====== Cryptographic Material ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]

===== Discussion =====

Cryptographic Material supports cryptographic operations and the establishment or maintenance of cryptographic relationships.

Cryptographic Material includes symmetric keys, private keys, public keys, certificates, key-encryption keys, seeds, salts, initialisation vectors, nonces, shared secrets, and related cryptographic parameters.

Not all Cryptographic Material requires [[dido:99_annexes:annex-b-terms-and-definitions:c:confidentiality|Confidentiality]]. Public keys and certificates ordinarily require [[dido:99_annexes:annex-b-terms-and-definitions:i:integrity|Integrity]] and authenticity without secrecy. Private keys and shared secrets require confidentiality in addition to integrity and authenticity.

The applicable protection depends upon the material’s purpose, classification, [[dido:99_annexes:annex-b-terms-and-definitions:l:lifecycle|Lifecycle]] state, and exposure risk.

===== Definition =====

//data used to perform a cryptographic operation or to establish or maintain a cryptographic relationship//

===== Source =====

DIDO Solutions project definition.

===== Note =====

Cryptographic Material remains distinct from a [[dido:99_annexes:annex-b-terms-and-definitions:c:credential|Credential]]. Cryptographic Material supports cryptographic processing. A Credential represents an [[dido:99_annexes:annex-b-terms-and-definitions:i:identity|Identity]] or authority claim used in [[dido:99_annexes:annex-b-terms-and-definitions:a:authentication|Authentication]] or [[dido:99_annexes:annex-b-terms-and-definitions:a:access_control|Access Control]]. A single artifact, such as a digital certificate, satisfies both definitions when an authentication process uses it to establish identity.

Cryptographic Material requires lifecycle controls addressing generation, acquisition, distribution, storage, access, use, rotation, revocation, expiration, archival, recovery, and destruction.

Records concerning protected Cryptographic Material use protected references, identifiers, digests, or redacted representations to preserve [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] and [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] without exposing the protected data.

===== Example =====

A private key and its associated public-key certificate used by a [[dido:99_annexes:annex-b-terms-and-definitions:n:node|Node]] for mutual TLS constitute Cryptographic Material. The certificate also constitutes a Credential when the authentication process uses it to establish the Node’s identity.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>