Keys may be created with a software protection level instead of being generated and held in a validated hardware security module. Key material then exists in a form that can be extracted or copied by a compromised host or privileged operator. Confidentiality of every item protected by the key is lost if the material is exfiltrated.
Key Material is Generated or Stored Outside a Hardware Security Module
CCC.KeyMgmt.TH06
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CP08 | Key Creation | The service can generate key material within its own boundary using any supported algorithm, so that private key material is never exposed to the user. |
| CCC.KeyMgmt.CP13 | FIPS 140 Level 3 Hardware Security Modules | The service can generate and store keys in hardware security modules validated to FIPS 140-2 Level 3 or FIPS 140-3 Level 3, so that key material never exists in plaintext outside the module. |
| CCC.KeyMgmt.CP22 | Key Import | The service can import key material generated outside the service, wrapped under a service-provided wrapping key, so that it can be used as a managed key. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CN07 | Require HSM Protection for Key Material | Ensure that key material is generated and held only inside validated hardware security modules. |