NIST Clé Management Référence
Référence pour NIST SP 800-57 clé management guidelines: hierarchy, lifecycle, et transitions.
Key Hierarchy
NIST defines a three-tier hierarchy: root/master keys (long-lived, HSM-protected), key-encryption keys (KEK, medium-lived), and data-encryption keys (DEK, short-lived). Root keys never leave the HSM; KEKs protect DEKs in transit/storage. Envelope encryption wraps DEKs with KEKs for distribution. Key separation by purpose (encryption, signing, MAC) prevents cross-protocol attacks. Cryptoperiod limits key usage time to bound compromise impact.
- root key
- HSM-protected
- KEK
- Encrypts DEKs
- DEK
- Encrypts data
never leaves HSMenvelope encryptionshort-livedLifecycle and Transition
Key states: pre-activation, active, suspended, deactivated, destroyed. Rotation triggers: time-based, volume-based (one-time keys), and event-based (compromise). Key transition (crypto-agility) enables algorithm migration without disruption. Archive deactivated keys for decrypting historical data. Destroy keys securely (zero memory, destroy HSM keys). NIST SP 800-57 Part 1 covers general management; Part 2 covers import/export; Part 3 covers application-specific. Crypto-agility is essential for post-quantum migration.
- states
- Pre-act to destroyed
- rotation
- Time/volume/event
- agility
- Algorithm migration
lifecycletriggersPQ readiness