NIST FIPS-validated cryptography must be used to protect passwords in the security database.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-79049	TSS0485	SV-93755r2_rule		High

Description
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Cryptographic modules must adhere to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

STIG	Date
z/OS TSS STIG	2019-12-12

Details

Check Text ( C-78645r2_chk )
From a command input line enter: TSS MODIFY(STATUS) Alternately: Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(STATUS) Automated Analysis: Refer to the following report produced by the TSS Data Collection: - PDI(TSS0485) If either of the following is included, this is not a finding. AES_ENCRYPTION(Active,128) AES_ENCRYPTION(Active,256)

Fix Text (F-85807r2_fix)
Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified below: Convert passwords/password phrases from Triple-DES encryption to 128-bit AES or 256-bit encryption by running TSSMAINT (with the AESENCRYPT option specified) and then running TSSXTEND to copy the old security file to the new security file. Please consult CA-TSS Installation guide for more information.

Fix Text (F-85807r2_fix)

Evaluate the impact associated with implementation of the control option.

Develop a plan of action to implement the control option as specified below:

Convert passwords/password phrases from Triple-DES encryption to 128-bit AES or 256-bit encryption by running TSSMAINT (with the AESENCRYPT option specified) and then running TSSXTEND to copy the old security file to the new security file.

Please consult CA-TSS Installation guide for more information.