Separate keys for encryption and signatures
Summary
The system must use asymmetric cryptography with separated keys for encryption and signatures.
Description
The key used for encryption is responsible for ensuring the confidentiality of data. By keeping the encryption key separate from the key used for signatures, the system ensures that compromising one type of operation (decryption) does not automatically compromise the other (signature verification).
Additionally, separating keys simplifies key management. Each key pair has a specific purpose, and their roles are clearly defined.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🟢 |
| Advanced | 🟢 |
References
- OWASP-M TOP 10-M5. Insufficient cryptography
- CERT-J-SER02-J. Sign then seal objects before sending them outside a trust boundary
- MITRE ATT&CK®-M1041. Encrypt sensitive information
- CMMC-SC_L2-3_13_10. Key management
- HITRUST CSF-10_g. Key management
- FedRAMP-CM-3_6. Baseline configuration - Cryptography management
- ISO/IEC 27002-8_24. Use of cryptography
- OWASP SCP-6. Cryptographic practices
- C2M2-9_5_e. Implement data security for cybersecurity architecture
- PCI DSS-3_6_1_2. Protect cryptographic keys used to protect stored account data
- ISO/IEC 27001-8_24. Use of cryptography
- OWASP MASVS-CRYPTO-2. The app performs key management according to industry best practices
Vulnerabilities
Free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.