1. Practices in Security Bruhadeshwar Bezawada

2. Algorithms, Key Sizes and Strengths

3. Design Choices Strength of the key established is equal to the weakest algorithm Strength of the key established is equal to the weakest algorithm 160-bit ECC is used to establish 128-bit AES, security is only 80 bits 160-bit ECC is used to establish 128-bit AES, security is only 80 bits 1024-bit RSA is used to establish 128-bit AES, security is only 80 bits 1024-bit RSA is used to establish 128-bit AES, security is only 80 bits For 128-bit security For 128-bit security Use AES for confidentiality Use AES for confidentiality Use SHA-256 or higher for integrity and authentication Use SHA-256 or higher for integrity and authentication

4. Key Compromise Can mean anything Can mean anything An unauthorized entity has gained access to the key and is able use it for personal gains An unauthorized entity has gained access to the key and is able use it for personal gains Key is incorrect or modified or substituted Key is incorrect or modified or substituted Incorrectly used for a different purpose Incorrectly used for a different purpose Authentication of sender fails Authentication of sender fails

5. Protective Measure Against Key Compromise Limit the amount of time key is in plain-text format Limit the amount of time key is in plain-text format Prevent human access of plain-text keys Prevent human access of plain-text keys Restrict keys to physical storage and restricted devices Restrict keys to physical storage and restricted devices Protect integrity of keys with other keys Protect integrity of keys with other keys Keep a log of key usage with central time stamp to keep track of usage Keep a log of key usage with central time stamp to keep track of usage Destroy keys as soon as they are no longer needed Destroy keys as soon as they are no longer needed

6. Compromise Recovery Plan Identity of personnel to notify Identity of personnel to notify Identity of personnel who initiates recovery actions Identity of personnel who initiates recovery actions Re-key method (automatic, manual, centralized, distributed, collaborative) Re-key method (automatic, manual, centralized, distributed, collaborative)

7. Factors to be Considered For Design of New System Sensitivity of information and system lifetime Sensitivity of information and system lifetime Keep in mind future computational developments, don’t underestimate level of protection Keep in mind future computational developments, don’t underestimate level of protection Appropriate algorithm selection keeping in mind feasibility and future needs Appropriate algorithm selection keeping in mind feasibility and future needs System design with performance and security as goals System design with performance and security as goals Pre-implementation evaluation Pre-implementation evaluation Do not use latest developments without appropriate evaluation and standardization Do not use latest developments without appropriate evaluation and standardization Testing Testing Training Training System implementation and transition System implementation and transition Post-implementation evaluation Post-implementation evaluation

8. Protection Requirements

10. Key Life Cycle

11. Key Management Phases

12. Key Management States and Phases

13. Key Management Phases Pre-operational Phase Pre-operational Phase User registration function User registration function System initialization System initialization User initialization User initialization