Cryptography – SSP Zeroization

You are here: Technology Topics » Computer & Gadgets » Computer & Network Security » Cryptography » Cryptography – SSP Zeroization

This post is part of the Computer Security – Cryptography posts series.

A module shall provide methods to zeroize all CSPs (including temporarily stored values) within the module.

Once a CSP is zeroized, the CSP shall not be retrievable from the module. Zeroization of PSPs, encrypted CSPs, or CSPs otherwise physically or logically protected within an additional embedded validated module (meeting the requirements of this standard) is not required at levels below Security Level 5.

Keys used only to perform pre-operational self-tests shall be considered as PSPs. Hash values of passwords that, if known, would be subject to an off-line exhaustion attack shall be considered as CSPs. RBG state information shall be considered a CSP.

Documentation shall specify the CSP zeroization method(s) employed by a module and the rationale as to why the method(s) prevent the retrieval and reuse the zeroized CSPs.
Temporary CSPs (e.g., ephemeral keys) shall be zeroized when they are no longer in use.

SECURITY LEVELS 1 AND 2

The zeroization of CSPs may be performed procedurally, and independent of the module’s control. For example, the operator executes the destruction of the module (e.g., reformatting of a hard drive, the atmospheric destruction of a module during reentry).

SECURITY LEVEL 3

The cryptographic module shall control the zeroization of the CSPs.

SECURITY LEVEL 4
There are no additional requirements for Security Level 4.

SECURITY LEVEL 5

The following security requirements shall be met:

• A module shall provide methods to zeroize all PSPs (including temporarily stored values) within the module.
• Documentation shall specify the PSP zeroization methods employed by a module and the rationale as to why the methods prevent the retrieval and reuse of the zeroized data.
• Temporary PSPs shall be zeroized when they are no longer needed.



7 Responses to “Cryptography – SSP Zeroization”

1. Kincaid says:

   What is the MAC class in Java?
2. admin says:

   The MAC class is the least complicated of the core classes of the java.security package that use keys. In general, the MAC class only uses a single secret key and no algorithm parameters.
3. Ross says:

   How to generate Secret Keys ?
4. admin says:

   If you use java for cryptography , then you can use the KeyGenerator class, which is responsible for generating secret keys. For generating public/private keys use KeyPairGenerator.
5. John T says:

   What are the largest (by revenue) cryptography companies ?
6. Rico says:

   RSA Security
   Crypto AG
   PGP Corporation
   NTRU Cryptosystems, Inc.
   Cryptography Research, Inc
   Cryptomathic
   C2net
   SlySoft
7. Alex says:

   Also IBM and Hewlett-Packard are lining up to develop and provide key recovery services as part of the electronic security solutions
8. Ken says:

   interesting post
9. P. Silva says:

   a very good article about Cryptography – SSP Zeroization