Insufficient validation during the key-import process may allow weak, back-doored, or otherwise compromised key material to be introduced, reducing the overall strength of subsequent cryptographic operations.
Weak or Compromised Key Material is Imported
CCC.KeyMgmt.TH04
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CP22 | Key Import | The service can import key material generated outside the service, wrapped under a service-provided wrapping key, so that it can be used as a managed key. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CN04 | Validate Imported Keys | Accept only externally generated keys that meet approved cryptographic strength and provenance requirements. |