The mobile operating system must require authentication to access private keys saved in the key certificate store.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32993	SRG-OS-000067-MOS-000041	SV-43391r1_rule		Medium

Description
The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and can pretend to be the authorized user. Allowing unauthenticated access to private keys can enable an adversary in possession of the device to decrypt messages encrypted with the public key and to digitally sign data, thereby potentially enabling an adversary to impersonate the user in any application that uses that private key for user authentication. Requiring authentication to access keys saved in the certificate store mitigates the risk of unauthorized access. The passcode must be entered upon each access of the key store, although passcodes may be cached for a period of up to two hours.

Description

The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and can pretend to be the authorized user. Allowing unauthenticated access to private keys can enable an adversary in possession of the device to decrypt messages encrypted with the public key and to digitally sign data, thereby potentially enabling an adversary to impersonate the user in any application that uses that private key for user authentication. Requiring authentication to access keys saved in the certificate store mitigates the risk of unauthorized access. The passcode must be entered upon each access of the key store, although passcodes may be cached for a period of up to two hours.

STIG	Date
Mobile Operating System Security Requirements Guide	2013-04-12

Details

Check Text ( C-41290r1_chk )
Examine the mobile operating system for requiring authentication to access private keys saved in the key certificate store. If the mobile operating system does not require authentication to access private keys saved in the key certificate store, this is a finding.

Fix Text (F-36905r1_fix)
Configure the mobile operating system to require authentication to access private keys saved in the key certificate store.