Call Us:1234567890

•

Email:[email protected]

Cryptography Policy

Posted by:

sagar

|

On:

|

  1. Allowed
    1. All new implementations are required to use these cryptographic mechanisms and minimum key lengths.
  2. Divest
    1. Cryptographic mechanisms and/or key lengths should only be used where the allowed ciphers/key lengths are not technically feasible
    1. For existing implementations that use divest ciphers a break is not required. New implementations that use divest ciphers require a break. Teams are required to upgrade to allowed ciphers and/or key lengths by 12/31/2024.
  3. Disallowed
    1. The cryptographic mechanisms and/or key lengths are prohibited and implementations that use them require a break to be opened.

Key Wrapping

  • Wrapping a higher strength key with a lower strength key is prohibited.

Disallowed

Cipher suites that are not in the Allowed and Divest list above are Disallowed.

As a general guideline cipher suites that negotiate, contain or offer the following are disallowed:

  • With NULL encryption.
  • RC4 or DES or 3DES ciphers.
  • SHA-1 or MD5 as hashing algorithms
  • CBC as the authentication mechanism for block encryption.
  • Less than 112 bits of security, including so called “export-level” encryption.
  • RSA key transport, aka static RSA (static private key, lack of forward secrecy).
  • Non-ephemeral finite field Diffie Hellman key agreement and non-ephemeral Elliptic Curve DH key agreement. (TLS_DH and TLS_ECDH)

SSH Cryptographic Components:

Allowed

Encryption Algorithms (Ciphers)Key Establishment (KexAlgorithms)
AES256-GCMECDH-SHA2-NISTP521 (ECDH)
AES128-GCMECDH-SHA2-NISTP384 (ECDH)
 ECDH-SHA2-NISTP256 (ECDH)
 Curve25519-SHA256 (ECDHE)
 Diffie-Hellman-group-exchange-SHA256 (DH)
Message Authentication Codes (MACs)Signatures for Host Keys (used for HostKey generation)
HMAC-SHA2-512ECDSA-SHA2-NIST521 (ECDSA)
HMAC-SHA2-256ECDSA-SHA2-NISTP384 (ECDSA)
 ECDSA-SHA2-NISTP256 (ECDSA)
 SSH-RSA (RSA)
Client Key Generation (use type -t)
ECDSA
ED25519
RSA*

*where the default or the ‘-b’ bit length is >= 2048

Divest

Encryption Algorithms (Ciphers)
AES-256-CTR
AES-192-CTR
AES-128-CTR
AES-256-CBC
AES-192-CBC
AES-128-CBC
Client Key Generation (use type -t)
DSA
RSA*

*Where the default or the ‘-b’ bit length is < 2048

Signatures for Host Keys
SSH-DSS (DSA)
SSH-RSA (Where RSA < 2048 bits)

Disallowed

SSH cryptography components that are not in the Allowed and Divest list above are Disallowed.

As a general guideline SSH cryptographic components that negotiate, contain or offer the following are disallowed:

  • RSA Host Keys generated with less than 2048 bits. RSA is still Divest for Host Keys minimum 2048
  • CTR and CBC modes for AES encryption are in a divest state and after 12/31/2024 they will be moved to a disallowed state
  • The only use of SHA-1 in SSH is used to create the digital fingerprint is the current technical implementation and is allowed

Implementation Notes:

  1. Symmetric Ciphers (Block Encryption)
    1. Symmetric Ciphers are limited to block ciphers
    1. JPMC Requires keys of size 256 bits for implementations that last beyond 2030.
    1. Minimum key lengths are subject to change with PQC developments
    1. ARIA (from South Korea) and Camellia (from Japan) will not be included in the list because they are not on NIST approved list.
    1. AES-XTS guidance :
      1. This mode of AES is not appropriate for general use in applications
      1. Other allowed symmetric ciphers and modes can be used for storage medium encryption
      1. Unlike other modes of AES, AES-XTS uses two keys, one key is the Data Encryption Key and the second key is the Tweak Encryption Key
      1. In most configurations the following names are used:
        1. AES-XTS-256 (128 bit data encryption key)
        1. AES-XTS-512 (256 bit data encryption key)
      1. If the above configurations are not mentioned, then the implementations can mention the size of the data encryption key (aka. Key 1) and the Tweak Encryption Key (aka. Key 2)
  • Asymmetric Ciphers (Key Establishment)
    • Most client implementations (i.e., commercial browsers) use ECDHE as the preferred method for key establishment, so server implementations should use ECDHE as the preferred method also.
    • NIST SP 800-186 approves the following ECC Curves for key establishment/digital signature usage:
  • P-256
  • P-384
  1. P-521
  2. X25519
  3. X448
  4. brainpoolP256r1
  5. brainpoolP320r1
  6. brainpoolP384r1
  7. brainpoolP512r1
  8. secp256k1 (Only for blockchain implementations)
  9. Key Wrapping
    1. After December 31, 2023, the use of PKCS1-v1_5 padding scheme is disallowed.
  10. Digital Signatures
    1. Current NIST guidelines (Digital Signature Standards – NIST.FIPS.186-5) only approved ECDSA, EDDSA and RSA for digital signatures. DSA is used for legacy purposes.
    1. BLS (Boneh-Lynn-Shacham) is a signature scheme that is used in the current version of Etherium blockchain but it is not approved list of NIST algorithms. It is allowed for Etherium Blockchain usage only.
  11. Cryptographic Message Digests
    1. Secure Hash Algorithm 1 (SHA-1) may be used in conjunction with a Symmetric Secret Key to create Message Authentication Code (HMAC) when SHA2 or SHA3 based implementations of HMAC are not feasible.
    1. Currently there are no known directives from NIST to move from SHA-2 to SHA-3
  12. Message Authentication Codes
    1. Secure Hash Algorithm 1 (SHA-1) may be used in conjunction with a Symmetric Secret Key to create Message Authentication Code (HMAC) when SHA2 or SHA3 based implementations of HMAC are not feasible.
    1. A well-known practice with MACs is to truncate their outputs when a protocol has performance of bandwidth constraints (i.e., the length of the final MAC used is less than the length of the original output of the HMAC function). When truncation is used, a predetermined number of the left most bits of the HMAC output are used as the actual MAC tag. (NIST FIPS 198-1)

i. Based on NIST recommendation, truncated MACs with lengths shorter than 64 bits are disallowed (NIST SP 800-107r1).

  • KMAC-SHA3 is based on Keccak hashing algorithm which is the NIST’s pick for SHA-3 implementation.
    • CMAC uses AES, so the strength is based on AES encryption key size.
  • TLS Cipher Suites
    • The Cyber Risk Pillar team relies on standard IANA naming conventions for TLS Ciphers. Programmatic methods to check supported ciphers may return a slightly different Cipher name depending on the solution leveraged. The validity of these Ciphers can be checked against the listed Hex Code(s).
    • IANA recommends the following ECC curves for TLS cipher suite usage:

o P-256

o P-384

o x25519

  • x448
  • Session resumption (in TLS 1.2) and Pre Shared Key for zero round trip session resumption (TLS 1.3) are protocol specific implementation and not discussed as part cipher suites. (both do not support PFS)
  • IKE and IPsec Cipher Suites
    • To facilitate the migration to Post Quantum Cryptography, all new implementations from Q4 – 2024 are encouraged to use IKE Version 2.

Glossary

ECDH: Elliptic Curve Diffie Hellman. A Diffie Hellman key establishment protocol performed using Elliptic Curve Cryptography. The private components of ECDH are static and do not change.

EDCHE: Elliptic Curve Diffie Hellman Ephemeral: A Diffie Hellman key establishment protocol performed using Elliptic Curve Cryptography. The private components are renewed for every handshake. Provides perfect forward Secrecy.

PFS: Perfect Forward Secrecy. A security paradigm that establishes not only a different session key but also uses ephemeral private components for every key agreement handshake.

ECDSA: Elliptic Curve Digital Signature Algorithm. A Public Key Cryptography based Digital Signature method using Elliptic Curve Algorithms.

EDDSA: Edwards-curve Digital Signature Algorithm. A Public Key Cryptography based Digital Signature method using Edwards Elliptic Curve Algorithms.

ChaCha20: A stream cipher used with the TLS 1.3 cipher suites. This suite is being positioned as an alternative to more ubiquitous AES block cipher, just in case there is a successful cryptanalytic attack on it.

Poly1305: A Message Authentication Code method used with ChaCha20 Stream cipher.

AES: Advanced Encryption System. Actual name of the algorithm used for Advanced Encryption System is called Rijndael. It uses three key lengths 128, 192 and 256. This is the most ubiquitous block cipher used in the world today.

CBC: Cipher Block Chain Mode. A mode used to encrypt contiguous blocks of data using Advanced Encryption Standard Algorithm. It is generally considered unsafe for encryption for data larger than 128 bits.

CCM: Cipher Block Chaining with a Message Authentication Code (CBC-MAC). A mode used to encrypt contiguous blocks of data using AES algorithm. It is generally considered safe for block encryption and is included in all allowed TLS cipher suites.

CTR: Counter Mode. A mode used to encrypt contiguous blocks of data using AES algorithm. The improved version CTR, called GCM and now widely used with AES block encryption algorithm.

GCM: Galois Counter Mode. A mode used to encrypt contiguous blocks of data using AES algorithm. It is generally considered safe for block encryption and is included in all allowed TLS cipher suites.

SHA: Secure Hash Algorithm. A method to create a cryptographic message digest. The legacy version SHA-1 is considered unsafe and is prohibited from usage. The SHA-1 is replaced by SHA-2. NIST also introduced SHA-3 series of algorithms but there is no immediate requirement to upgrade to SHA-3.

RSA: Rivest Shamir Adleman Public Key Cryptosystem. RSA algorithm is used for key exchange and digital signatures.

DH: Diffie Hellman Key Establishment Algorithm. This is an asymmetric key algorithm used to secret key establishment and creating Digital Signatures using Digital Signature Algorithm (DSA).

DHE: Diffie Hellman Ephemeral Key Establishment Algorithm. In this key exchange algorithm the private component is changed for every key establishment, establishing perfect forward secrecy.

DSA: Digital Signature Algorithm, usually performed using Diffie Hellman Key Exchange algorithm.

TLS: Transport Layer Security. A data in transit encryption security protocol uses a combination of encryption and hashing cryptographic primitives. The current allowed versions are TLS 1.2 and TLS 1.3.

DES & T-DES: Data Encryption Standard and Triple Data Encryption Standard. DES uses a single 64 bit key to block encrypt data and T-DES uses either two or three distinct keys to encrypt data. Both DES and T-DES are now deprecated and prohibited from usage.

Skipjack: Skipjack algorithm is a block cipher originally developed by National Security Agency (NSA), it was once classified but now declassified. This algorithm is considered legacy algorithm and not allowed for block cipher operations.

RC4 and RC2: Rivest Cipher 4 and Rivest Cipher 2. Both ciphers are invented by Ron Rivest one of the inventors of RSA public key cryptosystem. RC4 is a stream cipher and RC2 is a block cipher. Both ciphers are now unsafe and not used.

PAKE: Password Authenticated Key Exchange. A method of key exchange not widely used.

MD5: Message Digest Algorithm invented by Ron Rivest one of the inventors of the RSA public key cryptosystem. It is a prohibited algorithm for current use.

HMAC: Hash Based Message Authentication Code. A type of message authentication code, also known as keyed hash.

CMAC: Cipher based Message Authentication Code. Uses a AES algorithm to create message authentication codes.

Cipher Suite: A combination of cryptographic primitives used for encryption, hashing, digital signatures and message authentication codes to implement data in transit encryption for TLS (transport layer security) protocol.

OMAC: One Key Message Authentication Code

PMAC: Parallelizable Message Authentication Code

SSH: Secure Shell Protocol is a cryptographic network protocol for operating network services securely over an unsecured network. It also provides two associated features, Secure Copy known as SCP and Secure File Transfer Protocol known as SFTP.

IKE: Internet Key Exchange is a secure key management protocol that establishes authenticated communication channels between devices over IP Networks. IKE is part of the IPsec Protocol.

IPsec: Internet Protocol Security, is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is usually set up at layer 3 of the Open Systems Interconnection 7 layer network protocol.

ESP: Encapsulated Security Payload is part of the IPsec Protocol and provides confidentiality, integrity and data origin authentication.

AH: Authentication Header is part of the IPsec Protocol only provides data integrity and data origin authentication. Unlike ESP Mode of IPsec it does not provide confidentiality of the data.

MACSec: Media Access Control Security Protocol is a layer 2 network security protocol and used to setup encrypted communication with built in integrity protection.

PSK: Pre-Shared Keys are used by the end points that are going to setup an protected channel to verify (authenticate) each other. In some cases these Pre-Shared Keys are also used to set up a session key to encrypt the data in the channel.

ICV: Integrity Check Value in MACSec, is a value that is derived by performing an algorithmic transformation on the data unit for which data integrity services are provided. The ICV is sent with the protected data unit and is recalculated and compared by the receiver to detect data modification.

SAK: Secure Association Key is a secret session key used by a Security Association in a MACSec Channel Setup.

XPN: Extended Packet Numbering is an additional parameter added to the MACSec Cipher Suites to allow more than 2^32 frames to be protected with a single Secure Association Key (SAK).

QKD: Quantum Key Distribution utilizes the unique properties of a quantum mechanical systems to generate and distribute cryptographic keying material using special purpose technology. This concept has been proposed as an alternative to the classical asymmetric key algorithm (RSA, DH) based key establishment.

References/Sources:

  1. Guidelines for using Cryptographic Standards in Federal Government: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-175Br1.pdf
  2. Federal Office for Information Security (Germany) Cryptographic Mechanisms Recommendations: https://www.bsi.bund.de/EN/Themen/Unternehmen-und- Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema- sortiert/tr02102/tr02102_node.html

Posted by

sagar

in