Key Management: General
77 Transitioning between states often requires recording the event. Suitable places for such
recordings are audit logs and the keys metadata see Section 6.2.3.1
. [SP800-152]
also discusses the logging of these events.
The following sections discuss the example provided in Figure 3.
7.1 Pre-activation State
The key has been generated, but has not been authorized for use. In this state, the key may only be used to perform proof-of-possession
Section 8.1.5.1.1.2 or key confirmation
Section 4.2.5.5
. Other than for proof-of-possession or key-confirmation purposes, a key shall not be
used to apply cryptographic protection to information e.g., encrypt or sign information to be transmitted or stored or to process cryptographically protected information e.g., decrypt
ciphertext or verify a digital signature while in this state.
Transition 1: A key enters the pre-activation state immediately upon generation. Transition 2: If a key is in the pre-activation state, and it has been determined that the key
will not be needed in the future, the key shall transition directly from the pre- activation state to the destroyed state.
In the case of asymmetric keys, both keys of the key pair shall transition to the destroyed state.
The date and time of the transition shall be recorded.
Transition 3: When a key is in the pre-activation state, and the integrity of the key or the confidentiality of a key requiring confidentiality protection becomes suspect,
then the key shall transition from the pre-activation state to the compromised state.
In the case of asymmetric keys, both keys of the key pair shall transition to the compromised state.
The date and time of the transition shall be recorded. If the key is known by multiple entities, a revocation notice shall be generated.
Transition 4: Keys shall transition from the pre-activation state to the active state when the
key becomes available for use. This transition may occur upon reaching an activation date or may occur because of an external event. In the case where
keys are generated for immediate use, this transition occurs immediately after entering the pre-activation state.
For asymmetric keys associated with a certificate, both keys of the key pair become active upon the notBefore date in the first certificate issued for the
public key of the key pair.
The date and time of the transition should be recorded.
This transition marks the beginning of the cryptoperiod of a symmetric key or both keys of an asymmetric key pair see
Section 5.3 .
Key Management: General
78
7.2 Active State
