SAFECOM Members:

We are pleased to announce the release of the Operational Best Practices for Encryption Key Management document.  The Federal Partnership for Interoperable Communications (FPIC) in collaboration with SAFECOM and the National Council of Statewide Interoperability Coordinators developed this document as a way to further address critical encryption issues, including encryption key change periods and the continued use of the data encryption standard (DES).

This document is the fourth in a series of documents informing public safety on encryption.  Operational Best Practices for Encryption Key Management continues these education efforts.  This document thoroughly explores encryption challenges relevant to public safety land mobile radio (LMR) systems and provides the public safety community with specific encryption key management best practices and case studies that illustrate the importance of secure communications.

In additional to Operational Best Practices for Encryption Key Management we are also excited to share the accompanying Encryption Key Management Fact Sheet with you.  FPIC, developed these documents to help agencies understand and effectively manage encryption keys.  Public safety organizations can apply these best practices to help secure, manage, and distribute their encryption keys and improve overall encryption key management.  Best practices for encryption keys include:

Eliminate the use of DES, instead using the more secure Advanced Encryption Standard

Obtain encryption keys from the U.S. Customs and Border Protection's National Law Enforcement Communications Center

Establish key change periods and discontinue the use of static (unchanging) keys

For additional information about this document, please contact FPIC@cisa.dhs.gov. For additional encryption resources, please visit cisa.gov/safecom/technology.

We encourage you to share these resources with your colleagues and others who might be interested.

Thank you for your time and attention,

Stay Safe. Stay Healthy. Defend Today. Secure Tomorrow.

Thank You,

Cybersecurity and Infrastructure Security Agency