How to interpret specific NIST 800-57 cryptoperiod advice?

Question

We are uncertain how to interpret a specific piece of NIST 800-57 - to wit, how long a symmetric key cryptoperiod should be when originator usage and recipient usage begin concurrently. The short version is, it's unclear whether the cryptoperiod can extend three years past the termination of originator-usage regardless of when recipient-usage began, or if the maximum cryptoperiod is the same as the maximum recipient-usage period if originator-usage and recipient-usage begin concurrently.

The Setup

Sensitive data is being encrypted using symmetric keys. Data is in active use, so as soon as originator-usage of the key begins, recipient-usage must necessarily begin as well.

The Problem

The symmetric encryption key is rotated regularly, such that one key is in originator-usage (e.g., encrypting new data) and multiple keys are in recipient-usage (e.g., decrypting existing data) at any given time. However, as per NIST 800-57, keys cannot remain in recipient-usage indefinitely. Our problem, then, is determining when we must terminate recipient-usage of a key and perform a somewhat costly re-encryption of all data using the obsoleted key (as described in NIST 800-57 5.3.5, "If the required security life exceeds the cryptoperiod, then the protection will need to be reapplied using a new key.")

NIST 800-57 is a Maze of Twisty Little Cryptoperiods, All Different

There are a number of statements in NIST 800-57 which touch on this issue, and it leaves enough ambiguity that we've been arguing about it for a while :). Allow me to lay out the various statements and the interpretations we're assigning them. If, after that, you can help me understand when we have to get our keys out of this cave.

5.3.5, page 48 - "The (total) “cryptoperiod” of a symmetric key is the period of time from the beginning of the originator-usage period to the end of the recipient-usage period, although the originator-usage period has historically been used as the cryptoperiod for the key." (emphasis mine)

5.3.5.b, page 49 - "When a symmetric key is used to protect stored information, the originator-usage period (when the originator applies cryptographic protection to stored information) may end much earlier than the recipient-usage period (when the stored information is processed). In this case, the cryptoperiod begins at the initial time authorized for the application of protection with the key, and ends with the latest time authorized for processing using that key." (emphasis mine)

5.3.6.6.b, page 52 - "An encryption key used to encrypt smaller volumes of information might have an originator-usage period of up to one month." There is a minor ambiguity introduced here in that 5.3.6.6.b says the maximum OUP (Originator Usage Period) for symmetric data encryption keys is 1 month, but table 1 on 56 which summarizes this section says the maximum OUP for symmetric data encryption keys is 2 year. We're simply assuming the table is authoritative over the text in this case, as we believe it matches real-world usage better.

5.3.6.6.b, page 52 - "A maximum recipient-usage period of 3 years beyond the end of the originator-usage period is recommended." (emphasis mine) Here is the crucial ambiguity - this section implies that the maximum cryptoperiod is reached by extending the RUP (Recipient Usage Period) a fixed time beyond the end of the OUP, instead of having the RUP extend a fixed time beyond the beginning of the RUP, regardless of how much overlap there is with the OUP. Did the countdown start at the beginning of the RUP, or at the end of the OUP?

The Choices

So - presuming that, for symmetric data encryption keys, let's use a 6 month OUP (which is permitted as per Table 1) - the two choices are:

1. Total cryptoperiod is 3 years (<=6month OUP, <=3year RUP which fully overlaps with OUP)
2. Total cryptoperiod is 3.5 years (<=6month OUP, "<=OUP + 3 years" RUP, consistent with phrase "maximum recipient-usage period of 3 years beyond the end of the originator usage period")

The Answer

Any light you can shed is appreciated. Are we missing some definition which resolves whether the max RUP is an absolute, or whether it's relative to termination of the OUP?

Answer 1

Interesting question and I hope this helps a little in terms of my experience of seeing this implemented...

keyA is valid for 2 years

Data encrypted with keyA is flagged as having been encrypted by index number of keyA

For decryption operations keyA is used

After 2 years keyB is used to encrypt new data

Data encrypted with keyA is decrypted when accessed using keyA but is updated and re-encrypted using keyB following use

Gradually all regularly used data encrypted with keyA becomes encrypted with keyB over time (between end of OUP and end of RUP)

Data encrypted with keyA at the end of the RUP is either not required and should be discarded or can be updated through decryption using keyA and re-encrypting using keyB

Essentially the above means the OUP cryptoperiod is 2 years and the OUP key is retired. It is not discarded as it is still required for decryption operations until the end of the RUP. What this really means in practice is that you can keep multiple keys alive and avoid running full decrypt/encrypt operations on the entire dataset.