Detections
Analytics

4.2 Ensure AES encryption key size used to encrypt files stored in internal stages is set to 256 bits

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

All ingested data stored in Snowflake tables is encrypted using 256-bit long AES encryption keys. However, data uploaded to internal stages is by default encrypted with 128-bit long AES encryption keys.

The field of cryptanalysis is continuously advancing and new vulnerabilities and attacks are discovered that obsolete cryptographic primitives that once were considered secure.

The 128-bit long AES encryption keys are still considered secure today and there are no strong reasons to believe this will change soon. Usage of the 256-bit long AES encryption keys today is generally recommended out of an abundance of caution.

Solution

Programmatically:

To set the length of the AES encryption keys used to encrypt data uploaded to internal stages, run the following command:

ALTER ACCOUNT
 SET CLIENT_ENCRYPTION_KEY_SIZE=256;

Impact:

None.

See Also

https://workbench.cisecurity.org/benchmarks/14781

Item Details

References: CSCv7|14.8

Plugin: Snowflake

Control ID: e476691d9762e8fb0eac2e23c6894afe2d4f75e2e524d0ab32580e69dcaf693a