ANSI X9.24-PART-1-2004 pdf download Retail Financial Services Symmetric Key Management Part 2: Using Asymmetric Techniques for the Distribution of Symmetric Keys
1 Purpose
The financial services industry desires an additional and cost effective method of implementing symmetric Triple Data Encryption Algorithm (TDEA) key distribution at remote devices and between communicating pairs. Compliant implementation of the requirements stated in ANS X9.24 Part 1 for the secure management of symmetric TDEA keys requires (among other things) unique keys per device and strict enforcement of dual control and split knowledge processes for handling the full-length (i.e., not concatenated) keying material deployed to remote devices or established between communicating pairs. Historically, compliant implementation of key distribution has been a manually performed, physically on-site process that is difficult to manage, costly, and/or non-existent (i.e., not compliant). An automated rather than manual method of distributing symmetric keys could address these issues and could result in improved security of the financial services networked environment.
The use of public key cryptography and associated asymmetric key algorithms is one proposed solution for automated remote symmetric key distribution. Unlike clear TDEA keys which SHALL be protected from disclosure at all times during their key life cycle, the clear public keys of the asymmetric key pairs may be exchanged over open networks. This characteristic allows for automated distribution from a remote location and may eliminate the above issues associated with manual key loading. Once distributed, the protocols associated with the asymmetric algorithms may be used to establish the TDEA symmetric key, and may eliminate the manual symmetric key loading process and its associated risks. There are two such protocols for establishing the TDEA symmetric key. The key transport protocol may be used by the sender to encrypt and transport the TDEA symmetric key to the receiver. The key agreement protocol may be used to mutually derive the TDEA symmetric key.