BS 7205:1990 pdf free download.Procedures for Key management to achieve security for financial institutions engaged in financial transactions (wholesale).
BS 7205 describes procedures for the secure management of the secret cryptographic keys used to protect messages in a wholesale banking environment, for instance messages between banks. or between a bank and a corporate customer, or a hank and a government.
Key management is the process whereby cryptographic keys and initialisation vectors (keying material) are provided for use by two parties and continue to be subject to secure handling procedures until they have been destroyed. The security of the data enciphered by means of keying material is dependent upon the prevention of unauthorised disclosure, modification, substitution, insertion or deletion of keys or initialisation vectors (IVa). If these are compromised the security of the related data can no longer be ensured. Thus, key management is concerned with the generation, distribution, storage, custody, monitoring, destruction, and back-up procedures for keying material. Also, by the formalisation of such procedures provision is made for audit trails to be established.
Automated key distribution is the electronic transmission of cryptographic keys (and, where needed, IVa) via a communication channel. Automated key distribution utilises two types of keys:
1) Key Enciphering Keys: used to encipher and decipher other keys.
2) Data keys: used to encipher and decipher initialisation vectors (Wa). to authenticate Cryptographic
Service Messages, and to encipher/decipher or authenticate data.
Since key management facility(s) can be designed to replace electronically distributed Key Enciphering Keys and data keys automatically, manual intervention is kept to a minimum. Key Enciphering Keys generally have longer cryptoperiods than data keys.
The level of security to be achieved needs to be related to a number of factors, including the sensitivity of the data concerned and the likelihood that it will be intercepted, the practicality of any envisaged encipherment process, and the cost of providing. and breaking, a particular means of providing security. It is therefore necessary for each communicating pair to agree the extent and detail of security and key management procedures. Absolute security is not practically achievable so key management procedures need not only to aim to reduce the opportunity for a breach of security but also to aim for a “high” probability of detection of any illicit access or change to keying material that may occur despite any preventative measures. This applies at all stages of the generation, exchange and use of keying material, including those processes that occur in cryptographic equipment and those related to communication of cryptographic keys and initialisation vectors between communicating pairs or key centres. Thus, whilst wherever possible this International Standard has specified requirements in absolute terms, in some instances a level of subjectivity cannot be practically avoided. For instance, defining the frequency of key change is beyond the scope of this standard, and will be dependent upon the degree of risk associated with
8 Despatch of manually distributed keying material
All documents accompanying manually distributed keying material shall be prepared prior to the generation of the keying material. BS 7205 shall include:
a) A receipt for the keying material for signature by the recipient.
b) Details of the recipient.
c) Details of any passwords required for access to material distributed on magnetic storage media or other secure storage devices (eg key loaders).
d) Where a courier service is used, a receipt for signature by the courier.
e) Details of the date of generation of keying material, together with details of the issuer and the issue date.
All such documentation shall he signed by authorised signatories.
Once keying material has been generated (see 6.1), access to key components shall be controlled by the processes of dual control and split knowledge. Each key component shall be placed in a separate envelope which is sealed in such a manner that any subsequent unauthorised interference can be detected. Each envelope shall be marked to indicate its contents and the address of the appropriate function, and then placed in a second, separate, envelope that is sealed, and addressed to the recipient. The second envelope shall give no indication of its contents.
NOTE Each psckagv thus consiats of an outer envelope with a single inner envelope containing a single key component.
The individual components of a key shall be despatched. together with a receipt using a method to ensure separate despatch. for example. on different days. Any passwords required for access to magnetic storage media or other storage devices. eg key loaders, shall be despatched separately from the medium or device. Where keying material is transported by mail then a secure method shall be used. Where delivery is by means of courier a receipt shall be obtained from the courier by the sender. The courier shall not be aware of the nature of the contents of an envelope,
9 Receipt of manually distributed keying material
Upon receipt of a package containing a key component the recipient shall examine the innermost envelope in order to check, so far as is possible, that access to its contents has not been attempted or achieved. If it is suspected that the security of the inner envelope has been compromised the sender shall be advised immediately, The signatures on the accompanying documentation shall be checked by the recipient for authenticity. The identity of the key components. eg sequence number or effective date, shall be recorded. When the recipient of the key component is satisfied with the authenticity of the key component the receipt that accompanied it shall be signed and returned (see also 7.2.2). Keys shall be placed in secure storage immediately upon receipt. Inner envelopes (ie those containing the key components) shall be retained under appropriate control (see clause 7).
12.2.3 Management of Cryptographic Service Messages (see Table 1)
When a recipient receives a Cryptographic Service Message whose count equals the expected (stored) count, the message shall he accepted. Both the originator’s counter and recipient’s reception counter shall be incremented by one prior to the next message.
Where the counts do not match a log record shall be made. When the recipient receives a Cryptographic Service Message whose count is greater than the expected (stored) count, the message shall be accepted. The recipient’s reception count shall be set to the received count plus one. This will he the new expected count.
When a recipient receives a Cryptographic Service Message whose count is less than the expected (stored) count, the message shall he rejected and an error shall be reported to the originator. The recipient shall return an Error Service Message in which the nature of the error being reported (count error), the value of the reception counter [the recipient’s expected (stored) count] and the value of the count as received in the related Cryptographic Service Message, shall be included.
NOTE The count as received may be uaed to identify the Cryptographic Service Message which contained the counter in error.
The originator, upon receipt of the Error Service Message shall either:
a) adjust his origination counter up to the expected count value returned in the Error Service Message, or b) establish a new (*)KK with the recipient and also reset the value of the associated counters to one.