@@ -947,10 +947,10 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
### 5.6.2 CON - Key management
- REFERENCE: REQ-PKI-CON-10
- REQUIREMENT: [CONDITIONAL] If the product exports private or symmetric keys it shall use state of the art techniques for guaranteeing its confidentiality as defined in Annex K.
- REQUIREMENT: When the product exports private or symmetric keys it shall use state of the art cryptographic mechanisms for guaranteeing its confidentiality as defined in Annex K.
- RATIONALE: A secret key should not be compromised if its exported form is intercepted.
- EXAMPLES: The exported private or symmetric key can be encrypted such that only its designated recipient can decrypt it.
- APPLICABILITY: All use cases where key export is supported.
- APPLICABILITY: UC1 and UC2.
- REFERENCE: REQ-PKI-CON-11
- REQUIREMENT: Secret keys shall not be stored persistently in plaintext form. They shall be stored within a secure cryptographic device or encrypted using approved algorithms as defined in Annex K using independently managed keys. They may only be accessed in plaintext form temporarily for a single operation or batch of operations.
