The purpose of this policy is to provide guidance that limits the use of encryption to those algorithms that have received substantial public review and have been proven to work effectively. Additionally, this policy provides direction to ensure that Federal regulations are followed, and legal authority is granted for the dissemination and use of encryption technologies outside of the United States.

Algorithm Requirements

  1. Ciphers in use must meet or exceed the set defined as "AES-compatible" or "partially AES-compatible" according to the IETF/IRTF Cipher Catalog, or the set defined for use in the United States National Institute of Standards and Technology (NIST) publication FIPS 140-2, or any superseding documents according to the date of implementation. The use of the Advanced Encryption Standard (AES) is strongly recommended for symmetric encryption.
  2. Algorithms in use must meet the standards defined for use in NIST publication FIPS 140-2 or any superseding document, according to the date of implementation. The use of the RSA and Elliptic Curve Cryptography (ECC) algorithms is strongly recommended for asymmetric encryption.

Signature Algorithms

Algorithm: ECDSA
Minimum Key Length: P-256
Additional Comment: Consider RFC6090 to avoid patent infringement.

Algorithm: RSA
Minimum Key Length: 2048
Additional Comment: Must use a secure padding scheme. PKCS#7 padding scheme is recommended. Message hashing required.

Algorithm: LDWM
Minimum Key Length: SHA256
Additional Comment: Refer to LDWM Hash-based Signatures Draft

Hash Function Requirements

CrowdFiber adheres to the NIST Policy on Hash Functions.

Key Agreement and Authentication

  • Key exchanges must use one of the following cryptographic protocols: Diffie-Hellman, IKE, or Elliptic curve Diffie-Hellman (ECDH).
  • Endpoints must be authenticated prior to the exchange or derivation of session keys.
  • Public keys used to establish trust must be authenticated prior to use. Examples of authentication include transmission via cryptographically signed message or manual verification of the public key hash.
  • All servers used for authentication (for example, RADIUS or TACACS) must have installed a valid certificate signed by a known trusted provider.
  • All servers and applications using SSL or TLS must have the certificates signed by a known, trusted provider.
  • CrowdFiber accepts the following as known, trusted providers: Sectigo, RapidSSL, GlobalSign, Thawte and Lets Encrypt.