Zeroisation

"Emergency Erase" (АВАРИЙНОЕ СТИРАНИЕ) switch, zeroize in NSA parlance, on a cryptographic device of the Soviet Rocket Forces

In cryptography, zeroisation (also spelled zeroization) is the practice of erasing sensitive parameters (electronically stored data, cryptographic keys, and Critical Security Parameters) from a cryptographic module to prevent their disclosure if the equipment is captured. This is generally accomplished by altering or deleting the contents to prevent recovery of the data.^[1] When encryption was performed by mechanical devices, this would often mean changing all the machine's settings to some fixed, meaningless value, such as zero. On machines with letter settings rather than numerals, the letter 'O' was often used instead. Some machines had a button or lever for performing this process in a single step. Zeroisation would typically be performed at the end of an encryption session to prevent accidental disclosure of the keys, or immediately when there was a risk of capture by an adversary.^[2]

In modern software based cryptographic modules, zeroisation is made considerably more complex by issues such as virtual memory, compiler optimisations^[3] and use of flash memory.^[4] Also, zeroisation may need to be applied not only to the key, but also to a plaintext and some intermediate values. A cryptographic software developer must have an intimate understanding of memory management in a machine, and be prepared to zeroise data whenever a sensitive location might move outside the security boundary. Typically this will involve overwriting the data with zeroes, but in the case of some types of non-volatile storage the process is much more complex; see data remanence.

As well as zeroising data due to memory management, software designers consider performing zeroisation:

• When an application changes mode (e.g. to a test mode) or user;
• When a computer process changes privileges;
• On termination (including abnormal termination);
• On any error condition which may indicate instability or tampering;
• Upon user request;
• Immediately, the last time the parameter is required; and
• Possibly if a parameter has not been required for some time.

Informally, software developers may also use zeroise to mean any overwriting of sensitive data, not necessarily of a cryptographic nature.

In tamper resistant hardware, automatic zeroisation may be initiated when tampering is detected. Such hardware may be rated for cold zeroisation, the ability to zeroise itself without its normal power supply enabled.

Standards for zeroisation are specified in ANSI X9.17 and FIPS 140-2.

References