NIST FIPS-validated cryptography must be used to protect passwords in the security database.

SV-93755r1_rule NIST FIPS-validated cryptography must be used to protect passwords in the security database.

Vulnerability discussion

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Cryptographic modules must adhere to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

Check content

From a command input line enter: TSS MODIFY(STATUS) Alternately: Refer to the following report produced by the ACF2 Data Collection: - TSSCMDS.RPT(STATUS) Automated Analysis: Refer to the following report produced by the ACF2 Data Collection: - PDI(TSS0485) If either of the following is included, this is not a finding. AES_ENCRYPTION(Active,128) AES_ENCRYPTION(Active,256)

Fix text

Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified below: Convert passwords/password phrases from Triple-DES encryption to 128-bit AES or 256-bit encryption by running TSSMAINT (with the AESENCRYPT option specified) and then running TSSXTEND to copy the old security file to the new security file. Please consult CA-TSS Installation guide for more information.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.