Detections
Analytics

18.9.41.1 Ensure 'Configure validation of ROCA-vulnerable WHfB keys during authentication' is set to 'Enabled: Block' (DC only)

Information

This policy setting allows you to configure how Domain Controllers handle Windows Hello for Business (WHfB) keys that are vulnerable to the 'Return of Coppersmith's attack' (ROCA) vulnerability.

If this policy setting is enabled the following options are supported:

 - Ignore : During authentication the Domain Controller will not probe any WHfB keys for the ROCA vulnerability.
 - Audit : During authentication the Domain Controller will emit audit events for WHfB keys that are subject to the ROCA vulnerability (authentications will still succeed).
 - Block : During authentication the Domain Controller will block the use of WHfB keys that are subject to the ROCA vulnerability (vulnerable authentications will fail).

The recommended state for this setting is: Enabled: Block.

Note: This setting only takes effect on Domain Controllers running on Server 2022 (or newer).

Note #2: A reboot is not required for changes to this setting to take effect.

The 'Return of Coppersmith's attack' or ROCA vulnerability is a cryptographic weakness in a widely used cryptographic library. A threat actor can reveal secret keys (offline with no physical access to the affected device) on certified devices using this library.

For more information on this vulnerability, visit ADV170012 - Security Update Guide - Microsoft - Vulnerability in TPM could allow Security Feature Bypass https://msrc.microsoft.com/update-guide/en-us/vulnerability/ADV170012.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Block :

Computer Configuration\Policies\Administrative Templates\System\Security Account Manager\Configure validation of ROCA-vulnerable WHfB keys during authentication

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template Sam.admx/adml that is included with the Microsoft Windows 11 Release 21H2 Administrative Templates (or newer).

Impact:

This setting may affect vulnerable Trusted Platform Module (TPMs). To avoid issues, this setting should not be set to Block until appropriate mitigations have been performed, for example patching of vulnerable TPMs.

Warning: It is recommended that this setting is first set to Audit to ensure there are no audit events for WHfB keys that are subject to the ROCA vulnerability. If these exist, remediate before configuring this to Block.

See Also

https://workbench.cisecurity.org/benchmarks/25733

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SC-39, 800-53|SI-16, CSCv7|8.3

Plugin: Windows

Control ID: 34e6dabf7e84c0416c040f44c01c81694f0733649d8cb90653094dfcac4ff54d