Consideration of Appropriate Cryptoperiods as per NIST Guidelines

[ImanSharaf]

In light of enhancing ASVS cryptographic key management practices, it's advisable to consider aligning our cryptoperiods with the recommendations provided by the National Institute of Standards and Technology (NIST). NIST 800-57 suggests a maximum cryptoperiod of 1 to 3 years for private keys associated with certificates. This issue aims to initiate discussions and subsequent actions towards reviewing and possibly amending current ASVS key management practices in line with NIST guidelines.

[jmanico]

I think this is too long. I suggest "no long-term keys" for any reason.

[tghosth]

We currently have this requirement:

#	Description	L1	L2	L3	CWE
1.6.1	Verify that there is an explicit policy for management of cryptographic keys and that a cryptographic key lifecycle follows a key management standard such as NIST SP 800-57.		✓	✓	320

I would be quite hesitant to start trying to mandate too many details of this directly...

[ImanSharaf]

Should we explicitly mention "maximum cryptoperiod of 1 to 3 years for private keys"?

[tghosth]

Should we explicitly mention "maximum cryptoperiod of 1 to 3 years for private keys"?

But if we say that, do we not need to also mandate a whole bunch of other requirements?

[tghosth]

@ImanSharaf waiting for a response here

[tghosth]

@ImanSharaf :)

[ImanSharaf]

Sorry for delay. We can close this one.