SECURING FIBRE CHANNEL FABRICS - Brocade

Chapter 5: Elementary Cryptographypatient, which could be over 100 years. Keys can also be stolen orcompromised, in which case the information would have to be reencryptedor rekeyed using a different key to ensure the confidentialityof the information.Media such as disk and tape also have a limited shelf life and they gothrough evolution cycles to an eventually incompatible format. Encryptingdata-at-rest requires management of the encryption key for the lifeof the data. Encryption keys are usually managed by a comprehensivekey management system, because keys need to be managed for anextended period of time. A key management system is used to managethe lifecycle of keys. Encryption key information needs to be refreshedas the media expires and the data needs to be re-encrypted using adifferent key.Finally, encryption keys need to be backed up in a secure manner toavoid being compromised in the process. Keys can be backed up to akey vault, which can be a feature of a comprehensive key managementsolution used to establish policies and manage the keysthroughout their lifecycle. For redundancy, a typical key vault is implementedwith two or more units to prevent single points of failure. If theprimary key vault becomes unavailable, the secondary or clustered keyvault can accept or provide keys to the encryption device.Key management solutions are implemented using two basic methodologiesto exchange the keys between the encryption device and thekey management solution: trusted and opaque.Trusted Key ExchangeTrusted key managers have the ability to securely obtain cleartextkeys. To protect the keys during the transfer, a trusted relationshipmust be established between the two devices. For example, the deviceperforming the encryption must be able to store the encryption key inthe key vault. The encryption device and key vault must authenticateeach other to ensure that both are authorized to exchange keys. Wheneach device is authenticated and authorized, then the trusted relationshipis established. An example of a trusted key exchange is shown inFigure 33.88 Securing Fibre Channel Fabrics