Cryptographic algorithms This appendix provides an overview of the type of cryptographic algorithms used in transmission security, and guidelines on how they should be used. Public key algorithms Public key algorithms are an asymmetric cipher mechanism with two different keys. One key is made public and the other is kept private. Data encrypted with one key can only be decrypted by the other and vice versa. Typically, the public keys are given out and the private key is kept secret and protected. Public key algorithms are typically used in authentication or for securely exchanging cryptographic keys over an un-trusted network. Public key Description and Conditions of use algorithms recommendations Diffie-Hellman (D-H) Agreeing on encryption The modulus MUST be at least 1024 bits. session keys. Elliptic Digital Agreeing on encryption The field/key size MUST be at least 160 bits. Signature Algorithm session keys. (ECDSA) Elliptic Curve Digital signatures The size MUST be at least 160 bits. (ECDH) Digital Signature Digital signatures. The modulus MUST be at least 1024 bits. Algorithm (DSA) Digital signatures. The modulus MUST be at least 1024 bits. (RSA) Passing encryption Note: The public keys used for passing session keys or similar encryption session keys MUST be different keys. to the keys used for digital signatures. Table 7: Public key algorithms Symmetric key algorithms Symmetric key algorithms rely on both communicating entities sharing a secret key. Unlike public key algorithms, the same key is used for encryption and decryption. Symmetric algorithms are mostly used for the bulk encryption once each has been authenticated and the shared key has been securely exchanged. Symmetric key algorithms are used for encrypting the bulk transmission of data as they operate much faster than public key algorithms. Symmetric Description and Conditions of use key recommendations algorithms Advanced Encryption A encryption standard AES supports key lengths of 128, Standard (AES) developed by the NSA to 192, 256 and 512 bits, and uses a gradually replace 3DES. 128 bit block. Endorsed by the NIST and FIPS information standards.
Cryptographic algorithms This appendix provides an overview of the type of cryptographic algorithms used in transmission security, and guidelines on how they should be used. Public key algorithms Public key algorithms are an asymmetric cipher mechanism with two different keys. One key is made public and the other is kept private. Data encrypted with one key can only be decrypted by the other and vice versa. Typically, the public keys are given out and the private key is kept secret and protected. Public key algorithms are typically used in authentication or for securely exchanging cryptographic keys over an un-trusted network. Public key algorithms Description and recommendations Conditions of use Diffie-Hellman (D-H) Agreeing on encryption session keys. The modulus MUST be at least 1024 bits. Elliptic Digital Signature Algorithm (ECDSA) Agreeing on encryption session keys. The field/key size MUST be at least 160 bits. Elliptic Curve (ECDH) Digital signatures The size MUST be at least 160 bits. Digital Signature Algorithm (DSA) Digital signatures. The modulus MUST be at least 1024 bits. (RSA) Digital signatures. Passing encryption session keys or similar keys. The modulus MUST be at least 1024 bits. Note: The public keys used for passing encryption session keys MUST be different to the keys used for digital signatures. Table 7: Public key algorithms Symmetric key algorithms Symmetric key algorithms rely on both communicating entities sharing a secret key. Unlike public key algorithms, the same key is used for encryption and decryption. Symmetric algorithms are mostly used for the bulk encryption once each has been authenticated and the shared key has been securely exchanged. Symmetric key algorithms are used for encrypting the bulk transmission of data as they operate much faster than public key algorithms. Symmetric key algorithms Description and recommendations Conditions of use Advanced Encryption Standard (AES) A encryption standard developed by the NSA to gradually replace 3DES. Endorsed by the NIST and FIPS information standards. AES supports key lengths of 128, 192, 256 and 512 bits, and uses a 128 bit block.
NTSAF_v200.docx