|
|
| (26 intermediate revisions by 5 users not shown) |
| Line 1: |
Line 1: |
| − | = DRAFT CHEAT SHEET - WORK IN PROGRESS = | + | __NOTOC__ |
| − | = Introduction = | + | <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div> |
| − | This Key Management Cheat Sheet provides developers with guidance for implementation of cryptographic key management within application in a secure manner.
| |
| | | | |
| − | = Key Management General Guidelines and Considerations =
| + | The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]! |
| | | | |
| − | == Algorithm Selection ==
| + | Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html Key Management Cheat Sheet] to see the latest version of the cheat sheet. |
| − | | |
| − | | |
| − | | |
| − | Selection of the cryptographic and key management algorithms to use within a given application should begin with an understanding of the objectives of the application. For example, if the application is required to store data securely, then the developer should select an algorithm suite that supports the objective of Data-At-Rest (DAR) security. Applications that are required to transmit and receive data would select an algorithm suite that supports the objective of Data-in-Transit security. We have provided recommendations on the selection of crypto suites within an application based on application and security objectives.
| |
| − | | |
| − | <table>
| |
| − | <tr>
| |
| − | </tr>
| |
| − | | |
| − | == Key Strength ==
| |
| − | | |
| − | === Selecting ===
| |
| − | | |
| − | === Enforcing ===
| |
| − | | |
| − | === Maintaining ===
| |
| − | | |
| − | == Memory Management Considerations ==
| |
| − | | |
| − | == Perfect Forward Secrecy ==
| |
| − | | |
| − | == Proxy Handling ==
| |
| − | | |
| − | = Key Management Lifecycle Best Practices =
| |
| − | | |
| − | == Generation ==
| |
| − | | |
| − | == Distribution ==
| |
| − | | |
| − | === EndPoint Authentication ===
| |
| − | | |
| − | === Algorithms and Protools ===
| |
| − | | |
| − | === Integrity and Confidentiality ===
| |
| − | | |
| − | == Storage ==
| |
| − | | |
| − | === Software-based Storage ===
| |
| − | | |
| − | === Hardware Storage ===
| |
| − | | |
| − | == Escrow and Backup ==
| |
| − | | |
| − | === Key Escrow ===
| |
| − | | |
| − | === Key Backup ===
| |
| − | | |
| − | == Tracking and Audit ==
| |
| − | | |
| − | == Key Compromise and Recovery ==
| |
| − | | |
| − | = Trust Stores =
| |
| − | | |
| − | == Population ==
| |
| − | | |
| − | == Secure Update ==
| |
| − | | |
| − | = Cryptographic Module Topics =
| |
| − | | |
| − | = Standards =
| |
| − | | |
| − | = Cryptographic Key Management Libraries =
| |
| − | | |
| − | | |
| − | | |
| − | This article is focused on providing application security testing professionals with a guide to assist in managing cryptographic keys.
| |
| − | | |
| − | = Authors and Primary Editors =
| |
| − | | |
| − | Brian Russell - russellbri[at]leidos.com<br/>
| |
| − | | |
| − | Drew Van Duren - drew.f.van.duren[at]leidos.com
| |
| − | | |
| − | = Other Cheatsheets =
| |
| − | | |
| − | {{Cheatsheet_Navigation}}
| |
| − | | |
| − | [[Category:Cheatsheets]]
| |
| − | | |
| − | {{OWASP Builders}}
| |
