Consideration of Appropriate Cryptoperiods as per NIST Guidelines about asvs

[jmanico]

I think this is too long. I suggest "no long-term keys" for any reason.

[tghosth]

We currently have this requirement:

#	Description	L1	L2	L3	CWE
1.6.1	Verify that there is an explicit policy for management of cryptographic keys and that a cryptographic key lifecycle follows a key management standard such as NIST SP 800-57.		✓	✓	320

I would be quite hesitant to start trying to mandate too many details of this directly...

[ImanSharaf]

Should we explicitly mention "maximum cryptoperiod of 1 to 3 years for private keys"?

[tghosth]

Should we explicitly mention "maximum cryptoperiod of 1 to 3 years for private keys"?

But if we say that, do we not need to also mandate a whole bunch of other requirements?

[tghosth]

@ImanSharaf waiting for a response here

[tghosth]

@ImanSharaf :)

[ImanSharaf]

Sorry for delay. We can close this one.