Guidelines for Cryptographic Key Management
RFC 4107

Approval announcement
Draft of message to be sent after approval:

From: The IESG <iesg-secretary@ietf.org>
To: IETF-Announce <ietf-announce@ietf.org>
Cc: Internet Architecture Board <iab@iab.org>,
    RFC Editor <rfc-editor@rfc-editor.org>
Subject: Protocol Action: 'Guidelines for Cryptographic Key 
         Management' to BCP 

The IESG has approved the following document:

- 'Guidelines for Cryptographic Key Management '
   <draft-bellovin-mandate-keymgmt-04.txt> as a BCP

This document has been reviewed in the IETF but is not the product of an
IETF Working Group. 

The IESG contact person is Sam Hartman.

A URL of this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-bellovin-mandate-keymgmt-04.txt

Technical Summary
 
   The question often arises of whether or not a given security system
   requires some form of automated key management, or whether manual
   keying is sufficient.  This memo proposes guidelines for making such
   decisions.  The presumption is that when symmetric cryptographic
   mechanisms are used in a protocol, then automated key management is
   generally but not always needed.  If manual keying is proposed, the
   burden of proving that automated key management is not required falls
   to the proposer.
 
Working Group Summary
 
   While this specification is not the product of an IETF working
   group, it has been reviewed in the SAAG.  There was significant
   support for publication in SAAG.  Comments from the SAAG review have
   been incorporated into the specification.
 
Protocol Quality
 
   This document has been reviewed by Sam Hartman for the IESG.

RFC Editor Note

 In the abstract:
 s/proposes/provides/
 old:
    keying is sufficient.  This memo proposes guidelines for making such
 new:
    keying is sufficient.  This memo provides guidelines for making such

 section 2:
 old:
    In general, automated key management SHOULD be used to establish
    session keys.  This is a very strong "SHOULD", meaning the
    justification is needed in the security considerations section of a
    proposal that makes use of manual key management.
 new:
 In general, automated key management SHOULD be used to establish
     session keys.  Justification is needed in the security considerations
     section of a proposal that makes use of manual key management.

 Section 2.2:

 s/is/may be/
 old:
    Manual key management is a reasonable approach in any of these
    situations:
                                              new:
    Manual key management may be a reasonable approach in any of these
    situations:

IANA Note

  No IANA actions are required by this document.