Title

NIST FIPS-validated cryptography must be used to protect passwords in the security database. (Cat I impact)

Discussion

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Cryptographic modules must adhere to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

Check Content

From a command input line enter: TSS MODIFY(STATUS) Alternately: Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(STATUS) Automated Analysis: Refer to the following report produced by the TSS Data Collection: - PDI(TSS0485) If either of the following is included, this is not a finding. AES_ENCRYPTION(Active,128) AES_ENCRYPTION(Active,256)

Fix Text

Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified below: Convert passwords/password phrases from Triple-DES encryption to 128-bit AES or 256-bit encryption by running TSSMAINT (with the AESENCRYPT option specified) and then running TSSXTEND to copy the old security file to the new security file. Please consult CA-TSS Installation guide for more information.

Additional Identifiers

Rule ID: SV-93755r2_rule

Vulnerability ID: V-79049

Group Title: TSS0485

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.