Rule ID
SV-286603r1294298_rule
Version
V1R1
CCIs
Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. NIST cryptographic algorithms are approved by NSA to protect NSS. Based on an analysis of the impact of quantum computing, cryptographic algorithms specified by CNSSP-15 and approved for use in products in the Commercial Solutions for Classified (CSfC) program have been changed to more stringent protocols and configured with increased bit sizes and other secure characteristics to protect against quantum computing threats. The Commercial National Security Algorithm Suite (CNSA Suite) replaces Suite B. This requirement also applies to Zero Trust initiatives. Satisfies: SRG-NET-000352-ALG-000110, SRG-NET-000565-ALG-000010
If the UAG is not used to remotely access a classified network from an unclassified network, this requirement is not applicable. Log in to the UAG administrative interface as an administrator. Select "Configure Manually". Navigate to Advanced Settings >> System Configuration. Click the gear icon to edit. 1. Verify "TLS Server Cipher Suites" is set to: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 2. Verify "TLS Client Cipher Suites" is set to: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384 3. Verify "SSL Provider" is set to "JDK". 4. Verify "TLS Named Groups" is set to: secp256r1,secp384r1,secp521r1,ffdhe2048,ffdhe3072,ffdhe4096,ffdhe6144,ffdhe8192 5. Verify "TLS Signature Schemes" is set to "rsa_pkcs1_sha384". 6. Verify the "Extended Server Certificate Validation" toggle is enabled. 7. Verify the minimum "SHA Hash Size" is set to "SHA-384". If any of the above are not properly configured, this is a finding.
If the UAG is not used to remotely access a classified network from an unclassified network, this requirement is not applicable. Log in to the UAG administrative interface as an administrator. Select "Configure Manually". Navigate to Advanced Settings >> System Configuration. Click the gear icon to edit. 1. Set "TLS Server Cipher Suites" to: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 2. Set "TLS Client Cipher Suites" to: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384 3. Set "SSL Provider" to "JDK". 4. Set "TLS Named Groups" to: secp256r1,secp384r1,secp521r1,ffdhe2048,ffdhe3072,ffdhe4096,ffdhe6144,ffdhe8192 5. Set "TLS Signature Schemes" to "rsa_pkcs1_sha384". 6. Enable the "Extended Server Certificate Validation" toggle. 7. Set Minimum "SHA Hash Size" is set to "SHA-384". Note: If configuring UAG CSfC Compliant mode, ensure the certificates are issued with SHA-384 or greater signature. Click "Save". Note: Fully operating in CSfC mode may require reconfiguration of SAML providers and syslog. Consult Omnissa documentation for full details.