BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

8.3.2 Entity De-registration Function

NIST platform security: roots of trust, firmware and secure enclaves SP 800-57 Part 1 Rev. 5 against SP 800-57 Part 1 Rev. 4
All changes in this version
modified 8 Transition: A transition plan should be developed and followed so that the changeover part of 8.3

Title

Entity De-registration Function

Control changed

Before · SP 800-57 Part 1 Rev. 4

The entity de-registration function removes the authorizations of an entity to participate in a security domain. When an entity ceases to be a member of a security domain, the entity shall be de-registered. De-registration is intended to prevent other entities from relying on or using the de-registered entity's keying material. All records of the entity and the entity’s associations shall be marked to indicate that the entity is no longer a member of the security domain, but the records should not be deleted. To reduce confusion and unavoidable human errors, identification information associated with the de- registered entity should not be re-used (at least for a period of time). For example, if a “John Wilson” retires and is de-registered on Friday, the identification information assigned to his son “John Wilson”, who is hired the following Monday, should be different.

After · SP 800-57 Part 1 Rev. 5

The entity de-registration function removes the authorizations of an entity to participate in a security domain. When an entity ceases to be a member of a security domain, the entity shall be de-registered. De-registration is intended to prevent other entities from relying on or using the de-registeredde- entity'sregistered entity’s keying material (e.g., a symmetric key shared with the de-registered entity). All records of the entity and the entity’s associations shall be marked to indicate that the entity is no longer a member of the security domain, but the records should not be deleted (even though the key itself has been destroyed). To reduce confusion and unavoidable human errors, identification information associated with the de- registeredde-registered entity should not be re-used (at least for a period of time). For example, if a “John Wilson” retires and is de-registered on Friday, the identification information assigned to his son “John Wilson”,” who is hired the following Monday, should be different.

102 For example, an archived symmetric key could be recovered to decrypt a single message or file or could be used to decrypt multiple messages or files, all of which were encrypted using that key during its originator-usage period.