I am using an application of which in its privacy policy it has been stated the they use generally accepted standards to protect data. They encrypt data on their servers.
So, what is/are the "generally accepted standard(s)" for key management?
$\begingroup$
$\endgroup$
Add a comment
|
$\begingroup$
$\endgroup$
There are some agreed as universal, but then some might disagree it's generally accepted:
- ISO 27001/27002 land, as it's generally accepted standard for data protection, too. It has a section on key management, based around bloody obvious goals: cryptographic keys have to be protected against modification, loss, destruction and leakage. It requires system to have certain procedures around key management:
- key generation
- certificates of public key generation
- key distribution/activation procedures
- key storage and authenticated key access
- key change procedure
- working with leaked keys, key revocation, etc.
- business continuity goals (what if revoked keys protected unique data)
- ... I certainly forgot something here, haven't touched the standard in years, but aforementioned procedures are really important even outside ISO formalism.
- NIST has this beautiful document, which can be accounted as a standard in some circles.
- Some time ago, I've been asked to write a novice-friendly blog post about typical key management procedures you modern app developer may want to understand. It also somehow outlines the generally accepted standard measures for key management and protection, yet I've tried to make explanations as simple and accessible as possible.
