NIST SP 800-88 Rev 2
Section 3: sanitization methods (clear, purge, destroy) and cryptographic erase – NIST SP 800-88 Rev 2

NIST SP 800-88 Rev 2 3.2.4: Quality of cryptographic implementations: obtain independent validation or vendor evidence on entropy and key generation, algorithm and mode implementation, key sanitization technique and wrapping strength; federal agencies require FIPS 140 validation

What does 3.2.4 require?

Following ISO/IEC 27040, an organisation choosing CE seeks independent validation of, or asks the ISM vendor to identify the mechanisms addressing, four assurance areas: the entropy of the random sources and the whitening applied in key generation (for the cryptographic keys and any wrapping keys affected by CE); the security strength and correct implementation of the encryption algorithm and mode; whether the key sanitization technique is strong enough that the target keys cannot be recovered; and wrapping techniques whose strength and assurance match the encryption. Generally accepted, standardised mechanisms are used where applicable, for example the cryptographic requirements of ISO/IEC 19790 and the module test requirements of ISO/IEC 24759, bearing in mind that those tests address only part of the concern areas. Federal agencies must use modules validated to the current FIPS 140 so that the conditions are verified for the ISM.

Maintained by Gerard Blokdyk

Other controls in Section 3: sanitization methods (clear, purge, destroy) and cryptographic erase – NIST SP 800-88 Rev 2

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-88 Rev 2 controls