OWASPASVS 5.0 requirement
ASVS-V11.1.1 There is a documented policy for management of cryptographic keys and a cryptographic key lifecycle that follows a key management standard…
- Standard
- OWASP ASVS 5.0
- Chapter
- V11 Cryptography
- Section
- V11.1 Cryptographic Inventory and Documentation
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that there is a documented policy for management of cryptographic keys and a cryptographic key lifecycle that follows a key management standard such as NIST SP 800-57. This should include ensuring that keys are not overshared (for example, with more than two entities for shared secrets and more than one entity for private keys).