ISM unit 3 question bank answers 86-90

QUESTION NUMBER 86-90

86. Write a short note on key management policy. 

Each U.S. Government organization that manages cryptographic systems that are intended to protect sensitive information should base the management of those systems on an organizational policy
statement. The KMP3 is a high-level document that describes authorization and protection objectives and constraints that apply to the generation, distribution, accounting, storage, use, and destruction of cryptographic keying material.

1) Policy Content 
The Key Management Policy (KMP) is a high-level statement of organizational key management policies that includes authorization and protection objectives, and constraints that apply to the generation, distribution, accounting, storage, use, and destruction of cryptographic keying material. The policy document or documents that comprise the KMP will include high-level key management structure and responsibilities, governing standards and guidelines, organizational dependencies and other relationships, and security objectives. [Note that in a purely PKI environment, the KMP is usually a stand-alone document known as a Certificate Policy (CP).]
The scope of a KMP may be limited to the operation of a single PKI Certificate Authority (CA) and its supporting components4 , or to a symmetric point-to-point or single key center environment.5 Alternatively, the scope of a KMP may be the operations of a hierarchical PKI, bridged PKI, or multiple center symmetric key environment.

The KMP is used for a number of different purposes. The KMP is used to guide the development of KMPSs for each PKI CA or symmetric key management group that operates under its provisions. CAs from other organizations’ PKIs may review the KMP before crosscertification, and managers of symmetric key KMIs may review the KMP before joining new or existing multiple center groups. Auditors and accreditors will use the KMP as the basis for their reviews of PKI CA and/or symmetric key KMI operations. Application owners that are considering a PKI certificate source should review a KMP/CP to determine whether its certificates are appropriate for their applications.

1.1) General Policy Content Requirements
Although detailed formats are specified for some environments (e.g., See Appendix B for a PKI CP format), the policy documents into which key management information is inserted may vary from organization to organization. In general, the information should appear in a top-level organizational information systems policies and practices document. The policy need not always be elaborate. A degree of flexibility may be desirable with respect to actual organizational assignments and operations procedures in order to accommodate organizational and information infrastructure changes over time. However, the KMP needs to establish a policy foundation for the full set of key management functions.

 1.1.1) Security Objectives
A KMP should state the security objectives that are applicable to and expected to be supported by the KMI. The security objectives should include the identification of:

(a) The nature of the information to be protected (e.g., financial transactions, confidential information, critical process data);
(b) The classes of threats against which protection is required (e.g., the unauthorized modification of data, replay of communications, fraudulent repudiation of transactions, disclosure of information to unauthorized parties);
(c) The Federal Information Processing Standard 199 (FIPS 199) impact level which is determined by the consequences of a compromise of the protected information and/or processes (including sensitivity and perishability of the information);
(d) The cryptographic protection mechanisms to be employed (e.g., message authentication, digital signature, encryption);
(e) Protection requirements for cryptographic processes and keying material (e.g., tamperresistant processes, confidentiality of keying material); and
(f) Applicable statutes, and executive directives and guidance to which the KMI and its supporting documentation shall conform

1.1.2) Organizational Responsibilities
The KMP should identify key KMI management responsibilities and roles, including organizational contact information. The following classes of organizational responsibilities should be identified:

(a) Identification of the Keying Material Manager – Since the security of all material that is cryptographically protected depends on the security of the keying material employed, the ultimate responsibility for key management should reside at the executive level. The keying material manager should report directly to the organization’s Chief Information Officer (CIO). The keying material manager is a key employee who should have been determined to have the capabilities and trustworthiness that are commensurate with the responsibility for maintaining the authority and integrity of all formal, electronic transactions and the confidentiality of all information that is sufficiently sensitive to warrant cryptographic protection. Where public key cryptography is employed, either the keying material manager or his/her immediate superior should be designated as the organization’s certification authority.

(b) Identification of Infrastructure Entities and Roles - The key management policy document should identify organizational responsibilities for key KMI roles. The following roles (where applicable to the type and complexity of the infrastructure being established ) should be assigned:
(1) Central Oversight Authority (may be the Keying Material Manager)
(2) Certification Authorities (CAs)
(3) Registration Authorities (RAs)
(4) Overseers of operations (e.g., Key Processing Facility(ies), Service Agents)

(c) Basis for and Identification of Essential Key Management Roles – The KMP should also identify responsible organization(s), organization (not individual) contact information, and any relevant statutory or administrative requirements for the following functions:
(1) Key generation or acquisition;
(2) Agreements with partner organizations regarding the cross certification of keying material and/or key establishment, as appropriate;
(3) Key establishment and revocation tree design and management,
(4) Establishment of cryptoperiods;
(5) Distribution of and accounting for keying material;
(6) Protection of secret and private keys and related materials;
(7) Emergency and routine revocation of keying material;
(8) Auditing of keying material and related records;
(9) Destruction of revoked or expired keys;
(10) Key recovery;
(11) Compromise recovery;
(12) Contingency planning,
(13) Disciplinary consequences for the willful or negligent mishandling of keying material; and
(14) Generation, approval, and maintenance of key management practices statements.

1.1.3) Sample KMP Format
The sample format provided in this subsection is designed to be compatible with the Standard Format for PKI Certificate Policies (Appendix B). The sample format differs somewhat from that for PKI Certificate Policies (CPs) because some key management characteristics of and requirements for KMIs that accommodate symmetric keys differ from those for purely PKIbased KMIs. As stated above, variations among organizational structures and needs will necessarily result in variations in the form and content of policy documentation. The sample KMP format is provided as a general guide rather than as a mandatory template

(a) Introduction - 
The Introduction identifies and introduces the provisions of the policy document and indicates the security objectives and the types of entities and applications for which the KMP is targeted. This section has the following subsections: 1) Overview, 2) Identification, 3) Community and Applicability, and 4) Contact Details.

1)Overview - This subsection introduces the KMP.

2)Objectives – This subsection states the security objectives applicable to and expected to be supported by the KMI

3)Community and Applicability - This subsection identifies the types of entities that distribute keys or certificates. In the general case of the KMI, this will include the responsible entities identified in the “Identification of Infrastructure Entities and Roles”

4)Contact Details - This subsection includes the organization, telephone number, and mailing and/or network address of the Keying Material Manager.

(b) General Provisions – 
The General Provisions section of the KMP identifies any applicable policies regarding a range of legal and general practices topics. This section may contain subsections covering 1) obligations, 2) liability, 3) financial responsibility, 4) interpretation and enforcement, 5) fees, 6) publication and repositories, 7) compliance audit, 8) confidentiality, and 9) intellectual property rights. Each subcomponent may need to separately state the provisions applying to each KMI entity type (e.g., central oversight authority, key processing facility, service agent, client node, PKI CA, PKI repository, PKI RA, PKI subscriber, and/or PKI relying party )

1)Obligations - This subsection contains, for each entity type, any applicable policies regarding the entity's obligations to other entities. Such provisions may include: 1) Keying Material Manager and/or Central Oversight Authority obligations, 2) Key Processing Facility obligations, 3) Service Agent obligations, 4) CA and/or RA obligations (PKI), 4) User obligations (including Client Nodes and PKI subscribers and relying parties), and 5) Keying Material Repository obligations.

2)Liability - This subsection contains, for each entity type, any applicable policies regarding the apportionment of liability.

3)Financial Responsibility - This subsection contains, for key and/or certificate providers  any applicable policies regarding financial responsibilities, such as 1) the indemnification of KMI provider entity relying parties, 2) fiduciary relationships (or lack thereof) among the various entities; and 3) administrative processes (e.g., accounting, audit).

4)Financial Responsibility - This subsection contains, for key and/or certificate providers (e.g., key processing facilities, key distribution or translation centers, PKI CAs, key or certificate repositories, PKI RAs), any applicable policies regarding financial responsibilities, such as 1) the indemnification of KMI provider entity relying parties, 2) fiduciary relationships (or lack thereof) among the various entities; and 3) administrative processes (e.g., accounting, audit).

5)Fees - This subsection contains any applicable policies regarding interagency reimbursement or fees charged by key variable and/or certificate providers

6)Publication and Repositories - This subsection contains any applicable policies regarding 1) a key and/or certificate source’s obligations to publish information regarding its practices, its products (e.g., keys, certificates), and the current status of such products; 2) the frequency of publication; 3) access control on published information (e.g., policies, practice statements, key variables, certificates, key variable and/or certificate status, CRLs, CKLs); and 4) requirements pertaining to the use of repositories operated by private sector CAs or by other independent parties.

7)Compliance Audit - This subsection addresses any high-level policies regarding 1) the frequency of compliance audit for KMI entities, 2) the identity/qualifications of the auditor, 3) the auditor's relationship to the entity being audited, 4) topics covered under the compliance audit9 , 5) actions taken as a result of a deficiency found during compliance audit, 6) the dissemination of compliance audit results

8)Confidentiality Policy - This subsection states policies regarding 1) the types of information that shall be kept confidential by KMI entities, 2) the types of information that are not considered confidential, 3) the dissemination of reasons for revocation and suspension of certificates, 4) the release of information to law enforcement officials, 5) information that can be revealed as part of civil discovery, 6) the disclosure of keys or certificates by KMI entities at subscriber/user request; and 7) any other circumstances under which confidential information may be disclosed.

9)Intellectual Property Rights - This subsection addresses policies concerning the ownership rights of certificates, practice/policy specifications, names, and keys.

(c) Identification and Authentication –
The Identification and Authentication section describes circumstances and identifies any applicable regulatory authority and guidelines regarding the authentication of a certificate applicant or key variable requestor prior to the issuing of key(s) or certificate(s) by a keying material source. T

(d) Operational Requirements – 
The Operational Requirements section specifies policies regarding the imposition of requirements on KMI entities with respect to various operational activities

(e) Minimum Baseline Security Controls – 
This section states policies regarding management, operational, and technical security controls (i.e., physical, procedural, and personnel controls) used by KMI components to securely perform 1) key generation, 2) subject authentication, 3) key establishment/transfer and/or certificate issuance, 4) key and/or certificate revocation, 5) audit, and 6) archiving.

f) Cryptographic Key, Message Interchange, and/or Certificate Formats – 
This section is used to state policies specifying conformance to specific standards and/or guidelines regarding 1) key management architectures and/or protocols, 2) key management message formats, 3) certificate formats and/or 4) CRL/CKL formats.

(g) Specification and Administration – 
The “Specification Administration” section of the policy document specifies:
• What organization(s) has/have change control responsibility for the KMP,
• Publication and notification procedures for new versions, and
• KMPS approval procedures.


2) Policy Enforcement  
In order to be effective, key management policies shall be enforced, and policy implementation should be evaluated on a regular basis. Appendix C provides an evaluator’s checklist for the documentation and practices that implement key management policies.

Of course, evaluation requirements will vary with the size and complexity of an organization’s protected communications infrastructure. Each organization will need to determine its requirements based on the sensitivity of information being exchanged, the communications volume associated with sensitive or critical information and processes, personnel resources, the size and complexity of the organization or organizations supported, the variety and numbers of cryptographic devices and applications, the types of cryptographic devices and applications, and the scale and complexity of protected communications facilities


87. What are the security objectives of key management policy?

Security Objectives
A KMP should state the security objectives that are applicable to and expected to be supported by the KMI. The security objectives should include the identification of:

(a) The nature of the information to be protected (e.g., financial transactions, confidential information, critical process data);

(b) The classes of threats against which protection is required (e.g., the unauthorized modification of data, replay of communications, fraudulent repudiation of transactions, disclosure of information to unauthorized parties);

(c) The Federal Information Processing Standard 199 (FIPS 199) impact level which is determined by the consequences of a compromise of the protected information and/or processes (including sensitivity and perishability of the information);

(d) The cryptographic protection mechanisms to be employed (e.g., message authentication, digital signature, encryption);

(e) Protection requirements for cryptographic processes and keying material (e.g., tamperresistant processes, confidentiality of keying material); and

(f) Applicable statutes, and executive directives and guidance to which the KMI and its supporting documentation shall conform

The statement of security objectives will provide a basis and justification for other provisions of the KMP.


88. Explain the sample KMP format.

The sample format provided in this subsection is designed to be compatible with the Standard Format for PKI Certificate Policies (Appendix B). The sample format differs somewhat from that for PKI Certificate Policies (CPs) because some key management characteristics of and requirements for KMIs that accommodate symmetric keys differ from those for purely PKIbased KMIs.The sample KMP format is provided as a general guide rather than as a mandatory template.

(a) Introduction - 
The Introduction identifies and introduces the provisions of the policy document and indicates the security objectives and the types of entities and applications for which the KMP is targeted. This section has the following subsections: 1) Overview, 2) Identification, 3) Community and Applicability, and 4) Contact Details.

1) Overview: This subsection introduces the KMP.

2) Identification: Objectives – This subsection states the security objectives applicable to and expected to be supported by the KMI. The Objectives subsection should include the elements information

3) Community and Applicability; This subsection identifies the types of entities that distribute keys or certificates. In the general case of the KMI, this will include the responsible entities identified in the “Identification of Infrastructure Entities and Roles”

4) Contact Details: This subsection includes the organization, telephone number, and mailing and/or network address of the Keying Material Manager. This is the authority responsible for the registration, maintenance, and interpretation of the KMP.


(b) General Provisions – 
The General Provisions section of the KMP identifies any applicable policies regarding a range of legal and general practices topics. This section may contain subsections covering 1) obligations, 2) liability, 3) financial responsibility, 4) interpretation and enforcement, 5) fees, 6) publication and repositories, 7) compliance audit, 8) confidentiality, and 9) intellectual property rights. Each subcomponent may need to separately state the provisions applying to each KMI entity type (e.g., central oversight authority, key processing facility, service agent, client node, PKI CA, PKI repository, PKI RA, PKI subscriber, and/or PKI relying party).

1) obligations: This subsection contains, for each entity type, any applicable policies regarding the entity's obligations to other entities. Such provisions may include: 1) Keying Material Manager and/or Central Oversight Authority obligations, 2) Key Processing Facility obligations, 3) Service Agent obligations, 4) CA and/or RA obligations (PKI), 4) User obligations (including Client Nodes and PKI subscribers and relying parties), and 5) Keying Material Repository obligations.

2) liability:  This subsection contains, for each entity type, any applicable policies regarding the apportionment of liability (e.g., warranties and limitations on warranties, kinds of damages covered and disclaimers, loss limitations per certificate or per transaction, and other exclusions like acts of God)

3) financial responsibility: This subsection contains, for key and/or certificate providers (e.g., key processing facilities, key distribution or translation centers, PKI CAs, key or certificate repositories, PKI RAs), any applicable policies regarding financial responsibilities, such as 1) the indemnification of KMI provider entity relying parties, 2) fiduciary relationships (or lack thereof) among the various entities; and 3) administrative processes (e.g., accounting, audit)

4) interpretation and enforcement: This subsection contains any applicable policies regarding the interpretation and enforcement of the KMP or KMPS, addressing such topics as 1) governing law; 2) the severability of provisions, survival, merger, and notice; and 3) dispute resolution procedures

5) fees: This subsection contains any applicable policies regarding interagency reimbursement or fees charged by key variable and/or certificate providers (e.g., reimbursement for key center management, certificate issuance or renewal fees, a certificate access fee, revocation or status information access fee, reimbursement for information desk services, fees for other services such as policy information, refund policy).

6) publication and repositories: This subsection contains any applicable policies regarding 1) a key and/or certificate source’s obligations to publish information regarding its practices, its products (e.g., keys, certificates), and the current status of such products; 2) the frequency of publication; 3) access control on published information (e.g., policies, practice statements, key variables, certificates, key variable and/or certificate status, CRLs, CKLs); and 4) requirements pertaining to the use of repositories operated by private sector CAs or by other independent parties.

7) compliance audit:  This subsection addresses any high-level policies regarding 1) the frequency of compliance audit for KMI entities, 2) the identity/qualifications of the auditor, 3) the auditor's relationship to the entity being audited, 4) topics covered under the compliance audit9 , 5) actions taken as a result of a deficiency found during compliance audit, 6) the dissemination of compliance audit results.

8) confidentiality: This subsection states policies regarding 1) the types of information that shall be kept confidential by KMI entities, 2) the types of information that are not considered confidential, 3) the dissemination of reasons for revocation and suspension of certificates, 4) the release of information to law enforcement officials, 5) information that can be revealed as part of civil discovery, 6) the disclosure of keys or certificates by KMI entities at subscriber/user request; and 7) any other circumstances under which confidential information may be disclosed.

9) intellectual property rights.:This subsection addresses policies concerning the ownership rights of certificates, practice/policy specifications, names, and keys.


(c) Identification and Authentication –
The Identification and Authentication section describes circumstances and identifies any applicable regulatory authority and guidelines regarding the authentication of a certificate applicant or key variable requestor prior to the issuing of key(s) or certificate(s) by a keying material source. This section also includes policies regarding the authentication of parties requesting re-key or revocation. Where applicable, this section also addresses PKI naming practices, including name ownership recognition and name dispute resolution. This section of the KMP has the following subsections:

• Initial Registration,
• Routine Re-key,
• Re-key After Revocation, and
• Revocation Request.


(d) Operational Requirements –
The Operational Requirements section specifies policies regarding the imposition of requirements on KMI entities with respect to various operational activities. This section may address the following topics:
• Request for shared key variable relationship/Certificate application,
• Initial issuance of key encrypting keys and/or Certificate issuance,
• Acceptance of key variables and Certificates,
• Key and/or Certificate suspension and revocation,
• Security audit requirements,
• Records archiving,
• Key changeover (including re-keying, updating, re-derivation),
• Compromise and disaster recovery, and
• Key Center and/or CA Termination.

Within each topic, separate consideration may need to be given to each KMI entity class.


(e) Minimum Baseline Security Controls – 
This section states policies regarding management, operational, and technical security controls (i.e., physical, procedural, and personnel controls) used by KMI components to securely perform 1) key generation, 2) subject authentication, 3) key establishment/transfer and/or certificate issuance, 4) key and/or certificate revocation, 5) audit, and 6) archiving.


(f) Cryptographic Key, Message Interchange, and/or Certificate Formats – 
This section is used to state policies specifying conformance to specific standards and/or guidelines regarding 1) key management architectures and/or protocols, 2) key management message formats, 3) certificate formats and/or 4) CRL/CKL formats.


(g) Specification and Administration – 
The “Specification Administration” section of the policy document specifies:
• What organization(s) has/have change control responsibility for the KMP,
• Publication and notification procedures for new versions, and
• KMPS approval procedures.


89. Write a short note on Kerberos.

Kerberos is a network authentication protocol which utilizes symmetric cryptography to provide authentication for client-server applications.

Kerberos Standard Definition
Kerberos is defined in RFC 1510 – The Kerberos Network Authentication Service (V5)

Kerberos Architecture
The core of Kerberos architecture is the KDC (Key Distribution Server). The KDC stores authentication information and uses it to securely authenticate users and services.

This authentication is called secure because it:

• Does not appear as plaintext 
• Does not rely on authentication by the host operating system 
• Does not base trust on IP addresses 
• Does not require physical security of the network hosts

The KDC acts as a trusted third party in performing these authentication services.

Due to the critical function of the KDC, multiple KDCs are normally utilized. Each KDC stores a database of users, servers, and secret keys.


Kerberos client applications are normal network applications modified to use Kerberos for authentication. In Kerberos slang, they have been Kerberized.

How Kerberos Works
One of the problems that comes with using a network that requires authentication from the user–a username and password–is the fact that the password is sent over the network as plain text. So, the user types in the username and password, which might appear as asterisks, and then they hit enter to submit it. The password and username travel over the network as plain text. 

For someone looking to gain access to this information, it would not be too difficult to catch the password and username while en route through the network and use it to access the system. Kerberos allows for the password and username to be used without having to send them over the network. In other words, the network can be accessed, but the password and username don’t have to travel through it.


In a kerberized network, the kerberos database contains principles and their keys. All of the services are also stored on the kerberos database with their keys.


When a user wants to log in to the network, the principle is sent to the key distribution center (KDC). This is sent as a request for the ticket granting ticket (TGT). The request can be sent by a login program or by a kinit program.


If the KDC finds the principle in the database, it creates a TGT, encrypts it using the TGT, encrypts it using the user’s individual key and then sends it back to the user.


Once it [TGT] is received by the user, the login program decrypts the encrypted key. This TGT is stored in the credentials cache and expires after a certain amount of time. The time varies, but is typically around eight hours. This brings more security because when the TGT expires, access to the network expires as well (because a new TGT is needed).

The Kerberos Protocol
Kerberos defines ten messages that make up the Kerberos protocol:

• KRB_AS_REQ  : Kerberos Authentication Service Request 
• KRBAS_REP     : Kerberos Authentication Service Reply 
• KRB_AP_REQ : Kerberos Application Request 
• KRB_AP_REP  : Kerberos Application Reply 
• KRB_TGS_REQ: Kerberos Ticket Granting Service Request 
• KRB_TGS_REP : Kerberos Ticket Granting Service Reply 
• KRB_SAFE : Kerberos Safe (Checksummed) Application Message 
• KRB_PRIV : Kerberos Private (Encrypted) Application Message 
• KRB_CRED : Kerberos Credentiials 
• KRB_ERROR:Kerberos Erro 

90. List & explain the KMI components in detail.

Refer question number 85