V-265634
Application Security and Development Security Technical Implementation Guide
Title
The application must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
Description
<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect classified data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. Advanced Encryption Standard (AES) Symmetric block cipher used for information protection FIPS Pub 197 Use 256 bit keys to protect up to TOP SECRET Elliptic Curve Diffie-H...
Fix Text (Documentation Requirement)
Configure application to encrypt stored classified information; Ensure encryption is performed using NIST FIPS 140-2-validated encryption. Encrypt stored, non-SAMI classified information using NIST FIPS 140-2-validated encryption. Implement NSA-validated type-1 encryption of all SAMI data stored in the enclave.