IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Life span of cryptographic procedures
Cryptographic procedures and products must be checked regularly to establish
whether they still represent the state of the art. The algorithms that are used
may become too weak as a result of technical developments, such as faster or
cheaper IT systems, or because of new mathematical knowledge. The
cryptographic products in use may exhibit implementation errors. A time limit
for the use of cryptographic procedures should therefore be stipulated at the
time of their selection. When the time limit is reached, a thorough review
should take place again as to whether the crypto modules in use still offer the
expected level of protection.
Legal framework
Various general legal conditions must be observed in relation to the use of
cryptographic products. In some countries, for example, cryptographic
procedures are not allowed to be used without approval. It is therefore
necessary to examine the following points (see S 2.165 Selection of a suitable
cryptographic product):
- Whether restrictions on the use of cryptographic products have to be
observed in the countries belonging to the area of use (there are no
restrictions of any kind within Germany)
- Whether any export restrictions applying to products under consideration
have to be observed
However, there are not only maximum requirements applying to the
cryptographic algorithms or procedures used, there are also minimum
requirements. For example, encryption procedures with a sufficient key length
must be used for the transmission of person-related data.
Examples of technical solutions:
In the following there are a number of examples of application relating to the
various fields of use for cryptographic procedures. It can be seen that most
products cover several fields of use at the same time.
Example 1: Hard disk encryption
The sensitive data stored on the hard disk of a standalone PC needs to be
protected in such a way that the following conditions apply:
- The PC can only be booted by authorised users
- Only authorised users are given access to the stored data
- The stored data must be adequately protected against perusal by
unauthorised users when the PC is switched off - also in the event of it
being stolen.
The foremost priority in this case is the safeguarding of confidentiality. With
this in mind, the PC is to be protected against the following threats:
- Unauthorised disclosure of the data stored on the hard disk
- Manipulation of the data stored on the hard disk
- Manipulation of the crypto system
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000