2

To encrypt the database in the organization, I think it is better to use symmetric key encryption.

According to what I've researched from NIST paper.

Cryptoperiod: The originator-usage period recommended for the encryption of large volumes of information over a short period of time (e.g., for link encryption) is on the order of a day or a week. An encryption key used to encrypt smaller volumes of information might have an originator-usage period of up to two years. A maximum recipient-usage period of three years beyond the end of the originator-usage period is recommended.

but I couldn't find information on how to manage key in such a way that once the originator-usage period has expired, the database can still get decrypted as the recipient-usage period is longer. I don't really get the concept here since it is "symmetric" encryption key, how is it possible make it become decryptable but not encryptable. Could anyone explain or provide me with a resource of information? Thank you in advance.

1

I couldn't find information on how to manage key in such a way that once the originator-usage period has expired, the database can still get decrypted as the recipient-usage period is longer.

Quite simply, when they say "usage period", they mean "period during which you will use the key this way." They are not suggesting that you alter the key, only the way you use it.

To quote NIST SP 800-57 "Recommendation for Key Management"

A symmetric key shall not be used to provide protection after the end of the originator-usage period

They are not asking you to destroy the key, merely to stop using it to encrypt data at the end of the OUP. You will also need to stop using the key to decrypt data at the end of the RUP, which implies that by the end of the RUP you have re-encrypted any data with a newer key which you will use instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.