We are uncertain how to interpret a specific piece of NIST 800-57 - to wit, how long a symmetric key cryptoperiod should be when originator usage and recipient usage begin concurrently. The short version is, it's unclear whether the cryptoperiod can extend three years past the termination of originator-usage regardless of when recipient-usage began, or if the maximum cryptoperiod is the same as the maximum recipient-usage period if originator-usage and recipient-usage begin concurrently.
Sensitive data is being encrypted using symmetric keys. Data is in active use, so as soon as originator-usage of the key begins, recipient-usage must necessarily begin as well.
The symmetric encryption key is rotated regularly, such that one key is in originator-usage (e.g., encrypting new data) and multiple keys are in recipient-usage (e.g., decrypting existing data) at any given time. However, as per NIST 800-57, keys cannot remain in recipient-usage indefinitely. Our problem, then, is determining when we must terminate recipient-usage of a key and perform a somewhat costly re-encryption of all data using the obsoleted key (as described in NIST 800-57 5.3.5, "If the required security life exceeds the cryptoperiod, then the protection will need to be reapplied using a new key.")
NIST 800-57 is a Maze of Twisty Little Cryptoperiods, All Different
There are a number of statements in NIST 800-57 which touch on this issue, and it leaves enough ambiguity that we've been arguing about it for a while :). Allow me to lay out the various statements and the interpretations we're assigning them. If, after that, you can help me understand when we have to get our keys out of this cave.
5.3.5, page 48 - "The (total) “cryptoperiod” of a symmetric key is the period of time from the beginning of the originator-usage period to the end of the recipient-usage period, although the originator-usage period has historically been used as the cryptoperiod for the key." (emphasis mine)
5.3.5.b, page 49 - "When a symmetric key is used to protect stored information, the originator-usage period (when the originator applies cryptographic protection to stored information) may end much earlier than the recipient-usage period (when the stored information is processed). In this case, the cryptoperiod begins at the initial time authorized for the application of protection with the key, and ends with the latest time authorized for processing using that key." (emphasis mine)
184.108.40.206.b, page 52 - "An encryption key used to encrypt smaller volumes of information might have an originator-usage period of up to one month." There is a minor ambiguity introduced here in that 220.127.116.11.b says the maximum OUP (Originator Usage Period) for symmetric data encryption keys is 1 month, but table 1 on 56 which summarizes this section says the maximum OUP for symmetric data encryption keys is 2 year. We're simply assuming the table is authoritative over the text in this case, as we believe it matches real-world usage better.
18.104.22.168.b, page 52 - "A maximum recipient-usage period of 3 years beyond the end of the originator-usage period is recommended." (emphasis mine) Here is the crucial ambiguity - this section implies that the maximum cryptoperiod is reached by extending the RUP (Recipient Usage Period) a fixed time beyond the end of the OUP, instead of having the RUP extend a fixed time beyond the beginning of the RUP, regardless of how much overlap there is with the OUP. Did the countdown start at the beginning of the RUP, or at the end of the OUP?
So - presuming that, for symmetric data encryption keys, let's use a 6 month OUP (which is permitted as per Table 1) - the two choices are:
- Total cryptoperiod is 3 years (<=6month OUP, <=3year RUP which fully overlaps with OUP)
- Total cryptoperiod is 3.5 years (<=6month OUP, "<=OUP + 3 years" RUP, consistent with phrase "maximum recipient-usage period of 3 years beyond the end of the originator usage period")
Any light you can shed is appreciated. Are we missing some definition which resolves whether the max RUP is an absolute, or whether it's relative to termination of the OUP?