Blog - Cryptomathic

How Third Party Testing Can Improve Key Management System Security

Written by Ashiq JA (guest) | 16. November 2015

Independent third-party testing is essential for identification, detection, and elimination of defects in a key management system (KMS). The third-party testing organizations often have specialized facilities and expertise to carry out the testing and offer unbiased testing reports. These testing and validation activities should be performed on each module including the security functions and the protective measures employed by each module. This article discusses the benefits of third party testing for a key management system.

The need for third party testing

Business challenges such as quality of key management system, accuracy of internal assessments, accuracy of metrics and system deployment, reduction of production defects and risks. Third party testing provides optimum solution to help organizations improve their test processes. Trained and skilled professionals in the software testing sector perform the testing procedure in an appropriate manner, thereby reducing the chances of errors or other complexities while the software is implemented or used. Moreover, the third party testing company will have a specialized team that can handle any worst case scenario to improve the quality of the key management system software.

The professionals will test the software on various platforms and browsers. Moreover, they can reduce the time taken for the entire testing cycle, which is very beneficial in case of an emergency or immediate requirement. The professional testing team will further ensure that every stage of third-party testing is performed accurately. This provides savings by using a third-party test infrastructure, eliminates the need to acquire and continuously operate a test bed, and avoids time and cost needed to train test engineers to gain expertise. Subsequent engagements by the same third party, whose value was verified by earlier engagements, become even more cost-effective and efficient.

A third party functional test should verify that an implementation of cryptographic function operates correctly in the KMS system. A functional test might determine that a cryptographic algorithm implementation correctly computes the cipher text from the plaintext, given the key.

A third party penetration testing of key management system is a specific type of security testing in which a team of penetration testing experts develops penetration scenarios for the system as a whole and then evaluates the risk of a successful penetration. The scope of penetration testing should include personnel, facilities, and procedures. The testing team attempts to bypass the security safeguards with the goal of defeating KMS security. Any findings made by the penetration testing team should be addressed before initial deployment of the KMS in the production environment.

Processes involved in a third party testing

  • A vendor or customer may request that a third-party tests a Key Management System and device for conformance to a particular standard.
  • Functional walkthrough of the Key Management System and device is provided to the third-party testing organization
  • The third-party organization verifies that the requirements of a specification and regulation are met
  • The customer populates data that is relevant for testing to be carried out
  • The third-party organization initiates the test based on test plan, test strategy and test scenario
  • An unbiased testing report is provided to the customer

Third-party testing provides confidence that the vendor did not overlook some flaw in its own testing procedures. Specialized facilities from the testing organization help reducing the turnaround time for test activities to complete. Since the key management system and device security are critical, a third-party test will reduce the number of defects in the production environment.

Review of third party validations

The third party testing of the key management system (KMS) can include both functional and non-functional testing. For instance, scalability testing involves testing a device or system to learn how it reacts when the number of transactions to be processed over a given period of time increases dramatically. Every device has its limitations, but some device designs scale better than others. Scalability testing is used to stress devices and systems so that these problems are known and mitigated before they become fully operational (NIST).

While there are currently no formal validation programs for the security of a KMS, the NIST publication on ‘A framework for Designing Cryptographic Key Management System’ recommends following validation programs for certain devices of a KMS:

  • NIST-approved cryptographic algorithm implementations can be validated under the NIST Cryptographic Algorithm Validation Program (CAVP),
  • Cryptographic modules can be validated for conformance to [FIPS 140]-2 under the NIST Cryptographic Module Validation Program (CMVP),
  • Non-cryptographic security and hardware such as operating systems, DBMS, or firewall can be validated using the Common Criteria Standard under the National Information Assurance Partnership (NIAP)
  • A KMS, or parts thereof, could also be validated by a private entity hired by the vendor or a sponsor.

While these validation programs do not guarantee security, they can significantly increase confidence in the security and integrity of the KMS.

Image: "test", courtesy of DaveBleasdale, Flickr (CC BY 2.0)

 References and further reading