Encryption Algorithms
V11.3.1
Verify that insecure block modes (e.g., ECB) and weak padding schemes (e.g., PKCS#1 v1.5) are not used.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 20, 216, 218, 220, 272, 31, 37, 39, 461, 463, 473, 55, 594, 620, 94, 97
V11.3.2
Verify that only approved ciphers and modes such as AES with GCM are used.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 162, 20, 204, 216, 218, 220, 272, 31, 37, 39, 461, 473, 55, 594, 620, 94, 97
V11.3.3
Verify that encrypted data is protected against unauthorized modification preferably by using an approved authenticated encryption method or by combining an approved encryption method with an approved MAC algorithm.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 162, 184, 20, 204, 216, 218, 220, 272, 31, 37, 39, 438, 442, 461, 473, 475, 523, 55, 594, 620, 68, 690, 75, 94, 97
V11.3.4
Verify that nonces, initialization vectors, and other single-use numbers are not used for more than one encryption key and data-element pair. The method of generation must be appropriate for the algorithm being used.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 20, 216, 218, 220, 272, 31, 37, 39, 473, 55, 594, 620, 94, 97
V11.3.5
Verify that any combination of an encryption algorithm and a MAC algorithm is operating in encrypt-then-MAC mode.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 112, 114, 145, 157, 20, 216, 218, 220, 272, 31, 37, 39, 461, 473, 475, 55, 594, 620, 94, 97
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
