+SC-12 Cryptographic Key Establishment and Management
---+SC-12(01) Availability
---+SC-12(02) Symmetric Keys
---+SC-12(03) Asymmetric Keys
---+SC-12(06) Physical Control of Keys
|
SC-12 Cryptographic Key Establishment and Management
Control
Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignement: requirements].
Discussion
Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and specify appropriate options, parameters, and levels. Organizations manage trust stores to ensure that only approved trust anchors are part of such trust stores. This includes certificates with visibility external to organizational systems and certificates related to the internal operations of systems. [NIST CMVP](#1acdc775-aafb-4d11-9341-dc6a822e9d38) and [NIST CAVP](#84dc1b0c-acb7-4269-84c4-00dbabacd78c) provide additional information on validated cryptographic modules and algorithms that can be used in cryptographic key management and establishment.
Assessment Objective
- cryptographic keys are established when cryptography is employed within the system in accordance with [Assignement: requirements];
- cryptographic keys are managed when cryptography is employed within the system in accordance with [Assignement: requirements].
Assessment Method
Examine
System and communications protection policy
procedures addressing cryptographic key establishment and management
system design documentation
cryptographic mechanisms
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with responsibilities for cryptographic key establishment and/or management
1. Übersicht
| Bezeichnung |
Standard |
|
SC-12(01) Availability
|
Control
Maintain availability of information in the event of the loss of cryptographic keys by users.
Discussion
Escrowing of encryption keys is a common practice for ensuring availability in the event of key loss. A forgotten passphrase is an example of losing a cryptographic key.
Assessment Objective
information availability is maintained in the event of the loss of cryptographic keys by users.
Assessment Method
Examine
System and communications protection policy
procedures addressing cryptographic key establishment, management, and recovery
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with responsibilities for cryptographic key establishment or management
|
|
SC-12(02) Symmetric Keys
|
Control
Produce, control, and distribute symmetric cryptographic keys using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes.
Discussion
[SP 800-56A](#20957dbb-6a1e-40a2-b38a-66f67d33ac2e), [SP 800-56B](#0d083d8a-5cc6-46f1-8d79-3081d42bcb75) , and [SP 800-56C](#eef62b16-c796-4554-955c-505824135b8a) provide guidance on cryptographic key establishment schemes and key derivation methods. [SP 800-57-1](#110e26af-4765-49e1-8740-6750f83fcda1), [SP 800-57-2](#e7942589-e267-4a5a-a3d9-f39a7aae81f0) , and [SP 800-57-3](#8306620b-1920-4d73-8b21-12008528595f) provide guidance on cryptographic key management.
Assessment Objective
- symmetric cryptographic keys are produced using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes;
- symmetric cryptographic keys are controlled using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes;
- symmetric cryptographic keys are distributed using [Selection: NIST FIPS-validated; NSA-approved] key management technology and processes.
Assessment Method
Examine
System and communications protection policy
procedures addressing cryptographic key establishment and management
system design documentation
system configuration settings and associated documentation
system audit records
list of FIPS-validated cryptographic products
list of NSA-approved cryptographic products
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel with responsibilities for cryptographic key establishment or management
|
|
SC-12(03) Asymmetric Keys
|
Control
Produce, control, and distribute asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key; certificates issued in accordance with organization-defined requirements].
Discussion
[SP 800-56A](#20957dbb-6a1e-40a2-b38a-66f67d33ac2e), [SP 800-56B](#0d083d8a-5cc6-46f1-8d79-3081d42bcb75) , and [SP 800-56C](#eef62b16-c796-4554-955c-505824135b8a) provide guidance on cryptographic key establishment schemes and key derivation methods. [SP 800-57-1](#110e26af-4765-49e1-8740-6750f83fcda1), [SP 800-57-2](#e7942589-e267-4a5a-a3d9-f39a7aae81f0) , and [SP 800-57-3](#8306620b-1920-4d73-8b21-12008528595f) provide guidance on cryptographic key management.
Assessment Objective
- asymmetric cryptographic keys are produced using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key; certificates issued in accordance with organization-defined requirements];
- asymmetric cryptographic keys are controlled using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key; certificates issued in accordance with organization-defined requirements];
- asymmetric cryptographic keys are distributed using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key; certificates issued in accordance with organization-defined requirements].
Assessment Method
Examine
System and communications protection policy
procedures addressing cryptographic key establishment and management
system design documentation
system configuration settings and associated documentation
system audit records
list of NSA-approved cryptographic products
list of approved PKI Class 3 and Class 4 certificates
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel with responsibilities for cryptographic key establishment or management
organizational personnel with responsibilities for PKI certificates
|
|
SC-12(06) Physical Control of Keys
|
Control
Maintain physical control of cryptographic keys when stored information is encrypted by external service providers.
Discussion
For organizations that use external service providers (e.g., cloud service or data center providers), physical control of cryptographic keys provides additional assurance that information stored by such external providers is not subject to unauthorized disclosure or modification.
Assessment Objective
physical control of cryptographic keys is maintained when stored information is encrypted by external service providers.
Assessment Method
Examine
System and communications protection policy
procedures addressing cryptographic key establishment, management, and recovery
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with responsibilities for cryptographic key establishment or management
|
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|