Commit 852f5f1c authored by Santeri Toikka's avatar Santeri Toikka
Browse files

Merge branch 'crypto' into 'main' 

Added normative reference to Agreed Cryptographic Mechanisms

See merge request cyber/stan4cr2/en-304-621!18
parents ffce9fa7 908c4336

EN-304-621.md

+15 −2
Original line number Diff line number Diff line
@@ -192,7 +192,7 @@ This standard does not cover products in use in contexts other than those identi 


The following referenced documents are necessary for the application of the present document.



-   <a name="_ref_1">[1]</a> &lt;Standard Organization acronym> &lt;document number> (&lt;version number>): "&lt;Title>".

-   <a name="_ref_1">[1]</a> ENISA April 2025 (Version 2.0) "Agreed Cryptographic Mechanisms"



## 2.2 Informative references
@@ -589,6 +589,18 @@ ZeroTrust routing is also encouraged where applicable. 


### 5.2.4 Appropriate cryptographic libraries



Cryptographic libraries, primitivies and constructions shall follow ENISA's Agreed Cryptographic Mechanisms<a href="_ref_1">[1]</a>.

Manufacturer shall enable by default only the recommended designs that are fit for use-case. Any designs that are not fit for use-case may only be enabled after the user has been sufficiently informed of the security consequences in a manner that takes the use-case into account.



As an example, when using TLS to protect the transport, only TLS v1.3 shall be used with one of the three cipher suites: TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256 or TLS_AES_128_CCM_SHA256.



For backwards compatibility, use of other combinations of options other what is recommended<a href="_ref_1">[1]</a> shall be implemented with the following details listed in the technical documentation:



-   What component requires lesser cryptogarphical implementation

-   Statement about why the backwards compatibility is in place

-   Transition plan towards recommended cryptographical impelmentation

-   Transition timeline



## 5.3 Risk Mitigations



The following sections describe how technical security requirement in previous [Section 5.2](#52-technical-security-requirements-specifications) are mapped to the risk factors in [Section 4.5 Risk Factors](#45-risk-factors).
@@ -694,7 +706,7 @@ Unwanted traffic in the interfaces can cause a denial of service from the manage 
| ----------------------------------------------- | ------------------------------------------------- |

| No known exploitable vulnerabilities            |                                                   |

| Secure design, development, production          |                                                   |

| Secure by default configuration                 |                                                   |

| Secure by default configuration                 | [5.2.4]                                           |

| Secure updates                                  |                                                   |

| Authentication and access control mechanisms    | [5.3.1]                                           |

| Confidentiality protection                      | [5.3.2]                                           |
@@ -707,6 +719,7 @@ Unwanted traffic in the interfaces can cause a denial of service from the manage 
| Logging and monitoring mechanisms               | [5.3.x Logging](#53x-logging)                     |

| Secure deletion and data transfer               |                                                   |



[5.2.4]: (#524-appropriate-cryptographic-libraries)

[5.3.1]: (#531-mitigations-for-user-identity-integrity)

[5.3.2]: (#532-mitigations-for-ingested-data-integrity-and-confidentiality)

[5.3.3]: (#533-mitigations-for-managed-device-configuration-integrity-and-confidentiality)