NIST FIPS-validated cryptography must be used to protect passwords in the security database.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-65649	RACF0467	SV-80139r1_rule		High

Description
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Cryptographic modules must adhere to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

STIG	Date
z/OS RACF STIG	2019-12-12

Details

Check Text ( C-67757r2_chk )
From the ISPF Command Shell enter SETRopts List Alternately: Refer to the following report produced by the RACF Data Collection: - RACFCMDS.RPT(SETROPTS) Automated Analysis Refer to the following report produced by the RACF Data Collection: - PDI(RACF0467) If the following is specified under “PASSWORD PROCESSING OPTIONS: “THE ACTIVE PASSWORD ENCRYPTION ALGORITHM IS KDFAES” , this is not a finding.

Check Text ( C-67757r2_chk )

From the ISPF Command Shell enter

SETRopts List

Alternately:
Refer to the following report produced by the RACF Data Collection:

- RACFCMDS.RPT(SETROPTS)

Automated Analysis
Refer to the following report produced by the RACF Data Collection:

- PDI(RACF0467)

If the following is specified under “PASSWORD PROCESSING OPTIONS:
“THE ACTIVE PASSWORD ENCRYPTION ALGORITHM IS KDFAES” , this is not a finding.

Fix Text (F-73269r1_fix)
Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified below: For z/OS release 1.12 through z/OS release 2.1 APARs OA43998 and OA43999 must be applied. Set the passwords option for algorithm to KDFAES. Sample syntax to activate: SETRopts PASSWORD(ALGORITHM(KDFAES))