private static key-agreement key OK
Public static key-agreement key OK Until no longer needed to reconstruct keying material. Type of Key Archive? Retention period (minimum)
Private ephemeral key- agreement key No
Public ephemeral key- agreement key OK
Symmetric authorization key No
Private authorization key No
Public authorization key OK
Table 10: Archive of other cryptographic related information
Type of Key Archive? Retention period (minimum)
Domain parameters OK Until all keying material, signatures and signed data using the domain parameters are removed from archives
Initialization vector OK; normally stored with the protected information Until no longer needed to process the protected data
Shared secret No
RBG seed No
Other public information OK Until no longer needed to process data using the public information
Other secret information OK Until no longer needed to process data using the secret information
Intermediate result No
Key control information (e.g., IDs, purpose) OK Until the associated key is removed from the archive
Random number Depends on the application or use of the random number
Password OK when used to derive keys or to detect the reuse of passwords; otherwise, No Until no longer needed to (re-)derive keys or to detect password reuse
Audit information OK Until no longer needed The recovery of archived keying material may be required to remove (e.g., decrypt) or check (e.g., verify a digital signature or a MAC) the cryptographic protections on other archived data; recovered keys shall not be used to apply cryptographic protection. The key recovery process results in retrieving or reconstructing the desired keying material from archive storage in order to perform the required cryptographic operation. Immediately after completing this operation, the keying material shall be erased from the cryptographic process 44 for which it was recovered (i.e., it shall not be used for normal operational activities). However, the key shall be retained in the archive (see Section 8.3.4 ) as long as needed. Further advice on key recovery issues is provided in Appendix B .
After · SP 800-57 Part 1 Rev. 5
A key archive is a repository containing keying material and other related information for recovery beyond the cryptoperiod of the keys. Not all keying material needs to be archived. An organization’s security plan should indicate the types of information that are to be archived (see [ SP800-57, Part 2 ]). The archive shall continue to provide the appropriate protections for each key and any other related information in the archive, as specified in Section 6.2.2 . The archive will require a strong access-control mechanism to limit access to only authorized entities. When keying material is entered into the archive, it is often time-stamped so that the date-of-entry can be determined. This date may itself be cryptographically protected so that it cannot be changed without detection. If keying material needs to be recoverable (e.g., after the end of its cryptoperiod), either the keying material shall be archived, or the system shall be designed to allow reconstruction (e.g., re-derivation) of the keying material from archived information. Retrieving the keying material from archive storage or by reconstruction is commonly known as key recovery. The archive shall be maintained by a trusted party (e.g., the organization associated with the keying material or a trusted third party). While in storage, archived information may be either static (i.e., never changing) or may need to be re-encrypted under a new archive-encryption key from time-to-time. Archived data should be stored separately from operational data, and multiple copies of archived cryptographic information should be provided in physically separate locations (i.e., it is recommended that the key archive be backed up). For critical information that is encrypted under archived keys, it may be necessary to back up the archived keys and to store multiple copies of these archived keys in separate locations. When archived, keying material should be archived prior to the end of the cryptoperiod of the key. For example, it may be prudent to archive the keying material during key activation. When no longer required, the keying material shall be destroyed in accordance with Section 8.3.4 . The confidentiality of archived information is provided by an archive-encryption key (one or more encryption keys that are used exclusively for the encryption of archived information), by another key that has been archived, or by a key that may be derived from an archived key. Note that the algorithm with which the archive-encryption key is used may also provide integrity protection for the encrypted information. When encrypted by the archive-encryption key, the encrypted keying material shall be re-encrypted by any new archive-encryption key at the end of the cryptoperiod of the old archive-encryption key. When the keying material is re- encrypted, integrity values on that keying material shall be recomputed. This may impose a significant burden; therefore, the strength of the cryptographic algorithm and archive- encryption key shall be selected to minimize the need for re-encryption. When the archive-encryption key and its associated algorithm do not also provide integrity protection for the encrypted information, integrity protection shall be provided by a separate archive-integrity key (i.e., one or more authentication or digital-signature keys that are used exclusively for the archive) or by another key that has been archived. If integrity protection is to be maintained at the end of the cryptoperiod of the archive-integrity key, new integrity values shall be computed on the archived information on which the old archive-integrity key was applied. When the confidentiality and integrity protection of the archived information is provided using separate processes, the archive-encryption key and archive-integrity key (when used) shall be different from each other (e.g., independently generated), and shall be protected in the same manner as their key type (see Section 6 ). Note that these two services can also be provided using authenticated encryption, which uses a single cryptographic algorithm operation and a single key. Tables 9 and 10 indicate the appropriateness of archiving keys and other cryptographically related information. An “OK” in column 2 (Archive?) indicates that archival is permissible, but not necessarily required. Column 3 (Retention period) indicates the minimum time that the key should be retained in the archive. Additional advice on the storage of keying material in archive storage is provided in Appendix B.3 . Table 9: Archive of keysA key archive is a repository containing keys and their associated information (i.e., key information) for recovery beyond the cryptoperiod of the keys. Not all keys need to be archived. An organization’s security plan should discuss key archiving (see SP 800-57, Part 2 ). The key archive shall continue to provide the appropriate protections for each key and any other related information in the archive as specified in Section 6.2.2 . The archive will require a strong access-control mechanism to limit access to only authorized entities. When key information is entered into the archive, it is often timestamped so that the date of entry can be determined. This date may itself be cryptographically protected so that it cannot be changed without detection. If a key must be recoverable (e.g., after the end of its cryptoperiod), either the key shall be archived, or the system shall be designed to allow reconstruction (e.g., re-derivation) of the key from archived information. Retrieving the key from archive storage or by reconstruction is commonly known as key recovery. The archive shall be maintained by a trusted party (e.g., the organization associated with the key or a trusted third party). Archived key information shall be stored separately from operational data, and multiple copies of archived key information should be provided in physically separate locations (i.e., the key archive should be backed up). For critical information that is encrypted under archived keys, it may be necessary to back up the archived keys and store multiple copies of these archived keys in separate locations. When archived, keys should be archived prior to the end of the key’s cryptoperiod. For example, it may be prudent to archive the key when it is activated. When no longer required, the key shall be destroyed in accordance with Section 8.3.4 . The confidentiality of archived key information is provided by an archive-encryption key (one or more encryption keys that are used exclusively for the encryption of archived key information), by another key that has been archived, or by a key that may be derived from an archived key. Note that the algorithm with which the archive-encryption key is used may also provide integrity protection for the encrypted information. When the archive-encryption key and its associated algorithm do not also provide integrity protection for the encrypted information, integrity protection shall be provided by a separate archive-integrity key (i.e., one or more authentication or digital-signature keys that are used exclusively for the archive) or by another key that has been archived. When the confidentiality and integrity protection of the archived key information are provided using separate processes, the archive-encryption key and archive-integrity key shall be different from each other (e.g., independently generated) and shall be protected in the same manner as their key type (see Section 6.1.1 ). Note that these two services could also be provided using authenticated encryption, which uses a single cryptographic algorithm operation and a single key. Tables 9 and 10 indicate the appropriateness of archiving keys and other cryptographically related information. An “OK” in column 2 (Archive?) indicates that archiving is permissible but not necessarily required. Column 3 (Retention period) indicates the minimum time that the key should be retained in the archive. Additional advice on the storage of keying material in archive storage is provided in Appendix B.3 . Table 9: Archive of keys
Type of Key Archive? Retention period (minimum)
Private signature key No
Public signature-verification key OK Until no longer required to verify data signed with the associated private key
Symmetric authentication key OK Until no longer needed to authenticate data or an identity.
Private authentication key No
Public authentication key OK
Symmetric data-encryption key OK Until no longer needed to decrypt data encrypted by this key
Symmetric key-wrapping key OK Until no longer needed to decrypt keys encrypted by this key
Symmetric random number generator key No
Symmetric master key OK, if needed to derive other keys for archived data Until no longer needed to derive other keys
Private key-transport key OK Until no longer needed to decrypt keys encrypted by this key
Public key-transport key OK
Symmetric key-agreement key OK
Private static key-agreement key OK
Public static key-agreement key OK Until no longer needed to reconstruct keying material. Type of Key Archive? Retention period (minimum)
Private ephemeral key- agreement key No
Public ephemeral key- agreement key OK
Symmetric authorization key No
Private authorization key No
Public authorization key OK
Table 10: Archive of other cryptographic related information
Type of Key Archive? Retention period (minimum)
Domain parameters OK Until all keying material, signatures and signed data using the domain parameters are removed from archives
Initialization vector OK; normally stored with the protected information Until no longer needed to process the protected data
Shared secret No
RBG seed No
Other public information OK Until no longer needed to process data using the public information
Other secret information OK Until no longer needed to process data using the secret information
Intermediate result No
Key control information (e.g., IDs, purpose) OK Until the associated key is removed from the archive
Random number Depends on the application or use of the random number
Password OK when used to derive keys or to detect the reuse of passwords; otherwise, No Until no longer needed to (re-)derive keys or to detect password reuse
Audit information OK Until no longer needed The recovery of archived keying material may be required to remove (e.g., decrypt) or check (e.g., verify a digital signature or a MAC) the cryptographic protections on other archived data; recovered keys shall not be used to apply cryptographic protection. The key recovery process results in retrieving or reconstructing the desired keying material from archive storage in order to perform the required cryptographic operation. Immediately after completing this operation, the keying material shall be erased from the cryptographic process 44 for which it was recovered (i.e., it shall not be used for normal operational activities). However, the key shall be retained in the archive (see Section 8.3.4 ) as long as needed. Further advice on key recovery issues is provided in Appendix B .
Type of Key Archive? Retention period (minimum)
Private signature key No
Public signature-verification key OK Until no longer required to verify data signed with the associated private key
Symmetric authentication key OK Until no longer needed to authenticate data or an identity
Private authentication key No
Public authentication key OK
Symmetric data-encryption key OK Until no longer needed to decrypt data encrypted by this key
Symmetric key-wrapping key OK Until no longer needed to decrypt keys encrypted by this key
Symmetric random number generator key No Type of Key Archive? Retention period (minimum)
Symmetric master/key derivation key OK, if needed to derive other keys for archived data Until no longer needed to derive other keys
Private key-transport key OK Until no longer needed to decrypt keys encrypted by this key
Public key-transport key OK No real use after its usage period
Symmetric key-agreement key OK Until no longer useful for determining the key agreed upon
Private static key-agreement key OK Until no longer useful for determining the key agreed upon
Public static key-agreement key OK Until no longer needed to reconstruct keying material
Private ephemeral key- agreement key No
Public ephemeral key- agreement key OK Until no longer useful for determining the key agreed upon
Symmetric authorization key No
Private authorization key No
Public authorization key OK No real use after the usage period of the private authentication key
Table 10: Archive of other related information
Type of Key Archive? Retention period (minimum)
Domain parameters OK Until all keying material, signatures, and signed data using the domain parameters are removed from archives
Initialization vector OK; normally stored with the protected information Until no longer needed to process the protected data
Shared secret No
RBG seed No
Other public information OK Until no longer needed to process data using the public information
Other secret information OK Until no longer needed to process data using the secret information Type of Key Archive? Retention period (minimum)
Intermediate result No
Key-control information/metadata (e.g., IDs, purpose) OK Until the associated key is removed from the archive
Random number Depends on the application or use of the random number
Password OK when used to derive keys or to detect the reuse of passwords; otherwise, No Until no longer needed to (re-)derive keys or to detect password reuse
Audit information OK Until no longer needed
The recovery of archived keying material may be required to remove (e.g., decrypt) or check (e.g., verify a digital signature or a MAC) the cryptographic protections on other archived data; recovered keys shall not be used to apply cryptographic protection if the cryptoperiod (or originator-usage period) of those keys has expired. The key-recovery process results in retrieving or reconstructing the desired keying material from archive storage in order to perform the required cryptographic operation. Immediately after completing this operation, the keying material shall be erased from the cryptographic process 102 for which it was recovered (i.e., it shall not be used for normal operational activities). However, the key shall be retained in the archive (see Section 8.3.4 ) as long as needed. Further advice on key-recovery issues is provided in Appendix B .