NIST, Computer Security Division, Computer Security Resource Center
Key Management
About Key Management
Generally-speaking, there are two types of key establishment techniques: 1) techniques based on asymmetric (public key) algorithms, and 2) techniques based on symmetric (secret key) algorithms. However, hybrid techniques are also commonly used, whereby public key techniques are used to establish symmetric (secret) key encryption keys, which are then used to establish other symmetric (secret) keys.
Back to TopKey Management Project
NIST recently announced a new Key Management Project. For more information see the Cryptographic Key Management Project homepgae.
Back to TopKey Management Guideline
May 5, 2011: NIST requests comments on a draft revision of Special Publication (SP) 800-57, Part 1, Recommendation for Key Management: Part 1: General. This revision is intended to align the document with SP 800-131A, as well as to provide a general update of the document, including references to NIST publications that have been completed since the last revision of SP 800-57. A general list of the changes is provided at the end of Appendix D, and except for some editorial changes, the changes within the documented are marked. Here are the comments received.
April 12, 2011: NIST requested comments for Draft Special Publication (SP) 800-131B, Transitions: Validation of Transitioning Cryptographic Algorithm and Key Lengths. on February 10, 2001. SP 800-131B provides details about the validation of the cryptographic algorithms and cryptographic modules in transition, as specified in SP 800-131A. These are the comments received.
April 12, 2011: NIST requested comments for Draft Special Publication (SP) 800-131C, Transitions: Validating the Transition from FIPS 186-2 to FIPS 186-3 on February 10, 2011. SP 800-131C addresses both the cryptographic algorithm validations and the cryptographic module validations that are conducted by NIST’s Cryptographic Algorithm Validation Program (CAVP) and the Cryptographic Module Validation Program (CMVP), respectively. These are the comments received.
January 13, 2011: NIST announces the completion of Special Publication (SP) 800-131A, Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths. This Recommendation provides the approach for transitioning from the use of one algorithm or key length to another, as initially addressed in Part 1 of SP 800-57. SP 800-131B, Transitions: Validation of Transitioning Cryptographic Algorithms and Key Lengths, is under development and will address the validation of cryptographic modules during the transition period.
June 16, 2010: A Draft Special Publication 800-130, A Framework for Designing Cryptographic Key Management Systems, is available for an initial public comment period. This document contains descriptions of Cryptographic Key Management System (CKMS) components that should be considered by a CKMS designer and specifies requirements for the documentation of those CKMS components in the design. The following comments on the draft were received. Note that this document will be discussed at a Key Management Workshop scheduled for September 20-21, 2010 at NIST.
SP 800-57 Part 1, Recommendation for Key Management - Part 1: General (Revised) contains general guidance and has been updated (March 2007).
SP 800-57 Part 2, Recommendation for Key Management - Part 2: Best Practices for Key Management Organizations provides guidance for system and application owners for use in identifying appropriate organizational key management infrastructures, establishing organizational key management policies, and specifying organizational key management practices. Public comments are available for Part 2 draft.
SP 800-57, Part 3 Recommendation for Key Management - Part 3: Application-Specific Key Management Guidance. NIST announces the release of Part 3 of Special Publication 800-57, Recommendation for Key Management: Application-Specific Key Management Guidance. This Recommendation provides guidance when using the cryptographic features of current systems. It is intended to help system administrators and system installers adequately secure applications based on product availability and organizational needs, and to support organizational decisions about future procurements. The guide also provides information for end users regarding application options left under their control in the normal use of the application. Recommendations are given for a select set of applications, namely: PKI, IPsec, TLS, S/MIME, Kerberos, OTAR, DNSSEC and Encrypted File Systems.
Back to TopKey Schemes
The Recommendation for Key Establishment Schemes is under development and has been divided into two parts. SP 800-56A has been updated (March 2007). SP 800-56A, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography specifies key establishment schemes based on standards developed by the Accredited Standards Committee (ASC) X9, Inc.: ANS X9.42 (Agreement of Symmetric Keys Using Discrete Logarithm Cryptography) and ANS X9.63 (Key Agreement and Key Transport Using Elliptic Curve Cryptography).
August 27, 2009: NIST announces the completion of SP 800-56B, Recommendation for Pair-Wise Key Establishment Schemes Using Integer Factorization Cryptography. This Recommendation provides the specifications of key establishment schemes that are based on a standard developed by the Accredited Standards Committee (ASC) X9, Inc.: ANS X9.44, Key Establishment using Integer Factorization Cryptography. SP 800-56B provides asymmetric-based key agreement and key transport schemes that are based on the Rivest Shamir Adleman (RSA) algorithm.
July 11, 2011: The second draft of NIST SP 800-56C: Recommendation for Key Derivation through Extraction-then-Expansion is available for public comments. The initial draft was released in September 2010. This second version incorporates resolutions to the comments received during the first comment period. This Recommendation specifies techniques for the derivation of keying material from a shared secret established during a key establishment scheme defined in NIST Special Publications 800-56A or 800-56B through an extraction-then-expansion procedure. NIST is in the process of modifying SP 800-56A and SP 800-56B to include the extraction-then-expansion key derivation procedure specified in this draft Recommendation (800-56C). Please submit comments to 800-56Ccomments@nist.gov with "Comments on SP 800-56C" in the subject line. The comment period will close on August 11, 2011.
A specification is available for AES key wrapping.
Back to TopComments
NIST welcomes the submission of comments on this project at any time. Comments on the Key Management Guideline should be addressed to GuidelineComments@nist.gov. Comments on the Key Establishment Schemes document should be addressed to kmscomments@nist.gov.
Comments on the previous draft of the Recommendation for Key Management - Part 1.
Back to TopTesting Products
Testing is currently available for SP 800-56A. For more inforation see the Cryptographic Algorithm Validation Program (CAVP) homepage.
Back to TopAdditional Information
July 29, 2011: NIST requests comments on Special Publication (SP) 800-133, Recommendation for Cryptographic Key Generation. Cryptography relies upon two basic components: an algorithm (or cryptographic methodology) and a cryptographic key. This Recommendation discusses the generation of the keys to be managed and used by NIST’s approved cryptographic algorithms. Please provide comments by September 30th, 2011 to SP-800-133_Comments@nist.gov, with “Comments on SP 800-133 Key Generation” in the subject line.
Back to TopFuture Plans
For information about works in progess in the Key Management area, see the Cryptographic Key Management Project homepage.