Draft Recommendation for
Space Data System Standards
Draft Recommended Standard
CCSDS 000.0-R-0
DRAFT Red Book
February 2011
DRAFT CCSDS RECOMMENDED STANDARD FOR SYMMETRIC KEY MANAGEMENT
AUTHORITY
Issue: / Red Book, Issue 0.5Date: / February 2011
Location: / Not Applicable
(WHEN THIS RECOMMENDED STANDARD IS FINALIZED, IT WILL CONTAIN THE FOLLOWING STATEMENT OF AUTHORITY:)
This document has been approved for publication by the Management Council of the Consultative Committee for Space Data Systems (CCSDS) and represents the consensus technical agreement of the participating CCSDS Member Agencies. The procedure for review and authorization of CCSDS documents is detailed in the Procedures Manual for the Consultative Committee for Space Data Systems, and the record of Agency participation in the authorization of this document can be obtained from the CCSDS Secretariat at the address below.
This document is published and maintained by:
CCSDS Secretariat
Space Communications and Navigation Office, 7L70
Space Operations Mission Directorate
NASA Headquarters
Washington, DC 20546-0001, USA
FOREWORD
[Foreword text specific to this document goes here. The text below is boilerplate.]
Through the process of normal evolution, it is expected that expansion, deletion, or modification of this document may occur. This Recommended Standard is therefore subject to CCSDS document management and change control procedures, which are defined in the Procedures Manual for the Consultative Committee for Space Data Systems. Current versions of CCSDS documents are maintained at the CCSDS Web site:
http://www.ccsds.org/
Questions relating to the contents or status of this document should be addressed to the CCSDS Secretariat at the address indicated on page i.
At time of publication, the active Member and Observer Agencies of the CCSDS were:
Member Agencies
– Agenzia Spaziale Italiana (ASI)/Italy.
– Canadian Space Agency (CSA)/Canada.
– Centre National d’Etudes Spatiales (CNES)/France.
– China National Space Administration (CNSA)/People’s Republic of China.
– Deutsches Zentrum für Luft- und Raumfahrt e.V. (DLR)/Germany.
– European Space Agency (ESA)/Europe.
– Instituto Nacional de Pesquisas Espaciais (INPE)/Brazil.
– Japan Aerospace Exploration Agency (JAXA)/Japan.
– National Aeronautics and Space Administration (NASA)/USA.
– Federal Space Agency (FSA)/Russian Federation.
– UK Space Agency/United Kingdom.
Observer Agencies
– Austrian Space Agency (ASA)/Austria.
– Belgian Federal Science Policy Office (BFSPO)/Belgium.
– Central Research Institute of Machine Building (TsNIIMash)/Russian Federation.
– China Satellite Launch and Tracking Control General, Beijing Institute of Tracking and Telecommunications Technology (CLTC/BITTT)/China.
– Chinese Academy of Sciences (CAS)/China.
– Chinese Academy of Space Technology (CAST)/China.
– Commonwealth Scientific and Industrial Research Organization (CSIRO)/Australia.
– CSIR Satellite Applications Centre (CSIR)/Republic of South Africa.
– Danish National Space Center (DNSC)/Denmark.
– Departamento de Ciência e Tecnologia Aeroespacial (DCTA)/Brazil.
– European Organization for the Exploitation of Meteorological Satellites (EUMETSAT)/Europe.
– European Telecommunications Satellite Organization (EUTELSAT)/Europe.
– Geo-Informatics and Space Technology Development Agency (GISTDA)/Thailand.
– Hellenic National Space Committee (HNSC)/Greece.
– Indian Space Research Organization (ISRO)/India.
– Institute of Space Research (IKI)/Russian Federation.
– KFKI Research Institute for Particle & Nuclear Physics (KFKI)/Hungary.
– Korea Aerospace Research Institute (KARI)/Korea.
– Ministry of Communications (MOC)/Israel.
– National Institute of Information and Communications Technology (NICT)/Japan.
– National Oceanic and Atmospheric Administration (NOAA)/USA.
– National Space Agency of the Republic of Kazakhstan (NSARK)/Kazakhstan.
– National Space Organization (NSPO)/Chinese Taipei.
– Naval Center for Space Technology (NCST)/USA.
– Scientific and Technological Research Council of Turkey (TUBITAK)/Turkey.
– Space and Upper Atmosphere Research Commission (SUPARCO)/Pakistan.
– Swedish Space Corporation (SSC)/Sweden.
– United States Geological Survey (USGS)/USA.
PREFACE
This document is a draft CCSDS Recommended Standard. Its ‘Red Book’ status indicates that the CCSDS believes the document to be technically mature and has released it for formal review by appropriate technical organizations. As such, its technical contents are not stable, and several iterations of it may occur in response to comments received during the review process.
Implementers are cautioned not to fabricate any final equipment in accordance with this document’s technical content.
DOCUMENT CONTROL
Document / Title and Issue / Date / StatusCCSDS 000.0-R-0 / Symmetric Key Management, Draft Recommended Standard, Issue 0.5 / February 2011 / Current draft
CONTENTS
Section Page
CCSDS 000.0-R-0 Page A-22 November 2010
DRAFT CCSDS RECOMMENDED STANDARD FOR SYMMETRIC KEY MANAGEMENT
1 Introduction
1.1 Purpose of this recommendation
This recommendation describes standard CCSDS symmetric key management. In particular, the document recommends types of cryptographic keys, a cryptographic key lifecycle, and key distribution procedures for symmetric key management.
For types of cryptographic keys and the cryptographic key lifecycle, one single methodology with several options is recommended in this document. For key distribution procedures to support symmetric key management, one procedure is recommended; however, several alternative procedures are also specified in this recommendation.
This recommendation does specify symmetric key management as a support function to support cryptographic operations. It does not specify any of these cryptographic operations for the protection information or data. Suggestions on which recommendations exist for cryptographic operations and how these can be combined with symmetric key management can be found in “The Application of CCSDS Protocols to Secure Systems” (reference [A1]) and the CCSDS Security Architecture for Space Data Systems” (reference [A2]).
1.2 Scope
The specifications contained in this document are recommended for use on space missions with a requirement for key management or distribution. The algorithms may be employed to support cryptographic protection of any or all mission communications links such as the forward space link (e.g., telecommand), the return space link (e.g., telemetry, science data), as well as across the ground data network.
Symmetric key management mechanisms assume the presence of a side channel that allows secure distribution of an initial shared secret. The manner in which this initial shared secret is distributed and managed is left for individual Agencies or missions to decide. The “CCSDS Symmetric Key Management Green Book”(reference [A3]) and the “CCSDS Guide for Mission Planers”(reference [A4]) give some indications for mission planners on this topic.
This recommendation requires some information (cryptographic keys) to be transmitted securely over an unprotected channel. It does not specify how the protection of this information is realized. The “CCSDS Cryptographic Algorithms” (reference [A5]) recommends cryptographic algorithms that can be used for this purpose.
1.3 applicability
This recommendation is applicable to space missions with a requirement symmetric key management.
While the use of security services is encouraged for all missions, the results of a threat/risk analysis and the realities of schedule/cost drivers may reduce or eliminate its need on a mission-by-mission basis.
1.4 rationale
Traditionally, security mechanisms have not been employed on civilian space missions. In recognition of the increased threat, there has been a steady migration towards the integration of security services and mechanisms. For example, ground network infrastructures typically make use of controlled or protected networks. However, telecommands, telemetry, and science payload data, are still, for the most part, transmitted over unencrypted and unauthenticated radio frequency (RF) channels. As the threat environment becomes more hostile, this concept of operation becomes much more dangerous.
This CCSDS Symmetric Key Management Recommendation is necessary to support the development, deployment, and use of secure communication channels in space data systems. It enable the communication partners to exchange cryptographic keys, a necessary prerequisite for secure communications. It further specific exactly the use of these keys to ensure a high level of security and interoperability.
1.5 document structure
1.5.1 Document organization
Five sections and one annex make up this document. Section Error! Reference source not found. provides introductory information, definitions, nomenclature, and normative references. Section Error! Reference source not found. provides background and rationale for choice of the symmetric key management recommendations. Section Error! Reference source not found. describes cryptographic key types and hierarchies. Section 4 describes the cryptographic key lifecycle. Section 5 describes symmetric key management key distribution procedures. Section 5 discusses security considerations related to use of symmetric key management on the space link. Annex Error! Reference source not found. provides informative references.
1.5.2 nomenclature
The following conventions apply throughout this Recommendation:
a) the words ‘shall’ and ‘must’ imply a binding and verifiable specification;
b) the word ‘should’ implies an optional, but desirable, specification;
c) the word ‘may’ implies an optional specification;
d) the words ‘is’, ‘are’, and ‘will’ imply statements of fact.
1.6 definitions
NOTE: this section may be removed with a reference to the separate information security glossary document.
Access Control: The process of granting access to the resources of a system only to authorized users, programs, processes, or other systems.
Access Control Mechanism: Hardware or software features, operating procedures, management procedures, and various combinations of these designed to detect and prevent unauthorized access and to permit authorized access in an automated system.
Authenticate: (1) To verify the identity of a user, device, or other entity in a computer system, often as a prerequisite to allowing access to resources in a system. (2) To verify the integrity of data that have been stored, transmitted, or otherwise exposed to possible unauthorized modification.
Authorization: The granting to a user, program, or process (i.e., a system entity) the right to access a system resource.
Controlled Network: A network that enforces a security policy.
Confidentiality: Assurance that information is not disclosed to unauthorized entities or processes.
Ciphertext: Encrypted data.
Cryptographic Hash Function: a mathematical function that maps a string of arbitrary length (up to a pre-determined maximum size) to a fixed length string. It may be used to produce a checksum, called a hash value or message digest, for a potentially long string or message.
Data Integrity: Condition that exists when data is unchanged from its source and has not been accidentally or maliciously modified, altered, or destroyed.
Denial of Service: Any action or series of actions that prevent any part of a system from functioning in accordance with its intended purpose. Such actions include any action that causes unauthorized destruction, modification, or delay of service.
Identification: The process that enables recognition of an entity by a system, generally by the use of unique machine-readable user names.
Masquerading: Attempts to gain access to a system by posing as an authorized user or as a process. This is a form of spoofing.
Message Authentication Code (MAC): a cryptographic checksum that results from passing data through a message authentication algorithm.
Nonce: “Number used Once.” A randomly generated number used only once and may be used for authentication purposes or as an initialization vector.
Plaintext: Unencrypted data.
Residual Risk: The portion of risk that remains after security measures have been applied.
Risk: A combination of the likelihood that a threat will occur, the likelihood that a threat occurrence will result in an adverse impact, and the severity of the resulting adverse impact.
NOTE – Risk is the loss potential that exists as the result of threat and vulnerability pairs. It is a combination of the likelihood of an attack (from a threat source) and the likelihood that a threat occurrence will result in an adverse impact (e.g., denial of service, loss of confidentiality or integrity), and the severity of the resulting adverse impact. Reducing either the threat or the vulnerability reduces the risk.
Risk Analysis: An analysis of system assets and vulnerabilities to establish an expected loss from certain events based on estimated probabilities of the occurrence of those events. The purpose of a risk assessment is to determine if countermeasures are adequate to reduce the probability of loss or the impact of loss to an acceptable level.
Secret key: a symmetric cryptographic key that is associated with one or more entities. The use of the term "secret" in this context does not imply a classification level; rather the term implies the need to protect the key from disclosure or substitution.
Security Policy: The set of laws, rules, and practices that regulate how information is managed, protected, and distributed.
NOTE – A security policy may be written at many different levels of abstraction. For example, a corporate security policy is the set of laws, rules, and practices within a user organization; a system security policy defines the rules and practices within a specific system; and a technical security policy regulates the use of hardware, software, and firmware of a system or product.
Threat: Any circumstance or event with the potential to cause harm to a system in the form of destruction, disclosure, adverse modification of data, and/or denial of service.
Threat Agent: A method used to exploit a vulnerability in a system, operation, or facility.
Threat Analysis: The examination of all actions and events that might adversely affect a system or operation.
Threat Assessment: Formal description and evaluation of threat to a system.
Vulnerability: Weakness in an information system, or cryptographic system, or components (e.g., system security procedures, hardware design, internal controls) that could be exploited to violate system security policy.
Vulnerability Analysis: The systematic examination of systems in order to determine the adequacy of security measures, identify security deficiencies, and provide data from which to predict the effectiveness of proposed security measures.
Vulnerability Assessment: A measurement of vulnerability, which includes the susceptibility of a particular system to a specific attack and the opportunities available to a threat agent to mount that attack.
1.7 References
The following documents contain provisions which, through reference in this text, constitute provisions of this Recommended Standard. At the time of publication, the editions indicated were valid. All documents are subject to revision, and users of this Recommended Standard are encouraged to investigate the possibility of applying the most recent editions of the documents indicated below. The CCSDS Secretariat maintains a register of currently valid CCSDS documents.
[1] Information Technology—Open Systems Interconnection—Basic Reference Model: The Basic Model. International Standard, ISO/IEC 7498-1. 2nd ed. Geneva: ISO, 1994.
[2] Recommendation for Key Management, Part 1: General (Revised), National Institute of Standards and Technology Special Publication 800-57, March 2007
CCSDS 000.0-R-0 Page A-22 November 2010