← Back to General Application (GAPP) Security Requirements Guide

V-288247

CAT I (High)

The application must use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification.

Rule ID

SV-288247r1252860_rule

STIG

General Application (GAPP) Security Requirements Guide

Version

V1R0.1

CCIs

CCI-000803

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. To protect the integrity of the authenticator and authentication mechanism used for the cryptographic module used by the network device, the application, operating system, or protocol must be configured to use one of the following hash functions for hashing the password or other authenticator in accordance with SP 800-131Ar1: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256, SHA3-224, SHA3-256, SHA3-384, and SHA3-512. For digital signature verification, SP800-131Ar1 allows SHA-1 for legacy use where needed.

Check Content

Review the application documentation and deployed configuration to determine whether the application's cryptography mechanism uses FIPS-validated SHA-2 or higher hash function for digital signature generation and verification.

If the application's cryptography mechanism does not use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification, this is a finding.

Fix Text

Navigate to the cryptography configuration within the application.

Configure the application's cryptography mechanism to use FIPS-validated SHA-2 or higher hash function for digital signature generation and verification.