The system must use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-23825	GEN000588	SV-38937r1_rule	DCNR-1	Medium

Description
Cryptographic modules used by the system must be validated by the NIST CVMP as compliant with FIPS 140-2. Cryptography performed by modules that are not validated is viewed by NIST as providing no protection for the data.

STIG	Date
Draft AIX Security Technical Implementation Guide	2011-08-17

Details

Check Text ( C-29148r1_chk )
Determine if the system uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes. The NIST CVMP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy. If the system does not use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes, this is a finding.

Check Text ( C-29148r1_chk )

Determine if the system uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes. The NIST CVMP web site provides a list of validated modules and the required security policies for the compliant use of such modules. Verify the module is on this list and configured in accordance with the validated security policy.

If the system does not use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes, this is a finding.

Fix Text (F-31998r1_fix)
Configure the system to use a FIPS 140-2 validated cryptographic module (operating in FIPS mode) for generating system password hashes. #chsec –f /etc/security/login.cfg –s usw –a pwd_algorithm=ssha256