Key creation accepts any supported algorithm and key length, so a key may be created with a curve or modulus that organizational policy or a regulatory baseline does not permit, such as a non-NIST curve or a modulus below the required size. Data or signatures protected by that key then rely on weaker cryptography than intended. Confidentiality and integrity of the protected data are reduced for the life of the ciphertext or signature.
Keys are Created With Algorithms Not Permitted by Policy
CCC.KeyMgmt.TH05
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CP01 | AES-256 | The service can create and use symmetric keys that implement the Advanced Encryption Standard (AES) with a 256-bit key for encryption and decryption. |
| CCC.KeyMgmt.CP02 | RSA-2048 | The service can create and use RSA keys with a 2048-bit modulus for encryption and digital signatures. |
| CCC.KeyMgmt.CP03 | RSA-3072 | The service can create and use RSA keys with a 3072-bit modulus for encryption and digital signatures. |
| CCC.KeyMgmt.CP04 | RSA-4096 | The service can create and use RSA keys with a 4096-bit modulus for encryption and digital signatures. |
| CCC.KeyMgmt.CP05 | EC-P256 | The service can create and use elliptic curve keys on the NIST P-256 curve for digital signatures. |
| CCC.KeyMgmt.CP06 | EC-P256K | The service can create and use elliptic curve keys on the secp256k1 curve for digital signatures. |
| CCC.KeyMgmt.CP07 | EC-P384 | The service can create and use elliptic curve keys on the NIST P-384 curve for digital signatures. |
| CCC.KeyMgmt.CP08 | Key Creation | The service can generate key material within its own boundary using any supported algorithm, so that private key material is never exposed to the user. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CN06 | Restrict Key Algorithms to the Approved List | Ensure that every key created in the service uses an algorithm and key length permitted by organizational cryptographic policy. |