Issue No.04 - July/August (2010 vol.8)
Christian Cachin , IBM Research
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/MSP.2010.124
Encryption keys are sometimes encrypted themselves; doing that properly requires special care. Although it might look like an oversight at first, the broadly accepted formal security definitions for cryptosystems don't allow encryption of key-dependent messages. Furthermore, key-management systems frequently use key encryption or wrapping, which might create dependencies among keys that lead to problems with simple access-control checks. Security professionals should be aware of this risk and take appropriate measures. Novel cryptosystems offer protection for key-dependent messages and should be considered for practical use. Through enhanced access control in key-management systems, you can prevent security-interface attacks.
key encryption, cryptography, security and privacy, semantic security, CCA2 security, key management, access control
Christian Cachin, "Encrypting Keys Securely", IEEE Security & Privacy, vol.8, no. 4, pp. 66-69, July/August 2010, doi:10.1109/MSP.2010.124