The service can generate key material within its own boundary using any supported algorithm, so that private key material is never exposed to the user.
Key Creation
CCC.KeyMgmt.CP08
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.TH05 | Keys are Created With Algorithms Not Permitted by Policy | Key creation accepts any supported algorithm and key length, so a key may be created with a curve or modulus that organizational policy or a regulatory baseline does not permit, such as a non-NIST curve or a modulus below the required size. Data or signatures protected by that key then rely on weaker cryptography than intended. Confidentiality and integrity of the protected data are reduced for the life of the ciphertext or signature. |
| CCC.KeyMgmt.TH06 | Key Material is Generated or Stored Outside a Hardware Security Module | Keys may be created with a software protection level instead of being generated and held in a validated hardware security module. Key material then exists in a form that can be extracted or copied by a compromised host or privileged operator. Confidentiality of every item protected by the key is lost if the material is exfiltrated. |