An engineer has been given the task of ensuring all of the keys used to encrypt archival data are securely stored according to industry standards…

Key escrow is an industry-standard practice for the secure storage and recovery of cryptographic keys. A fundamental security principle is to store encryption keys in a location that is logically and/or physically separate from the encrypted data. This separation ensures that a single security breach of the data storage environment does not also compromise the keys needed to decrypt that data, thereby preserving confidentiality. This method provides a robust mechanism for key recovery and long-term archival security.

A. A private repository is too generic; it lacks the specific, stringent security controls, audit trails, and access policies required for cryptographic key management by industry standards.

C. Storing keys in an escrow local to the data violates the core security principle of separation, creating a single point of compromise for both the data and its keys.

D. Storing private encryption keys in a public repository would completely negate the purpose of encryption, as it would allow any unauthorized party to access and decrypt the data.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-57 Part 1

Rev. 5

Recommendation for Key Management.

Section 5.3.8

"Key Escrow

" discusses the storage of keys by a trusted party for recovery purposes. The document's principles implicitly support separation. For instance

Section 5.3.5

"Key Storage

" states

"Cryptographic keys shall be protected against unauthorized disclosure

modification

and substitution." Storing keys with the data they protect increases the risk of disclosure if the data location is compromised.

2. Cloud Security Alliance (CSA)

Security Guidance for Critical Areas of Focus in Cloud Computing v4.0.

Domain 5: Encryption and Key Management

Page 83

emphasizes the importance of secure key storage. It states

"The fundamental requirement of a key management system is to ensure the confidentiality

integrity

and availability of the keys." It further recommends using dedicated systems like Hardware Security Modules (HSMs) or cloud provider Key Management Services (KMS)

which are inherently separate from the data storage services.

3. Stallings

W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson.

Chapter 14.3

"Key Management

" outlines the key distribution and management lifecycle. The text emphasizes that secure key storage requires protecting keys from disclosure and that keys should be stored in a secure location

separate from the data they protect

often in an encrypted form themselves or within a secure hardware module. This separation is a foundational concept for preventing catastrophic data breaches.