Key Management

Question 1

Crypto period

Answer 1

The crypto period is the time span during which a specific key is authorized for use.
The processing period can continue after the protection period. The crypto-period lasts from the beginning of the protection period to the end of the processing period.

Question 2

Understand requirements for key distributions with and without PKI

Answer 2

Symmetric secret keys: Confidentiality required.

Asymmetric public keys: Authenticity required.

Asymmetric public keys with PKI: Authenticity required.

Question 3

PKI

Answer 3

Public-Key Infrastructure.
Cryptography solves security problems in open networks, but creates key distribution challenges. Public-key cryptography simplifies the key distribution, but requires a PKI which creates trust management challenges

PKI consists of:
– Policies (to define the rules for managing certificates)
– Technologies (to implement the policies and generate,
store and manage certificates)
– Procedures (related to key management)
– Trust model of public-key certificates (how the
certificates are cryptographically linked to each other)

Question 4

Understand requirements for type of protection needed (confidentiality or integrity)

Answer 4

..

Question 5

Certificates

Answer 5

• A public-key certificate is a
  record of data, including the
  subject distinguished name andits public key, all digitally signed
  by a CA (Certificate Authority).
• Binds name to public key
• An authentic copy of the CA’s public key is needed in order to validate the certificate

Question 6

Ideas, content, issuing, managing of certificates and PKI

Answer 6

..

Question 7

PKI trust model

Answer 7

• Advantages:
– works well in highly-structured setting such as military and
government
– unique certification path between two entities (so finding certification
paths is trivial)
– scales well to larger systems

• Disadvantages:
– need a trusted third party (root CA)
– ‘single point-of-failure’ target
– If any node is compromised, trust impact on all entities stemming
from that node
– Does not work well for global implementation (who is root TTP?)

Question 8

The strength of cryptographic security depends on

Answer 8

1. The size of the keys
2. The robustness of cryptographic algorithms/protocols
3. The protection and management afforded to the keys. (Key management)

Question 9

Key Protection

Answer 9

Symmetric ciphers
– Never stored or transmitted ‘in the clear’
– May use hierarchy: session keys encrypted with master key
– Master key protection:
• Locks and guards
• Tamper proof devices
• Passwords/passphrases
• Biometrics

Asymmetric ciphers
– Private keys need confidentiality protection
(“Master Key”)
– Public keys need integrity/authenticity protection
(“PKI”)