Detections
Analytics

1.6.3 Ensure system wide crypto policy macs are configured

Information

Message Authentication Code (MAC) algorithm is a family of cryptographic functions that is parameterized by a symmetric key. Each of the functions can act on input data (called a "message") of variable length to produce an output value of a specified length. The output value is called the MAC of the input message.

A MAC algorithm can be used to provide data-origin authentication and data-integrity protection

Weak algorithms continue to have a great deal of attention as a weak spot that can be exploited with expanded computing power. An attacker that breaks the algorithm could take advantage of a MiTM position to decrypt the tunnel and capture credentials and information.

A MAC algorithm must be computationally infeasible to determine the MAC of a message without knowledge of the key, even if one has already seen the results of using that key to compute the MAC's of other messages.

Solution

Create or edit a file ending in .pmod in /etc/crypto-policies/policies/modules/ and add the following line to disable weak (less than 128-bit) MACs:

mac = -*-64

Example:

# printf '%s\n' "# Disable weak (less than 128-bit) MACs" "mac = -*-64" >> /etc/crypto-policies/policies/modules/NO-WEAKMAC.pmod

Apply the subpolicy together with every other subpolicy that should remain active (a subpolicy that is not listed is not applied), then reboot:

# update-crypto-policies --set <CRYPTO_POLICY>:<SUBPOLICY1>:<SUBPOLICY2>:<SUBPOLICY3>

Example:

# update-crypto-policies --set DEFAULT:NO-SHA1:NO-WEAKMAC

Reboot the system for the updated policy to take effect.

Impact:

Restricting the MAC algorithms available to the system-wide policy may cause interoperability problems with older clients or servers that only offer the disabled (weaker, 128-bit truncated) MAC algorithms.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CM-6, 800-53|SC-8, 800-53|SC-8(1), 800-53|SC-13, CSCv7|14.4

Plugin: Unix

Control ID: f9121b0422e9fd11c875df645d2e49b2abb52df31163e632db78ba3608d21c47