# Presentation: 318925

## Security Model Working Group

- TACDFIPSFKMI - WG 2
- October 15, 1997

## Primary Security Components

- General System Requirements
- End User Product Requirements
- Key Recovery Agent Security
- Registration Agent Security
- APKS Security

## General System

**General Requirements**
- Confidentiality
- Keys should not be disclosed unduly.
- Policy
- It must be possible to decide if, when, where, and how escrowing is to be done.
- Strength
- Key recovery should not weaken the system.

## General System

**Configurable Capability**
- Robustness
- There should be no single point of failure.

## General System

**Optional Capabilities**
- Non-disclosure of KRA
- Users may be able to hide the identities of their recovery agents.
- Interoperability
- Policy validation is available.

## End User

**General Requirements**
- Confidentiality
- Keys should not be disclosed unduly.
- Policy
- When system policy permits, users should have the ability to decide when, where, and how escrowing is to be done.

## End User

**Configurable Capability**
- Robustness
- There should be no single point of failure.

## End User

**Optional Capabilities**
- Non-disclosure of KRA
- Users may be able to hide the identities of their recovery agents.
- Non-repudiation
- Receipts available for KRA communication.
- Interoperability
- Policy validation is available.

## Key Recovery Agent

**General Requirements**
- Confidentiality
- Keys should not be disclosed unduly.
- Policy
- It must be possible to decide if, when, where, and how escrowing is to be done.

## Key Recovery Agent

**Configurable Capabilities**
- Robustness
- There should be no single point of failure.
- Confidentiality
- Users should neither view their own keys nor know of recoveries by certain requestors.
- Integrity
- Integrity of recovered data should be proven.

## Key Recovery Agent

**Configurable Capabilities (continued)**
- Authentication
- Authentication of requestors is required.
- Non-repudiation
- Receipts available for all communication.
- Auditing
- All significant events can be audited.

## Key Recovery Agent

**Optional Capabilities**
- Granularity
- Requestors may have different capabilities.
- Non-disclosure of users
- KRAs may be able to hide the identities of their subscribers.
- Non-reputation
- Receipts available for KRA communication.

## Registration Agent

**General Requirements**
- Integrity
- Integrity of vendor-specific information should be provable.
- Non-repudiation
- Receipts should be available for communications with this agent.

## Authentic PK Source

**General Requirements**
- Confidentiality
- Keys should not be disclosed unduly.
- Policy
- It must be possible to decide if, when, where, and how an APKS key is to be used.

## Authentic PK Source

**Configurable Capabilities**
- Robustness
- There should be no single point of failure.
- Confidentiality
- Users should neither view their own keys nor know of recoveries by certain requestors.
- Integrity
- Integrity of recovered data should be proven.

## Authentic PK Source

**Configurable Capabilities (continued)**
- Authentication
- Authentication for access is required.
- Auditing
- All significant events can be audited.

## Authentic PK Source

**Optional Capability**
- Granularity
- A single authentic public key source may support multiple capabilities for different cryptographic key recovery systems.

## Licensing Agent

**General Requirement**
- Non-repudiation
- Receipts should be available for communications with this agent.

## Reserve Clause

- In no case shall any of the requirements enumerated in this section be construed as limiting the policy options delineated in section 1.4 of this document.