NIST 800-53 REV 5 • IDENTIFICATION AND AUTHENTICATION
IA-13(1) — Protection of Cryptographic Keys
Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.
Supplemental Guidance
Identity assertions and access tokens are typically digitally signed. The private keys used to sign these assertions and tokens are protected commensurate with the impact of the system and information resources that can be accessed.
Practitioner Notes
This enhancement requires protection of cryptographic keys used by identity providers and authorization servers — these keys are the crown jewels of your authentication infrastructure.
Example 1: Store your SAML signing certificates and OAuth signing keys in a Hardware Security Module (HSM) or Azure Key Vault with HSM backing to prevent extraction.
Example 2: Implement automatic key rotation for your identity provider's token signing keys and publish updated public keys to relying parties through standard metadata endpoints.