Crypto / Key / Controls / v2026.11
Restrict Key Algorithms to the Approved List
CCC.KeyMgmt.CN06 · Encryption
Ensure that every key created in the service uses an algorithm and key length permitted by organizational cryptographic policy.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.KeyMgmt.CP01 | AES-256 | The service can create and use symmetric keys that implement the Advanced Encryption Standard (AES) with a 256-bit key for encryption and decryption. |
| CCC.KeyMgmt.CP02 | RSA-2048 | The service can create and use RSA keys with a 2048-bit modulus for encryption and digital signatures. |
| CCC.KeyMgmt.CP03 | RSA-3072 | The service can create and use RSA keys with a 3072-bit modulus for encryption and digital signatures. |
| CCC.KeyMgmt.CP04 | RSA-4096 | The service can create and use RSA keys with a 4096-bit modulus for encryption and digital signatures. |
| CCC.KeyMgmt.CP05 | EC-P256 | The service can create and use elliptic curve keys on the NIST P-256 curve for digital signatures. |
| CCC.KeyMgmt.CP06 | EC-P256K | The service can create and use elliptic curve keys on the secp256k1 curve for digital signatures. |
| CCC.KeyMgmt.CP07 | EC-P384 | The service can create and use elliptic curve keys on the NIST P-384 curve for digital signatures. |
| CCC.KeyMgmt.CP08 | Key Creation | The service can generate key material within its own boundary using any supported algorithm, so that private key material is never exposed to the user. |
| CCC.Core.CP01 | Encryption in Transit Enabled by Default | The service automatically encrypts all data using industry-standard cryptographic protocols prior to transmission via a network interface. |
| CCC.Core.CP02 | Encryption at Rest Enabled by Default | The service automatically encrypts all data using industry-standard cryptographic protocols prior to being written to a storage medium. |
| CCC.Core.CP35 | Customer-Managed Encryption Keys | The service may be configured to encrypt data at rest using a key that the user creates and controls in a key management service, instead of a key managed by the provider. |
Related Threats
| ID | Title | Description |
|---|
| CCC.KeyMgmt.TH05 | Keys are Created With Algorithms Not Permitted by Policy | Key creation accepts any supported algorithm and key length, so a key may be created with a curve or modulus that organizational policy or a regulatory baseline does not permit, such as a non-NIST curve or a modulus below the required size. Data or signatures protected by that key then rely on weaker cryptography than intended. Confidentiality and integrity of the protected data are reduced for the life of the ciphertext or signature. |
| CCC.Core.TH18 | Encryption Key is Misused | Encryption keys may be used by an unauthorized entity due to inadequate key management practices or the compromise of a connected system. This could lead to the decryption of sensitive data, impacting its confidentiality and integrity. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.KeyMgmt.CN06.AR01 | When a key is created, its algorithm and key length MUST be on the organization's approved list. | tlp-clear, tlp-green, tlp-amber, tlp-red |