Commit 908c4336 authored by Santeri Toikka's avatar Santeri Toikka
Browse files

Crypto shall be secure by default

parent ff213b15

EN-304-621.md

+3 −2
Original line number Diff line number Diff line
@@ -596,7 +596,7 @@ ZeroTrust routing is also encouraged where applicable. 
### 5.2.4 Appropriate cryptographic libraries



Cryptographic libraries, primitivies and constructions shall follow ENISA's Agreed Cryptographic Mechanisms<a href="_ref_1">[1]</a>.

Manufacturer shall implement only the recommended designs that are fit for the use-case.

Manufacturer shall enable by default only the recommended designs that are fit for use-case. Any designs that are not fit for use-case may only be enabled after the user has been sufficiently informed of the security consequences in a manner that takes the use-case into account.



As an example, when using TLS to protect the transport, only TLS v1.3 shall be used with one of the three cipher suites: TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256 or TLS_AES_128_CCM_SHA256.
@@ -712,7 +712,7 @@ Unwanted traffic in the interfaces can cause a denial of service from the manage 
| ----------------------------------------------- | ------------------------------------------------- |

| No known exploitable vulnerabilities            |                                                   |

| Secure design, development, production          |                                                   |

| Secure by default configuration                 |                                                   |

| Secure by default configuration                 | [5.2.4]                                           |

| Secure updates                                  |                                                   |

| Authentication and access control mechanisms    | [5.3.1]                                           |

| Confidentiality protection                      | [5.3.2]                                           |
@@ -725,6 +725,7 @@ Unwanted traffic in the interfaces can cause a denial of service from the manage 
| Logging and monitoring mechanisms               | [5.3.x Logging](#53x-logging)                     |

| Secure deletion and data transfer               |                                                   |



[5.2.4]: (#524-appropriate-cryptographic-libraries)

[5.3.1]: (#531-mitigations-for-user-identity-integrity)

[5.3.2]: (#532-mitigations-for-ingested-data-integrity-and-confidentiality)

[5.3.3]: (#533-mitigations-for-managed-device-configuration-integrity-and-confidentiality)