THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · SC-12

Cryptographic Key Establishment and Management

US National Institute of Standards and Technology (NIST) · cited in 17 of our lessons

Explanation

What it asks for. Cryptographic keys must be established and managed according to defined requirements for key generation, distribution, storage, access and destruction.

In practice. Doing this well means a key management standard, central key management services or hardware security modules for sensitive keys, defined key lifetimes and rotation, separation of duties for key custodians and procedures for compromise. Auditors expect the standard, key inventories, rotation records and access controls on key stores. ISO/IEC 27001 cryptographic key management sets similar expectations.

Common gaps. Keys and secrets are often stored alongside the data they protect or embedded in code. Many organisations cannot list all their keys and certificates. Key custodians may also leave without a handover. Rotation is also frequently postponed indefinitely because nobody knows what would break.

Open SP 800-53 at NIST
The official text
Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements]. Discussion: Cryptographic key management and establishment can be performed using manual procedures or automated mechanisms with supporting manual procedures. Organizations define key management requirements in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and specify appropriate options, parameters, and levels. Organizations manage trust stores to ensure that only approved trust anchors are part of such trust stores. This includes certificates with visibility external to organizational systems and certificates related to the internal operations of systems. [NIST CMVP](#1acdc775-aafb-4d11-9341-dc6a822e9d38) and [NIST CAVP](#84dc1b0c-acb7-4269-84c4-00dbabacd78c) provide additional information on validated cryptographic modules and algorithms that can be used in cryptographic key management and establishment.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 17.