Encryption key management is a crucial component of any high-assurance encryption security solution for Layer 2 high-speed networks and their links. Despite how secure and efficient a dedicated encryption device may be; ultimately encryption key management is the determinant of data security.
An encrypted high-speed data network’s ‘robustness’ is determined by the type of encryption key management used.
Ensuring that the transmitted data’s encryption keys are not accessible to an unauthorised party is essential to ensuring that a network breach will only result in meaningless data in the hands of an unauthorised party.
Encryption is dependent upon on key management to provide and deliver the local information needed to encrypt and decrypt frames.
Secure Encryption Management
Secure encryption depends on key security in all of its phases:
- A safe key needs randomness. Real randomness can only be delivered by a hardware source, while software-created randomness is calculated randomness, not real randomness. Senetas uses true hardware random number generators.
- Keys must be stored securely. Senetas encryptors feature a tamper-proof key storage in a temper-resistant enclosure. Any tampering inevitably leads to the zeroisation of the key storage.
- The encryption keys are in plain text while encrypting and decrypting and are dependent on a safe encryption environment. Senetas encryptors feature a tamper-proof enclosure. Any tampering inevitably leads to the zeroisation of all data in memory, including the keys in use.
- Keys need to be secure while being transported between encryptors. The keys are always encrypted while they are in transit.
Secure Encryption Generation
Each encryptor has its own certificate issued by the Certificate Authority (CA).
The certificate is an initial secret and its public key is used as a digital signature so that the recipient can verify the sender. The key exchange uses the certificate to sign the keys or partial keys that are exchanged to ensure that they are coming from the correct remote device.
The partial keys are generated completely inside the encryptor, without any user having access to it. After exchanging the partial keys both sides calculate the same shared secret. Subsequently, the encryptor generates internally the master key and encrypts it with the shared secret.
The encryptor also generates the session key and uses the master key to encrypt it. The transmission of the master and session keys from one encryptor to the other is always encrypted.
Senetas supports the two leading public key algorithms, RSA and ECC (elliptic curve cryptography), for the exchange of the master keys (key encryption keys). In case of ECC, ECDSA (elliptic curve digital signature algorithm) and ECKAS-DH (elliptic curve key agreement scheme) are used.
Senetas offers the choice between pairwise key system and group key system (or a combination of the two) in order to accommodate different topologies and usage scenarios.