documentation_complete: true

title: 'Use Only FIPS 140-2 Validated Ciphers'

description: "Limit the ciphers to those algorithms which are FIPS-approved.\nCounter (CTR) mode is also preferred over cipher-block chaining (CBC) mode.\nThe following line in <tt>/etc/ssh/sshd_config</tt> demonstrates use of \nFIPS 140-2 validated ciphers:\n<pre>Ciphers aes128-ctr,aes192-ctr,aes256-ctr</pre>\n<br /><br />\nThe following ciphers are FIPS 140-2 certified on RHEL 7:\n<br />- aes128-ctr\n<br />- aes192-ctr\n<br />- aes256-ctr\n<br />- aes128-cbc\n<br />- aes192-cbc\n<br />- aes256-cbc\n<br />- 3des-cbc\n<br />- rijndael-cbc@lysator.liu.se\n<br /><br />\nAny combination of the above ciphers will pass this check. Official FIPS 140-2 paperwork for \nRHEL7 can be found at http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp2630.pdf."

rationale: |-
    Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore
    cannot be relied upon to provide confidentiality or integrity, and system data may be compromised.
    <br />
    Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to
    cryptographic modules.
    <br />
    FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules
    utilize authentication that meets industry and government requirements. For government systems, this allows
    Security Levels 1, 2, 3, or 4 for use on Red Hat Enterprise Linux.

severity: medium

identifiers:
    cce@rhel7: 27295-5

references:
    cis: 5.2.10
    cjis: 5.5.6
    cui: 3.1.13,3.13.11,3.13.8
    disa: 68,366,803
    hipaa: 164.308(b)(1),164.308(b)(2),164.312(e)(1),164.312(e)(2)(i),164.312(e)(2)(ii),164.314(b)(2)(i)
    nist: AC-3,AC-17(2),AU-10(5),CM-6(b),IA-5(1)(c),IA-7
    srg: SRG-OS-000033-GPOS-00014,SRG-OS-000120-GPOS-00061,SRG-OS-000125-GPOS-00065,SRG-OS-000250-GPOS-00093,SRG-OS-000393-GPOS-00173
    stigid@rhel7: "040110"

ocil_clause: 'FIPS ciphers are not configured or the enabled ciphers are not FIPS-approved'

ocil: |-
    Only FIPS ciphers should be used. To verify that only FIPS-approved
    ciphers are in use, run the following command:
    <pre>$ sudo grep Ciphers /etc/ssh/sshd_config</pre>
    The output should contain only those ciphers which are FIPS-approved.
