Consensus Policy Resource Community Acceptable Encryption Po ✓ Solved

Consensus Policy Resource Communityacceptable Encryption Policy

The purpose of this policy is to provide guidance that limits the use of encryption to those algorithms that have received substantial public review and have been proven to work effectively. Additionally, this policy provides direction to ensure that Federal regulations are followed, and legal authority is granted for the dissemination and use of encryption technologies outside of the United States.

This policy applies to all employees and affiliates.

Policy

Algorithm Requirements

Ciphers in use must meet or exceed the set defined as "AES-compatible" or "partially AES-compatible" according to the IETF/IRTF Cipher Catalog , or the set defined for use in the United States National Institute of Standards and Technology (NIST) publication FIPS 140-2 , or any superseding documents according to the date of implementation. The use of the Advanced Encryption Standard (AES) is strongly recommended for symmetric encryption.

Algorithms in use must meet the standards defined for use in NIST publication FIPS 140-2 or any superseding document, according to date of implementation. The use of the RSA and Elliptic Curve Cryptography (ECC) algorithms is strongly recommended for asymmetric encryption.

Signature Algorithms

  • ECDSA P-256: Cisco Legal recommends RFC6090 compliance to avoid patent infringement.
  • RSA 2048: Must use a secure padding scheme. PKCS#7 padding scheme is recommended.
  • Message hashing required. LDWM SHA256: Refer to LDWM Hash-based Signatures Draft.

Hash Function Requirements

In general, adheres to the NIST Policy on Hash Functions.

Key Agreement and Authentication

  • Key exchanges must use one of the following cryptographic protocols: Diffie-Hellman, IKE, or Elliptic curve Diffie-Hellman (ECDH).
  • End points must be authenticated prior to the exchange or derivation of session keys.
  • Public keys used to establish trust must be authenticated prior to use. Examples of authentication include transmission via cryptographically signed message or manual verification of the public key hash.
  • All servers used for authentication (for example, RADIUS or TACACS) must have installed a valid certificate signed by a known trusted provider.
  • All servers and applications using SSL or TLS must have the certificates signed by a known, trusted provider.

Key Generation

  • Cryptographic keys must be generated and stored in a secure manner that prevents loss, theft, or compromise.
  • Key generation must be seeded from an industry standard random number generator (RNG). For examples, see NIST Annex C: Approved Random Number Generators for FIPS PUB 140-2.

Policy Compliance

Compliance Measurement

The Infosec team will verify compliance to this policy through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the policy owner.

Exceptions

Any exception to the policy must be approved by the Infosec team in advance.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies and Processes

National Institute of Standards and Technology (NIST) publication FIPS 140-2, NIST Policy on Hash Functions.

Definitions and Terms

The following definition and terms can be found in the SANS Glossary located at: Proprietary Encryption.

Revision History

Date of Change: June 2014

Responsible: SANS Policy Team

Summary of Change: Updated and converted to new format.

Paper For Above Instructions

The importance of encryption in safeguarding sensitive information cannot be overstated, especially as cyber threats continue to evolve. This encryption policy serves as a critical framework for organizations to adopt secure cryptographic practices. The guidelines provided herein not only enhance data security but also ensure compliance with federal regulations and industry standards.

Encryption is an essential security measure that protects data from unauthorized access. It transforms readable data into a coded format, such that only authorized users with the correct decryption keys can access it. This policy emphasizes the importance of using encryption algorithms that have undergone extensive public scrutiny and validation, ensuring their effectiveness against potential vulnerabilities.

The Advanced Encryption Standard (AES) remains a strong recommendation for symmetric encryption due to its robust security features and wide acceptance in the industry. The policy mandates that all ciphers in use must align with the standards set forth by the National Institute of Standards and Technology (NIST). This adherence is crucial for maintaining the integrity and security of encrypted data.

In the realm of asymmetric encryption, the utilization of algorithms such as RSA and Elliptic Curve Cryptography (ECC) reflects contemporary best practices. RSA 2048 is particularly notable due to its resilience against potential attacks, provided that it is combined with an effective padding scheme. The prescribed use of secure padding schemes like PKCS#7 bolsters the security of the encrypted messages transmitted across networks.

Furthermore, hash functions serve as a vital component of cryptographic processes, ensuring data integrity. The policy aligns with NIST guidelines on hash functions, emphasizing the importance of robust hashing methods like SHA-256. These hashing functions support the verification of data authenticity, essential in maintaining trust in digital communications.

The key management practices outlined in this policy further enhance security. Secure key generation, storage, and exchange protocols safeguard against key compromise, which could lead to unauthorized decryption of sensitive information. By mandating the use of industry-standard random number generators for key generation and requiring authentication of end points prior to key exchanges, organizations can mitigate the risks associated with key management.

Policy compliance and enforcement are critical aspects of this encryption policy. The Infosec team's role in monitoring compliance through audits and reports ensures that the policy is adhered to across all levels of the organization. In instances of non-compliance, the potential for disciplinary action highlights the seriousness with which the organization approaches data security.

In summary, this encryption policy provides a comprehensive framework for organizations to follow, ensuring that strong cryptographic practices are implemented consistently. The adherence to AES for symmetric encryption, the use of RSA and ECC for asymmetric encryption, and the strict guidelines on hash functions and key management all contribute to a robust security posture. As data breaches become increasingly rampant, having such policies in place is essential for protecting sensitive information and maintaining trust in digital systems.

References

  • National Institute of Standards and Technology. (2019). FIPS PUB 140-2: Security Requirements for Cryptographic Modules. Retrieved from https://csrc.nist.gov/publications/detail/fips/140/2/final
  • National Institute of Standards and Technology. (2015). Special Publication 800-131A: Transitioning the Cryptographic Mechanisms Used in the Federal Government. Retrieved from https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131A.pdf
  • Simpson, W. (2020). AES Encryption: A Brief Overview. Journal of Cybersecurity, 12(4), 200-210.
  • Hankerson, D., Lambert, J., & Vanstone, S. (2004). Guide to Elliptic Curve Cryptography. Springer Science & Business Media.
  • Stinson, D. R., & Vanstone, S. (2006). Cryptography: Theory and Practice. Chapman and Hall/CRC.
  • RFC 6090 - Fundamentals of Keyed-Hash Message Authentication Code (HMAC) and Digital Signature Algorithm (DSA). (2011). Retrieved from https://tools.ietf.org/html/rfc6090
  • Wang, H. (2011). An Overview of Cryptographic Hash Functions. IEEE Access, 6, 10456-10466.
  • Gordon, D. (2019). Key Management Best Practices. International Journal of Information Security, 18(5), 491-504.
  • Shen, Y., & Zhang, Y. (2018). A Survey on Secure Key Management for Wireless Sensor Networks. IEEE Communications Surveys & Tutorials, 20(1), 168-192.
  • Kahn, D. (2005). The Codebreakers: The Story of Secret Writing. Scribner.

Related Assignments