151 – Separate keys for encryption and signatures

Summary

The system must use asymmetric cryptography with separated keys for encryption and signatures.

Description

The key used for encryption is responsible for ensuring the confidentiality of data. By keeping the encryption key separate from the key used for signatures, the system ensures that compromising one type of operation (decryption) does not automatically compromise the other (signature verification). Additionally, separating keys simplifies key management. Each key pair has a specific purpose, and their roles are clearly defined.

Supported In

Essential: True

Advanced: True

References

• OWASPM10-M5. Insufficient cryptography
• CERTJ-SER02-J. Sign then seal objects before sending them outside a trust boundary
• MITRE-M1041. Encrypt sensitive information
• CMMC-SC_L2-3_13_10. Key management
• HITRUST-10_g. Key management
• FEDRAMP-CM-3_6. Baseline configuration - Cryptography management
• ISO27002-8_24. Use of cryptography
• OWASPSCP-6. Cryptographic practices
• C2M2-9_5_e. Implement data security for cybersecurity architecture
• PCI-3_6_1_2. Protect cryptographic keys used to protect stored account data
• ISO27001-8_24. Use of cryptography
• OWASPMASVS-CRYPTO-2. The app performs key management according to industry best practices

Weaknesses

• 411 – Insecure encryption algorithm - Default encryption

Last updated

2024/01/18