Advanced Authentication response to NIST's deprecation of 3DES Encryption as a compliance issue
Article ID: 243619
Updated On:
Products
Issue/Introduction
Advanced Authentication response to NIST 3DES Encryption changes.
Environment
Release : 9.1.x
Component :Strong Authentication and Risk Authentication
Cause
Request For Information (RFI) from Broadcom Product Management
Resolution
In March of 2019, NIST announced that it was retiring the 3DES encryption algorithm. This was done in stages, where the algorithm was first deprecated and then in December 2023 it will be disallowed. This change may impact customers who adhere to NIST standards. You can find the updated NIST guidelines here.
Advanced Authentication has been replacing the usage of 3DES in some areas of the solution. This includes advancing to the use of TLS 1.2 for example, which uses AES256 for encryption. The 3DES algorithm has been removed except for the encryption of the various credentials when they are stored in the database and inside the AuthID. There are no plans at this time to change the encryption algorithm in these areas.
Broadcom recommends that to mitigate the use of 3DES for credential storage, customers enable the database Transparent Database Encryption (TDE) feature. This can encrypt the entire database itself with the AES256 algorithm and prevent any exposure of data that was initially encrypted with 3DES by Advanced Authentication. This capability is supported by both Microsoft and Oracle.
The AuthID credential has two components, one on the server and one on the device. The key on the server is encrypted with 3DES in the database similar to the other credentials. This can be mitigated by the TDE feature described above. On the device, the AuthID is further protected by our patented cryptographic camouflage feature which is used in combination with the encryption algorithms to protect the private key. Mobile OTP and PUSH credentials as well as Risk Authentication are not affected by the NIST guidelines as long as TDE is implemented.
Final decisions on the usage of Advanced Authentication and the AuthID should be made in consultation with the security team of your organization.
For any questions or concerns you can reach out to the Support team.
Additional Information
Effective as of the final publication of this revision of SP 800-131A, encryption using three-key TDEA is deprecated through December 31, 2023 using the approved encryption modes. Note that SP 800-67 specifies a restriction on the protection of no more than 220 data blocks using the same single key bundle. Three-key TDEA may continue to be used for encryption in existing applications but shall not be used for encryption in new applications. After December 31, 2023, three-key TDEA is disallowed for encryption unless specifically allowed by other NIST guidance. Decryption using three-key TDEA is allowed for legacy use.
From Draft NIST Special Publication 800-131A Revision 2.
Attachments
Feedback
