NIEF TPAT | TD: Federated ICAM Endpoint Cryptographic Requirements

Federated ICAM Endpoint Cryptographic Requirements, v1.0

The cryptographic requirements for system endpoints deployed for use by NIEF trusted partners.

Assessment Steps (2)

1 Proper Use of TLS (ProperUseofTLS) Is the system configured to use TLS and SSL correctly, as specified in the conformance criterion, to protect all of its protocol endpoints? Specifically, does the system first attempt to use TLS 1.2 or higher, and then attempt to use TLS 1.1 if necessary? Note that use of TLS 1.0 or SSL 3 is acceptable but not recommended, and use of SSL 2 is prohibited. Artifact TLS Scanner Report Provide a TLS Scanner Report from Qualys Scanner or equivalent. See https://www.ssllabs.com/ssltest/index.html.
2 Proper Use of Hashing Algorithms (ProperUseofHashingAlgorithms) Does the system use only SHA-256, SHA-384, and/or SHA-512 hashes for digital signatures? Artifact Hash Algorithm Artifact Provide evidence (policies, procedures, samples, etc.) that the system uses only SHA-256, SHA-384, and/or SHA-512 hashes for digital signatures.

Conformance Criteria (2)

Proper Use of TLS The system MUST conform to the following rules regarding negotiation and handling of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. The system MUST support TLS version 1.2 or higher, and MUST attempt to use TLS version 1.2 or higher before negotiating down to an older version of TLS. The system SHOULD support TLS version 1.1 and MUST attempt to use TLS version 1.1 before negotiating down to an older version of TLS or SSL in the event that TLS 1.2 or higher cannot be used. The system SHOULD NOT allow the use of TLS version 1.0 or SSL version 3. The system MUST NOT allow the use of SSL version 2. Citation NIEF Discussion/Review
Proper Use of Hashing Algorithms The system MUST use SHA-256, SHA-384, or SHA-512 for all hashes used with digital signatures. No other hash functions are permitted. Citation NIEF Discussion/Review

Show Metadata, Sources & Terms

Hide Metadata, Sources & Terms

Metadata

Identifier

https://trustmark.nief.org/tpat/tds/federated-icam-endpoint-crypto/1.0/

Publication Date

2021-06-25

Issuing Organization

NIEF (https://nief.org/) View Contact

NIEF Support

help@nief.org

No telephone

No Mailing Address

Keywords

NIEF, Federated ICAM, Transport Layer Security, TLS, Secure Sockets Layer, SSL, Secure Hash Algorithm, SHA

Issuance Criteria

yes(all)

Legal Notice

This artifact is published by the National Identity Exchange Federation (NIEF). This artifact and the information contained herein is provided on an "AS IS" basis, and NIEF disclaims all warranties, express or implied, including but not limited to any warranty that the use of the information herein will not infringe any rights or any implied warranties or merchantability or fitness for a particular purpose. In addition, NIEF disclaims legal liability for any loss incurred as a result of the use or reliance on the document or the information contained herein.

Sources (1)

NIEF	NIEF Technical Guidance

Terms (4)

Term Name	Abbreviations	Definition
Federated Identity, Credential, and Access Management	Federated ICAM	Refers to a comprehensive approach for dealing with digital identities (and associated attributes), credentials, and access control within a federated environment (across jurisdictional boundaries).
National Identity Exchange Federation	NIEF	National law enforcement and public safety information sharing trust framework.
Secure Hash Algorithm	SHA	A family of hasing algorithms that provides critical cryptography capabilities necessary for digital signatures, to help ensure non-repudiation and integrity of messages.
Transport Layer Security	TLS	An end-to-end communication protocol that provides on-the-wire encryption for communication sessions between endpoints. TLS has superseded SSL, which is widely regarded as obsolete.

Also available as XML or JSON