Key Management Cheat Sheet / 密钥管理速查表

Introduction / 介绍

This Key Management Cheat Sheet provides developers with guidance for implementation of cryptographic key management within an application in a secure manner. It is important to document and harmonize rules and practices for:

本密钥管理速查表为开发者提供了在应用程序中以安全方式实施加密密钥管理的指导。记录和协调以下规则和实践非常重要：

1. Key life cycle management (generation, distribution, destruction)
   中文：密钥生命周期管理（生成、分发、销毁）
2. Key compromise, recovery and zeroization
   中文：密钥泄露、恢复和零化
3. Key storage
   中文：密钥存储
4. Key agreement
   中文：密钥协商

General Guidelines and Considerations / 一般指南和考虑因素

Formulate a plan for the overall organization's cryptographic strategy to guide developers working on different applications and ensure that each application's cryptographic capability meets minimum requirements and best practices.

制定一个整体组织的加密策略计划，以指导不同应用程序的开发者，并确保每个应用程序的加密能力满足最低要求和最佳实践。

Identify the cryptographic and key management requirements for your application and map all components that process or store cryptographic key material.

识别您应用程序的加密和密钥管理需求，并映射所有处理或存储加密密钥材料的组件。

Key Selection / 密钥选择

Selection of the cryptographic and key management algorithms to use within a given application should begin with an understanding of the objectives of the application.

在给定应用程序中使用加密和密钥管理算法的选择应从理解应用程序的目标开始。

For example, if the application is required to store data securely, then the developer should select an algorithm suite that supports the objective of data at rest protection security. Applications that are required to transmit and receive data would select an algorithm suite that supports the objective of data in transit protection.

例如，如果应用程序需要安全地存储数据，则开发人员应选择支持静态数据保护安全目标的算法套件。需要传输和接收数据的应用程序应选择支持传输数据保护目标的算法套件。

We have provided recommendations on the selection of crypto suites within an application based on application and security objectives. Application developers oftentimes begin the development of crypto and key management capabilities by examining what is available in a library.

我们已经根据应用程序和安全目标提供了在应用程序中选择加密套件的建议。应用程序开发人员通常通过检查库中可用的内容开始开发加密和密钥管理功能。

However, an analysis of the real needs of the application should be conducted to determine the optimal key management approach. Begin by understanding the security objectives of the application which will then drive the selection of cryptographic protocols that are best suited. For example, the application may require:

然而，应分析应用程序的实际需求，以确定最佳密钥管理方法。首先，理解应用程序的安全目标，这将驱动选择最适合的加密协议。例如，应用程序可能需要：

1. Confidentiality of data at rest and confidentiality of data in transit.
   中文：静态数据的机密性和传输数据的机密性。
2. Authenticity of the end device.
   中文：终端设备的真实性。
3. Authenticity of data origin.
   中文：数据源的真实性.
4. Integrity of data in transit.
   中文：传输中数据完整性.
5. Keys to create the data encryption keys.
   中文：创建数据加密密钥的密钥.

Once the understanding of the security needs of the application is achieved, developers can determine what protocols and algorithms are required. Once the protocols and algorithms are understood, you can begin to define the different types of keys that will support the application's objectives.

一旦理解了应用程序的安全需求，开发者可以确定所需的协议和算法。一旦理解了协议和算法，就可以开始定义支持应用程序目标的不同类型的密钥。

There are a diverse set of key types and certificates to consider, for example:

需要考虑多种密钥类型和证书，例如：

1. Encryption: Symmetric encryption keys, Asymmetric encryption keys (public and private).
   中文：加密：对称加密密钥，非对称加密密钥（公钥和私钥）。
2. Authentication of End Devices: Pre-shared symmetric keys, Trusted certificates, Trust Anchors.
   中文：终端设备的认证： 预共享对称密钥，受信任证书，信任锚点.
3. Data Origin Authentication: HMAC.
   中文：数据来源认证: HMAC.
4. Integrity Protection: Message Authentication Codes (MACs).
   中文：完整性保护: 消息认证码 (MACs).
5. Key Encryption Keys.
   中文：密钥加密密钥.

Algorithms and Protocols / 算法和协议

According to NIST SP 800-57 Part 1, many algorithms and schemes that provide a security service use a hash function as a component of the algorithm.

根据NIST SP 800-57 Part 1，许多提供安全服务的算法和方案使用哈希函数作为算法的组成部分。

Hash functions can be found in digital signature algorithms (FIPS186), Keyed-Hash Message Authentication Codes (HMAC) (FIPS198), key-derivation functions/methods (NIST Special Publications (SP) 800-56A, 800-56B, 800-56C and 800-108), and random number generators (NIST SP 800-90A). Approved hash functions are defined in FIPS180.

哈希函数可以在数字签名算法（FIPS186）、密钥哈希消息认证码（HMAC）（FIPS198）、密钥派生函数/方法（NIST 特别出版物 (SP) 800-56A, 800-56B, 800-56C 和 800-108）以及随机数生成器（NIST SP 800-90A）中找到。批准的哈希函数在FIPS180中定义。

NIST SP 800-57 Part 1 recognizes three basic classes of approved cryptographic algorithms: hash functions, symmetric- key algorithms and asymmetric-key algorithms. The classes are defined by the number of cryptographic keys that are used in conjunction with the algorithm.

NIST SP 800-57 Part 1认可了三种基本的批准加密算法类别：哈希函数、对称密钥算法和非对称密钥算法。这些类别是通过算法中使用的加密密钥数量来定义的。

The NSA released a report, Commercial National Security Algorithm Suite 2.0 which lists the cryptographic algorithms that are expected to remain strong even with advances in quantum computing.

国家安全局发布了一份报告，商业国家网络安全算法套件 2.0，其中列出了即使在量子计算进步的情况下仍预计保持强大的加密算法。

Cryptographic hash functions / 加密哈希函数

Cryptographic hash functions do not require keys. Hash functions generate a relatively small digest (hash value) from a (possibly) large input in a way that is fundamentally difficult to reverse (i.e., it is hard to find an input that will produce a given output). Hash functions are used as building blocks for key management, for example,

加密哈希函数不需要密钥。哈希函数从（可能）大的输入中生成一个相对较小的摘要（哈希值），其方式在本质上难以逆向（即，很难找到一个输入可以产生给定的输出）。哈希函数用作密钥管理的构建块，例如，

1. To provide data authentication and integrity services (Section 4.2.3) – the hash function is used with a key to generate a message authentication code.
   中文：提供数据认证和完整性服务（第 4.2.3 节）——使用密钥与哈希函数一起生成消息认证码。
2. To compress messages for digital signature generation and verification (Section 4.2.4).
   中文：压缩消息以生成和验证数字签名（第 4.2.4 节）。
3. To derive keys in key-establishment algorithms (Section 4.2.5).
   中文：在密钥建立算法中推导密钥（第4.2.5节）
4. To generate deterministic random numbers (Section 4.2.7).
   中文：生成确定性的随机数（第4.2.7节）

Symmetric-key algorithms / 对称密钥算法

Symmetric-key algorithms (sometimes known as secret-key algorithms) transform data in a way that is fundamentally difficult to undo without knowledge of a secret key. The key is "symmetric" because the same key is used for a cryptographic operation and its inverse (e.g., encryption and decryption).

对称密钥算法（有时也称为密钥算法）以一种基本难以撤销的方式转换数据，除非知道密钥。密钥被称为“对称”是因为相同的密钥用于加密操作及其逆操作（例如，加密和解密）

Symmetric keys are often known by more than one entity; however, the key shall not be disclosed to entities that are not authorized access to the data protected by that algorithm and key. Symmetric key algorithms are used, for example,

对称密钥通常被多个实体所知；然而，密钥不得向未经授权访问该算法和密钥保护的数据的实体泄露。对称密钥算法被用于，例如

1. To provide data confidentiality (Section 4.2.2); the same key is used to encrypt and decrypt data.
   中文：提供数据机密性（第4.2.2节）；相同的密钥用于加密和解密数据。
2. To provide authentication and integrity services (Section 4.2.3) in the form of Message Authentication Codes (MACs); the same key is used to generate the MAC and to validate it. MACs normally employ either a symmetric key-encryption algorithm or a cryptographic hash function as their cryptographic primitive.
   中文：提供认证和完整性服务（第4.2.3节），以消息认证码（MAC）的形式；相同的密钥用于生成MAC并验证它。MAC通常使用对称密钥加密算法或密码散列函数作为其密码学原语。
3. As part of the key-establishment process (Section 4.2.5).
   中文：作为密钥建立过程的一部分（第4.2.5节）。
4. To generate deterministic random numbers (Section 4.2.7).
   中文：生成确定性的随机数（第4.2.7节）

Asymmetric-key algorithms / 非对称密钥算法

Asymmetric-key algorithms, commonly known as public-key algorithms, use two related keys (i.e., a key pair) to perform their functions: a public key and a private key. The public key may be known by anyone; the private key should be under the sole control of the entity that "owns" the key pair. Even though the public and private keys of a key pair are related, knowledge of the public key does not reveal the private key. Asymmetric algorithms are used, for example,

非对称密钥算法，通常称为公钥算法，使用两个相关密钥（即密钥对）来执行其功能：一个公钥和一个私钥。公钥可以由任何人知道；私钥应仅由拥有该密钥对的实体控制。尽管密钥对中的公钥和私钥相关联，但公钥的知识并不能揭示私钥。非对称算法用于，例如，

1. To compute digital signatures (Section 4.2.4).
   中文：计算数字签名（第4.2.4节）。
2. To establish cryptographic keying material (Section 4.2.5).
   中文：建立加密密钥材料（第4.2.5节）。
3. To generate random numbers (Section 4.2.7).
   中文：生成随机数（第4.2.7节）。

Message Authentication Codes (MACs) / 消息认证码（MAC）

Message Authentication Codes (MACs) provide data authentication and integrity. A MAC is a cryptographic checksum on the data that is used in order to provide assurance that the data has not changed and that the MAC was computed by the expected entity.

消息认证码（MAC）提供数据认证和完整性。MAC是对数据的加密校验和，用于确保数据未发生变化，并且MAC是由预期的实体计算的。

Although message integrity is often provided using non-cryptographic techniques known as error detection codes, these codes can be altered by an adversary to effect an action to the adversary's benefit. The use of an approved cryptographic mechanism, such as a MAC, can alleviate this problem.

尽管通常使用称为错误检测码的非加密技术来提供消息完整性，但这些代码可以被对手篡改以实现对其有利的行动。使用经过批准的加密机制，如MAC，可以减轻这个问题。

In addition, the MAC can provide a recipient with assurance that the originator of the data is a key holder (i.e., an entity authorized to have the key). MACs are often used to authenticate the originator to the recipient when only those two parties share the MAC key.

此外，MAC可以为接收者提供保证，即数据的发起者是密钥持有者（即有权拥有该密钥的实体）。MAC通常用于在只有这两个当事人共享MAC密钥的情况下，对发起者进行身份验证。

Digital Signatures / 数字签名

Digital signatures) （数字签名） are used to provide authentication, integrity and non-repudiation. Digital signatures are used in conjunction with hash functions and are computed on data of any length (up to a limit that is determined by the hash function).

FIPS186 specifies algorithms that are approved for the computation of digital signatures.

FIPS186规定了用于计算数字签名的批准算法。

Key Encryption Keys / 密钥加密密钥

Symmetric key-wrapping keys are used to encrypt other keys using symmetric-key algorithms. Key-wrapping keys are also known as key encrypting keys.

对称密钥封装密钥用于使用对称密钥算法加密其他密钥。密钥封装密钥也称为密钥加密密钥。

Key Strength / 密钥强度

Review NIST SP 800-57 (Recommendation for Key Management) for recommended guidelines on key strength for specific algorithm implementations. Also, consider these best practices:

请查阅NIST SP 800-57（密钥管理推荐）以获取针对特定算法实现推荐的密钥强度指南。同时，考虑以下最佳实践：

1. Establish what the application's minimum computational resistance to attack should be. Understanding the minimum computational resistance to attack should take into consideration the sophistication of your adversaries, how long data needs to be protected, where data is stored and if it is exposed. Identifying the computational resistance to attack will inform engineers as to the minimum length of the cryptographic key required to protect data over the life of that data. Consult NIST SP 800-131a for additional guidance on determining the appropriate key lengths for the algorithm of choice.
   中文：确定应用程序对攻击的最小计算抵抗力。理解最小计算抵抗力时，应考虑对手的复杂程度、数据需要保护的时间长度、数据存储的位置以及是否暴露。确定计算抵抗力将告知工程师为保护数据在其整个生命周期内所需的最小密钥长度。参考NIST SP 800-131a获取确定所选算法适当密钥长度的额外指导。
2. When encrypting keys for storage or distribution, always encrypt a cryptographic key with another key of equal or greater cryptographic strength.
   中文：在加密用于存储或分发的密钥时，始终使用同等或更高计算强度的另一个密钥来加密密钥。
3. When moving to Elliptic Curve-based algorithms, choose a key length that meets or exceeds the comparative strength of other algorithms in use within your system. Refer to NIST SP 800-57 Table 2.
   中文：当迁移到基于椭圆曲线算法时，选择一个密钥长度，使其与系统中使用的其他算法的相对强度相当。请参考 NIST SP 800-57 表 2。
4. Formulate a strategy for the overall organization's cryptographic strategy to guide developers working on different applications and ensure that each application's cryptographic capability meets minimum requirements and best practices.
   中文：制定整个组织的加密策略策略，以指导在不同应用程序上工作的开发者，并确保每个应用程序的加密能力满足最低要求和最佳实践。

Memory Management Considerations / 内存管理注意事项

Keys stored in memory for a long time can become "burned in". This can be mitigated by splitting the key into components that are frequently updated. NIST SP 800-57).

长时间存储在内存中的密钥可能会变得“烧蚀”。这可以通过将密钥分成经常更新的组件来缓解。（NIST SP 800-57）。

Loss or corruption of the memory media on which keys and/or certificates are stored, and recovery planning, according to NIST SP 800-57.

根据NIST SP 800-57，计划处理存储密钥和/或证书的内存媒体丢失或损坏的情况，以及恢复计划。

Plan for the recovery from possible corruption of the memory media necessary for key or certificate generation, registration, and/or distribution systems, subsystems, or components as recommended in NIST SP 800-57.

根据NIST SP 800-57的建议，计划从可能损坏的内存媒体中恢复，这些媒体对于密钥或证书的生成、注册和/或分发系统、子系统或组件是必要的。

Perfect Forward Secrecy / 完美前向安全性

Ephemeral keys) （临时密钥） can provide perfect forward secrecy protection, which means a compromise of the server's long term signing key does not compromise the confidentiality of past sessions. Refer to TLS cheat sheet.

Key Usage / 密钥用途

According to NIST, in general, a single key should be used for only one purpose (e.g., encryption, authentication, key wrapping, random number generation, or digital signatures).

根据NIST的规定，通常情况下，单个密钥应仅用于单一目的（例如，加密、认证、密钥封装、随机数生成或数字签名）

There are several reasons for this:

存在几个原因：

1. The use of the same key for two different cryptographic processes may weaken the security provided by one or both of the processes.
   中文：使用同一密钥进行两种不同的加密过程可能会削弱其中一个或两个过程提供的安全性。
2. Limiting the use of a key limits the damage that could be done if the key is compromised.
   中文：限制密钥的使用可以限制密钥泄露可能造成的损害。
3. Some uses of keys interfere with each other. For example, the length of time the key may be required for each use and purpose. Retention requirements of the data may differ for different data types.
   中文：某些密钥的使用可能会相互干扰。例如，每个使用和目的可能需要的密钥长度。不同数据类型的数据保留要求可能不同。

Cryptographic Module Topics / 加密模块主题

According to NIST SP 800-133, cryptographic modules are the set of hardware, software, and/or firmware that implements security functions (including cryptographic algorithms and key generation) and is contained within a cryptographic module boundary to provide protection of the keys.

根据NIST SP 800-133，加密模块是包含在加密模块边界内的一组硬件、软件和/或固件，它实现了安全功能（包括加密算法和密钥生成）并提供了密钥的保护。

All cryptographic operations (such as key generation, encryption, decryption, and digital signing) should be performed inside the isolated cryptographic security module boundary so that plaintext key material is never exposed outside the module (OWASP Application Security Verification Standard (ASVS) 5.0 §13.3.3). For higher-assurance deployments (such as OWASP ASVS 5.0 Level 3), applications should use hardware-backed modules, such as a Hardware Security Module (HSM) or Trusted Platform Module (TPM), to significantly reduce the risk of key extraction or compromise in software memory.

所有加密操作（如密钥生成、加密、解密和数字签名）应在隔离的加密安全模块边界内执行，以确保明文密钥材料永远不会暴露在模块外部（OWASP 应用安全验证标准 (ASVS) 5.0 §13.3.3）。对于更高保证的部署（如OWASP ASVS 5.0级别3），应用程序应使用硬件支持模块，例如硬件安全模块 (HSM)或可信平台模块（TPM），以显著降低密钥提取或软件内存中密钥泄露的风险。

Key Management Lifecycle Best Practices / 密钥管理生命周期最佳实践

Generation / 生成

Cryptographic keys shall be generated within cryptographic module with at least a FIPS 140-2 or 140-3 compliance. For explanatory purposes, consider the cryptographic module in which a key is generated to be the key-generating module.

加密密钥应在符合至少FIPS 140-2或140-3的加密模块内生成。为了说明目的，考虑密钥生成的加密模块为密钥生成模块。

Any random value required by the key-generating module shall be generated within that module; that is, the Random Bit Generator that generates the random value shall be implemented within cryptographic module with at least a FIPS 140-2 or 140-3 compliance that generates the key.

密钥生成模块所需的任何随机值都应在该模块内生成；也就是说，生成随机值的随机比特生成器应实现为至少符合FIPS 140-2或140-3的加密模块，该模块生成密钥。

Hardware cryptographic modules are preferred over software cryptographic modules for protection.

硬件加密模块比软件加密模块更受保护。

Distribution / 分发

The generated keys shall be transported (when necessary) using secure channels and shall be used by their associated cryptographic algorithm within at least a FIPS 140-2 or 140-3 compliant cryptographic modules. For additional detail for the recommendations in this section refer to NIST Special Paper 800-133.

生成的密钥（如有必要）应通过安全通道传输，并在至少符合FIPS 140-2或140-3规范的加密模块中由其关联的加密算法使用。关于本节中推荐的详细信息，请参阅NIST特别论文800-133。

Storage / 存储

1. Cryptographic keys, secrets, and API keys should never be committed to source code repositories or embedded in build artifacts (such as binaries, container images, or configuration files). Secrets and keys should be stored in a dedicated secrets-management solution or key vault (OWASP ASVS 5.0 §13.3.1).
   中文：加密密钥、机密信息和API密钥绝不应提交到源代码仓库或嵌入到构建工件（如二进制文件、容器镜像或配置文件）中。机密信息和密钥应存储在专用的机密管理解决方案或密钥库中（OWASP ASVS 5.0 §13.3.1）。
2. Developers must understand where cryptographic keys are stored within the application. Understand what memory devices the keys are stored on.
   中文：开发者必须了解加密密钥在应用程序中的存储位置。了解密钥存储在哪些内存设备上。
3. Keys must be protected on both volatile and persistent memory, ideally processed within secure cryptographic modules.
   中文：密钥必须在易失性和持久性内存中受到保护，理想情况下在安全的加密模块中处理。
4. Keys should never be stored in plaintext format.
   中文：密钥绝不应以明文格式存储。
5. Ensure all keys are stored in a cryptographic vault, such as a hardware security module (HSM) or isolated cryptographic service.
   中文：确保所有密钥都存储在加密保险库中，例如硬件安全模块 (HSM)或隔离的加密服务。
6. If you are planning on storing keys in offline devices/databases, then encrypt the keys using Key Encryption Keys (KEKs) prior to the export of the key material. KEK length (and algorithm) should be equivalent to or greater in strength than the keys being protected.
   中文：如果您计划在离线设备/数据库中存储密钥，则在导出密钥材料之前，应使用密钥加密密钥（KEKs）加密密钥。KEK长度（和算法）应与受保护的密钥的强度相当或更高。
7. Ensure that keys have integrity protections applied while in storage (consider dual purpose algorithms that support encryption and Message Code Authentication (MAC)).
   中文：确保在存储期间对密钥应用完整性保护（考虑支持加密和消息代码认证（MAC）的双重用途算法）。
8. Ensure that standard application level code never reads or uses raw cryptographic keys in any way and use key management libraries.
   中文：确保标准应用程序级代码永远不会以任何方式读取或使用原始加密密钥，并使用密钥管理库。
9. Ensure that keys and cryptographic operations are done inside the sealed vault.
   中文：确保在密封保险库内进行密钥和加密操作。
10. All work should be done in the vault (such as key access, encryption, decryption, signing, etc).

For a more complete guide to storing sensitive information such as keys, see the Secrets Management Cheat Sheet.

Cryptoperiods and Rotation

A cryptoperiod is the time span during which a specific cryptographic key is authorized for use. Limiting cryptoperiods restricts the amount of data protected by a single key and reduces the window of exposure if a key is compromised (NIST SP 800-57 Part 1 Rev. 5 Section 5.3). For storage-level rotation fundamentals and criteria, see the Cryptographic Storage Cheat Sheet.

Representative cryptoperiods vary depending on the algorithm, key strength, operational environment, threat model, and sensitivity of the protected data. Organizations should define cryptoperiods through risk assessment in accordance with NIST SP 800-57 Part 1 Rev. 5.

• Rotation Schedule: Establish and document a key rotation schedule based on the system's threat model and risk assessment (OWASP ASVS 5.0 §13.1.4, §13.3.4).
  中文：轮换计划：根据系统的威胁模型和风险评估建立并记录密钥轮换计划（OWASP ASVS 5.0 §13.1.4，§13.3.4）。
• Representative Cryptoperiod Examples:
  • Symmetric Data Encryption Keys: Originator usage (encrypting new data) should be capped at up to 2 years for general low-volume applications, or on the order of a day or a week for high-volume or link-encryption systems (NIST SP 800-57 Part 1 Rev. 5 §5.3.6, item 6(b)). Recipient usage (decryption) should typically be limited to no more than 3 years beyond the originator usage period.
    中文：对称数据加密密钥：发起者使用（加密新数据）应限制在最多2年，适用于通用低流量应用程序，或对于高流量或链路加密系统，通常为一天或一周。接收者使用（解密）通常应限制在发起者使用期之后不超过3年（NIST SP 800-57 第1部分修订版5 §5.3.6，项目6(b)）。
  • TLS/HTTPS Server Keys and Certificates: Plan certificate renewal around the validity limits in the CA/Browser Forum Baseline Requirements §6.3.2. Set key-replacement schedules separately; renewing a certificate does not necessarily replace its key pair.
    中文：TLS/HTTPS 服务器密钥和证书：围绕证书有效期限制在 CA/Browser 论坛基准要求 §6.3.2 计划证书续订。单独设置密钥替换计划；续订证书不一定替换其密钥对。
  • Asymmetric Key Pairs: Operational cryptoperiods depend on key usage (NIST SP 800-57 Part 1 Rev. 5 Table 1 & §5.3.6):
    中文：非对称密钥对：操作加密周期取决于密钥使用情况 (NIST SP 800-57 第1部分修订5 表1 & §5.3.6)：
    • Digital Signature Keys: Private signing keys typically have an originator cryptoperiod of 1 to 3 years; public signature verification keys may be retained longer to verify archived signed data.
    • Key Establishment Keys: Static key-agreement pairs typically have an originator cryptoperiod of up to 1 to 2 years; ephemeral pairs are used for a single key-agreement transaction.
• Usage-Based Rotation Limits: Key rotation must account for usage volume in addition to calendar time. For example, when using Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) with random 96-bit initialization vectors (IVs), limit each key to at most 2^32 (4,294,967,296) encryption operations across all devices sharing that key to limit IV-collision risk (NIST SP 800-38D §8.3).
  中文：基于使用的轮换限制：密钥轮换必须考虑使用量，而不仅仅是日历时间。例如，在使用高级加密标准在伽罗瓦/计数模式 (AES-GCM) 中，与随机的96位初始化向量 (IVs) 结合时，限制每个密钥在所有共享该密钥的设备上最多执行 2^32 (4,294,967,296) 次加密操作，以限制 IV 冲突风险 (NIST SP 800-38D §8.3)。
• Handling Existing Encrypted Data (Envelope Encryption): To retire a Key Encryption Key (KEK), re-wrap stored Data Encryption Keys (DEKs) under the replacement KEK before destroying the old one. Rewrapping leaves the DEKs unchanged and does not reset their cryptoperiods or usage limits. Replacing a DEK for existing ciphertext requires re-encrypting that data. Managed services may retain old wrapping-key versions automatically; check the provider's rotation behavior. For key IDs and data-migration choices, see the Cryptographic Storage Cheat Sheet.
  中文：处理现有加密数据（信封加密）：要退役密钥加密密钥 (KEK)，在销毁旧密钥之前，使用替换 KEK 重新包装存储的数据加密密钥 (DEK)。重新包装不会更改 DEK，也不会重置其加密周期或使用限制。为现有密文替换 DEK 需要重新加密该数据。托管服务可能会自动保留旧包装密钥版本；检查提供商的 轮换行为。有关密钥 ID 和数据迁移选择，请参阅 加密存储速查表。
• Automated Rotation: Prefer automated key rotation using Key Management Services (KMS) or automated certificate management protocols (such as Automated Certificate Management Environment (ACME)) to reduce operational error and ensure timely updates.
• Manual Rotation Logging: When manual key rotation is required, rotation events should be logged with the timestamp, operator identity, and management authorization reference.

Escrow and Backup

Data that has been encrypted with lost cryptographic keys will never be recovered. Therefore, it is essential that the application incorporate a secure key backup capability, especially for applications that support data at rest encryption for long-term data stores.

When backing up keys, ensure that the database that is used to store the keys is encrypted using at least a FIPS 140-2 or 140-3 validated module. It is sometimes useful to escrow key material for use in investigations and for re-provisioning of key material to users in the event that the key is lost or corrupted.

Never escrow keys used for performing digital signatures, but consider the need to escrow keys that support encryption. Oftentimes, escrow can be performed by the Certificate Authority (CA) or key management system that provisions certificates and keys, however in some instances separate APIs must be implemented to allow the system to perform the escrow for the application.

Accountability and Audit

Accountability involves the identification of those that have access to, or control of, cryptographic keys throughout their lifecycles. Accountability can be an effective tool to help prevent key compromises and to reduce the impact of compromises once they are detected.

Enforce the principle of least privilege for all key and secret assets (OWASP ASVS 5.0 §13.3.2). Access to cryptographic keys, key management interfaces, and secret material should be restricted strictly to authorized roles, services, and workloads with a verified operational need.

Although it is preferred that no humans are able to view keys, as a minimum, the key management system should account for all individuals who are able to view plaintext cryptographic keys.

In addition, more sophisticated key-management systems may account for all individuals authorized to access or control any cryptographic keys, whether in plaintext or ciphertext form.

Accountability provides three significant advantages:

1. It aids in the determination of when the compromise could have occurred and what individuals could have been involved.
2. It tends to protect against compromise, because individuals with access to the key know that their access to the key is known.
3. It is very useful in recovering from a detected key compromise to know where the key was used and what data or other keys were protected by the compromised key.

Certain principles have been found to be useful in enforcing the accountability of cryptographic keys. These principles might not apply to all systems or all types of keys.

Some of the principles that apply to long-term keys controlled by humans include:

适用于由人类控制的长期密钥的原则包括：

1. Uniquely identifying keys.
   中文：唯一标识密钥。
2. Identifying the key user.
   中文：识别密钥用户。
3. Identifying the dates and times of key use, along with the data that is protected.
   中文：识别密钥的使用日期和时间，以及受保护的数据。
4. Identifying other keys that are protected by a symmetric or private key.
   中文：识别由对称密钥或私钥保护的其它密钥。

Two types of audit should be performed on key management systems:

应在密钥管理系统上执行两种类型的审计：

1. The security plan and the procedures that are developed to support the plan should be periodically audited to ensure that they continue to support the Key Management Policy (NIST SP 800-57 Part 2).
   中文：支持该计划的安全计划和程序应定期审计，以确保它们继续支持密钥管理策略（NIST SP 800-57 第2部分）。
2. The protective mechanisms employed should be periodically reassessed with respect to the level of security that they provide and are expected to provide in the future, and that the mechanisms correctly and effectively support the appropriate policies.
   中文：采用的防护机制应定期重新评估其提供的和预期将提供的安全级别，以及这些机制是否正确有效地支持适当的策略。

New technology developments and attacks should be taken into consideration. On a more frequent basis, the actions of the humans that use, operate and maintain the system should be reviewed to verify that the humans continue to follow established security procedures.

新技术发展和攻击应予以考虑。更频繁地，应审查使用、操作和维护系统的用户的行为，以验证用户是否继续遵循既定的安全程序。

Strong cryptographic systems can be compromised by lax and inappropriate human actions. Highly unusual events should be noted and reviewed as possible indicators of attempted attacks on the system.

强加密系统可能因宽松和不适当的人类行为而被破坏。应记录并审查高度异常事件，作为系统可能遭受攻击尝试的可能指标。

Key Compromise and Recovery / 密钥泄露与恢复

The compromise of a key has the following implications:

密钥泄露有以下影响：

1. In general, the unauthorized disclosure of a key used to provide confidentiality protection (i.e., via encryption) means that all information encrypted by that key could be exposed or known by unauthorized entities. The disclosure of a Certificate of Authorities's private signature key means that an adversary can create fraudulent certificates and Certificate Revocation Lists (CRLs).
   中文：一般来说，用于提供保密性保护（即通过加密）的密钥的非授权披露意味着所有由该密钥加密的信息都可能被未授权实体暴露或知晓。披露证书颁发机构的私有签名密钥意味着对手可以创建欺诈性证书和证书吊销列表（CRL）。
2. A compromise of the integrity of a key means that the key is incorrect - either that the key has been modified (either deliberately or accidentally), or that another key has been substituted; this includes a deletion (non-availability) of the key. The substitution or modification of a key used to provide integrity calls into question the integrity of all information protected by the key. This information could have been provided by, or changed by, an unauthorized entity that knows the key. The substitution of a public or secret key that will be used (at a later time) to encrypt data could allow an unauthorized entity (who knows the decryption key) to decrypt data that was encrypted using the encryption key.
   中文：密钥完整性的泄露意味着密钥是错误的——要么密钥已被修改（故意或意外），要么被替换了另一个密钥；这包括密钥的删除（不可用）。用于提供完整性的密钥的替换或修改质疑了由该密钥保护的所有信息的完整性。这些信息可能已被知晓密钥的未授权实体提供或更改。替换用于（以后）加密数据的公钥或密钥可能允许知晓解密密钥的未授权实体解密使用加密密钥加密的数据。
3. A compromise of a key's usage or application association means that the key could be used for the wrong purpose (e.g., for key establishment instead of digital signatures) or for the wrong application, and could result in the compromise of information protected by the key.
   中文：密钥的使用或应用关联的泄露意味着密钥可能被用于错误的目的（例如，用于密钥建立而不是数字签名）或用于错误的应用，可能导致密钥保护的信息泄露。
4. A compromise of a key's association with the owner or other entity means that the identity of the other entity cannot be assured (i.e., one does not know who the other entity really is) or that information cannot be processed correctly (e.g., decrypted with the correct key).
   中文：密钥与所有者或其他实体的关联泄露意味着无法保证其他实体的身份（即，不知道其他实体真正是谁）或无法正确处理信息（例如，使用正确的密钥解密）。
5. A compromise of a key's association with other information means that there is no association at all, or the association is with the wrong "information". This could cause the cryptographic services to fail, information to be lost, or the security of the information to be compromised. Certain protective measures may be taken in order to minimize the likelihood or consequences of a key compromise. Similar effect as ransomware, except that you can't pay the ransom and get the key back.
   中文：密钥与其其他信息的关联被破坏意味着根本不存在关联，或者关联错误地指向了“其他信息”。这可能导致加密服务失败、信息丢失或信息安全受到损害。可以采取某些保护措施以最大限度地减少密钥泄露的可能性或后果。与勒索软件有类似的效果，只不过你无法支付赎金来恢复密钥。

The following procedures are usually involved:

以下通常是涉及到的程序：

1. Limiting the amount of time a symmetric or private key is in plaintext form.
   中文：限制对称密钥或私钥以明文形式存在的时长。
2. Preventing humans from viewing plaintext symmetric and private keys.
   中文：防止人类查看明文形式的对称密钥和私钥。
3. Restricting plaintext symmetric and private keys to physically protected containers. This includes key generators, key-transport devices, key loaders, cryptographic modules, and key-storage devices.
   中文：将明文形式的对称密钥和私钥限制在物理保护的容器中。这包括密钥生成器、密钥传输设备、密钥加载器、加密模块和密钥存储设备。
4. Using integrity checks to ensure that the integrity of a key or its association with other data has not been compromised. For example, keys may be wrapped (i.e., encrypted) in such a manner that unauthorized modifications to the wrapping or to the associations will be detected.
   中文：使用完整性检查来确保密钥或其与其他数据的完整性没有被破坏。例如，密钥可能被封装（即加密），这样就可以检测到对封装或关联的未授权修改。
5. Employing key confirmation (see NIST SP 800-57 Part 1 Section 4.2.5.5) to help ensure that the proper key was, in fact, established.
   中文：采用密钥确认（参见NIST SP 800-57第1部分第4.2.5.5节）以确保确实建立了正确的密钥。
6. Establishing an accountability system that keeps track of each access to symmetric and private keys in plaintext form.
   中文：建立一个责任制度，以跟踪对称密钥和私钥以明文形式访问的每一次。
7. Providing a cryptographic integrity check on the key (e.g., using a MAC or a digital signature).
   中文：在密钥上提供加密完整性检查（例如，使用MAC或数字签名）。
8. The use of trusted timestamps for signed data. i. Destroying keys as soon as they are no longer needed.
   中文：使用受信任的时间戳对签名数据进行处理。i. 一旦密钥不再需要，立即销毁密钥。
9. Creating a compromise-recovery plan, especially in the case of a CA compromise.
   中文：创建妥协恢复计划，特别是在CA妥协的情况下。

A compromise-recovery plan is essential for restoring cryptographic security services in the event of a key compromise. A compromise-recovery plan shall be documented and easily accessible.

妥协恢复计划对于在密钥妥协的情况下恢复加密安全服务至关重要。妥协恢复计划应予以记录，并易于访问。

The compromise-recovery plan should contain:

妥协恢复计划应包含：

1. The identification and contact info of the personnel to notify.
   中文：通知人员的身份和联系方式。
2. The identification and contact info of the personnel to perform the recovery actions.
   中文：执行恢复操作人员的身份和联系方式。
3. The re-key method.
   中文：重新生成密钥的方法。
4. An inventory of all cryptographic keys and their use (e.g., the location of all certificates in a system).
   中文：所有加密密钥及其用途的清单（例如，系统中所有证书的位置）
5. The education of all appropriate personnel on the recovery procedures.
   中文：对所有适当人员进行恢复程序的培训
6. An identification and contact info of all personnel needed to support the recovery procedures.
   中文：所有需要支持恢复程序的人员的识别和联系方式
7. Policies that key-revocation checking be enforced (to minimize the effect of a compromise).
   中文：实施密钥撤销检查的政策（以最小化泄露的影响）
8. The monitoring of the re-keying operations (to ensure that all required operations are performed for all affected keys).
   中文：监控密钥重置操作（以确保对所有受影响密钥执行所有必需的操作）
9. Any other recovery procedures, which may include:
   中文：任何其他恢复程序，可能包括：
   1. Physical inspection of the equipment.
      中文：设备的物理检查
   2. Identification of all information that may be compromised as a result of the incident.
      中文：识别由于事件可能被泄露的所有信息
   3. Identification of all signatures that may be invalid, due to the compromise of a signing key.
      中文：识别所有可能因签名密钥泄露而无效的签名
   4. Distribution of new keying material, if required.
      中文：如有需要，分发新的密钥材料

Zeroization and Destruction / 零化与销毁

Destruction is the final state in the cryptographic key lifecycle. Key management policies should account for the lifecycle key states described in NIST SP 800-57 Part 1 Rev. 5 Section 7 (such as pre-activation, active, suspended, deactivated, compromised, and destroyed).

销毁是密码学密钥生命周期的最终状态。密钥管理策略应考虑NIST SP 800-57 第1部分 第5版第7节中描述的生命周期密钥状态（例如预激活、活动、暂停、停用、泄露和销毁）

Revoke compromised keys promptly and stop using them to protect new data. Retain only tightly controlled access needed for recovery or migration of previously protected data. Destroy all copies of secret and private keys, including backup, archived, escrowed, and memory copies, as soon as they are no longer needed for decryption or recovery and retention requirements are satisfied. Public verification keys may be retained to verify archived signatures (NIST SP 800-57 Part 1 Rev. 5 Sections 7.5 and 8.3.4–8.3.5).

及时吊销泄露的密钥并停止使用它们来保护新数据。仅保留用于恢复或迁移先前受保护数据的严格控制访问权限。一旦不再需要用于解密或恢复以及满足保留要求，应立即销毁所有秘密和私有密钥的副本，包括备份、存档、托管和内存副本。公共验证密钥可以保留以验证存档签名(NIST SP 800-57 第1部分 第5版第7.5节和第8.3.4-8.3.5节)

• Cryptographic Erasure: For encrypted key material at rest, consider cryptographic erasure only when all copies of the protecting keys can be destroyed and no recoverable plaintext copies of the target material remain (NIST SP 800-88 Rev. 2 Section 3.2). Destroying a wrapping key does not erase plaintext copies of the keys it protected.
  中文：加密擦除：对于静态加密密钥材料，只有在所有保护密钥的副本都可以销毁且没有可恢复的明文目标材料副本时，才考虑加密擦除 (NIST SP 800-88 修订2 第3.2节)。销毁包装密钥不会擦除其保护的密钥的明文副本。
• Software Memory: Overwriting key material is best-effort in managed runtimes, where copies can survive in garbage-collected memory, immutable strings, or swapped-out pages. Use platform secure-memory or zeroization APIs where available; see Protecting Secrets in Memory.
  中文：软件内存：在管理运行时中覆盖密钥材料是尽力而为的，因为副本可能存在于垃圾回收的内存、不可变字符串或交换出的页面中。如有可用，请使用平台安全内存或零化API；参见保护内存中的机密
• Hardware Security Modules (HSMs): Use vendor-supplied zeroize or destroy commands to zeroize key material stored in volatile memory and non-volatile HSM storage.
  中文：硬件安全模块(HSMs)：使用供应商提供的零化或销毁命令来零化存储在易失性内存和非易失性HSM存储中的密钥材料
• Physical Media: Physically destroy obsolete storage media or cryptographic tokens containing key material in accordance with organizational sanitization standards.
  中文：物理介质：根据组织的数据清理标准，物理销毁过时的存储介质或包含密钥材料的加密令牌

Trust Stores / 信任存储

1. Design controls to secure the trust store against injection of third-party root certificates. The access controls are managed and enforced on an entity and application basis.
   中文：设计控制措施以保护信任存储免受第三方根证书注入。访问控制将在实体和应用程序层面上进行管理和执行。
2. Implement integrity controls on objects stored in the trust store.
   中文：在信任存储中存储的对象上实施完整性控制。
3. Do not allow for export of keys held within the trust store without authentication and authorization.
   中文：不允许未经身份验证和授权从信任存储中导出密钥。
4. Setup strict policies and procedures for exporting key material from applications to network applications and other components.
   中文：为从应用程序导出密钥材料到网络应用程序和其他组件设置严格的政策和程序。
5. Implement a secure process for updating the trust store.
   中文：实施一个安全的更新信任存储的过程。

Cryptographic Key Management Libraries / 加密密钥管理库

Use only reputable crypto libraries that are well maintained and updated, as well as tested and validated by third-party organizations (e.g., NIST/FIPS).

仅使用由第三方组织（例如NIST/FIPS）维护良好、更新、测试和验证的知名加密库。

References / 参考

• NIST SP 800-57 Part 1 Rev. 5: Recommendation for Key Management) （NIST SP 800-57 第1部分 第5版：密钥管理推荐）
• NIST SP 800-38D: Galois/Counter Mode (GCM) and GMAC
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization) （NIST SP 800-88 Rev. 2: 媒体清理指南）