Title

NIST FIPS-validated cryptography must be used to protect passwords in the security database. (Cat I impact)

Discussion

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Cryptographic modules must adhere to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

Check Content

From the ISPF Command Shell enter SETRopts List Alternately: Refer to the following report produced by the RACF Data Collection: - RACFCMDS.RPT(SETROPTS) Automated Analysis Refer to the following report produced by the RACF Data Collection: - PDI(RACF0467) If the following is specified under “PASSWORD PROCESSING OPTIONS: “THE ACTIVE PASSWORD ENCRYPTION ALGORITHM IS KDFAES” , this is not a finding.

Fix Text

Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified below: For z/OS release 1.12 through z/OS release 2.1 APARs OA43998 and OA43999 must be applied. Set the passwords option for algorithm to KDFAES. Sample syntax to activate: SETRopts PASSWORD(ALGORITHM(KDFAES))

Additional Identifiers

Rule ID: SV-80139r1_rule

Vulnerability ID: V-65649

Group Title: RACF0467

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.