1.01.1 Actor-generated Key Material

This aspect requires that the individual or system using key material is also the one generating it. The intent is to maintain confidentiality of the key material by preventing exposure to any party who is not the intended actor.  Confidentiality is prioritized where access is strictly given to the actor generating the key material, and randomness ensures that keys must be unpredictable to maintain secure systems.

Additionally, digital signatures confirm the key material generation process has not been altered. The Level II requirement allows a digital signature for an extra measure of security. The digital signature for the key material is generated, published, and validated before each execution. This confirms that the key material generation process has not been compromised.

1.01.2 Validation of Generation Methodology

This aspect focuses on verifying the integrity and reliability of key generation methodology before it is used. The purpose is to validate that the process produces secure and unpredictable key material.

Validation of the methodology must happen prior to usage to confirm that the features will not restrict entropy, leak data, or create weaknesses. Unless security is being enhanced, software used in key generation must not restrict the values produced or store key material. A feature that would enhance security would be  using Deterministic Random Bit Generators (DRBG).

By validating the integrity of the generation process, this aspect maintains the confidentiality and entropy needed for cryptographic protection.

1.01.3 Deterministic Random Bit Generator (DRBG) Compliance

This aspect focuses on key material adhering to the NIST SP 800-90A. NIST SP 800-90A ensures that DRBGs produce numbers that are statistically random. The goal is to ensure strong randomness is maintained, even though the generation process is deterministic.

The NIST SP 800-90A generation mechanism confirms that key material generation allows for high entropy and unpredictable outputs to minimize risks. The security and integrity of the key generation environment must be maintained.

Key generation must take place in a controlled and protected environment. The physical location should be inspected to ensure there is:

• No unauthorized recording/surveillance equipment
• No Visibility from outside or windows
• No weak entry points or uncontrolled access
• Access controls that are working as intended
• Backup power and environmental safeguards in place

All hardware and software involved must be up-to-date, verified, and functioning correctly. Portable devices must be secured, and every actor involved must follow a documented runbook so the process is consistent and accountable. Each actor generates their own key material independently to prevent any one person from influencing or exposing another participant’s key.

1.01.4 Entropy Pool

This aspect helps ensure that key material is generated using a Key Management System (KMS) with a strong, reliable entropy pool. Sufficient entropy is required for secure randomness. This prevents bias in key generation, reduced variability, or other properties that would allow for predictability or reproduction.

A robust entropy pool helps ensure that keys are unguessable, unique, and resistant to reproduction. Even strong algorithms fail without sufficient entropy, so this requirement reinforces one of the fundamental protections in secure key generation.

This article was written by Shreya Patel.