Secure Cryptography Implementation
V11.2.1
Verify that industry-validated implementations (including libraries and hardware-accelerated implementations) are used for cryptographic operations.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 162, 20, 204, 216, 218, 220, 272, 31, 37, 39, 473, 55, 594, 620, 94, 97
V11.2.2
Verify that the application is designed with crypto agility such that random number, authenticated encryption, MAC, or hashing algorithms, key lengths, rounds, ciphers and modes can be reconfigured, upgraded, or swapped at any time, to protect against cryptographic breaks. Similarly, it must also be possible to replace keys and passwords and re-encrypt data. This will allow for seamless upgrades to post-quantum cryptography (PQC), once high-assurance implementations of approved PQC schemes or standards are widely available.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 20, 461, 473, 97
V11.2.3
Verify that all cryptographic primitives utilize a minimum of 128-bits of security based on the algorithm, key size, and configuration. For example, a 256-bit ECC key provides roughly 128 bits of security where RSA requires a 3072-bit key to achieve 128 bits of security.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 20, 216, 218, 220, 272, 39, 473, 594, 620, 94, 97
V11.2.4
Verify that all cryptographic operations are constant-time, with no 'short-circuit' operations in comparisons, calculations, or returns, to avoid leaking information.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 20, 216, 218, 220, 272, 31, 37, 39, 463, 473, 55, 594, 620, 94, 97
V11.2.5
Verify that all cryptographic modules fail securely, and errors are handled in a way that does not enable vulnerabilities, such as Padding Oracle attacks.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 20, 216, 218, 220, 24, 272, 31, 37, 39, 461, 463, 473, 54, 55, 594, 620, 94, 97
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
