Detections
Analytics

4.2 Ensure AES encryption key size used to encrypt files stored in internal stages is set to 256 bits

Information

All ingested data stored in Snowflake tables is encrypted using 256-bit long AES encryption keys. However, data uploaded to internal stages is by default encrypted with 128-bit long AES encryption keys.

The field of cryptanalysis is continuously advancing and new vulnerabilities and attacks are discovered that obsolete cryptographic primitives that once were considered secure.

The 128-bit long AES encryption keys are still considered secure today and there are no strong reasons to believe this will change soon. Usage of the 256-bit long AES encryption keys today is generally recommended out of an abundance of caution.

Solution

Programmatically:

To set the length of the AES encryption keys used to encrypt data uploaded to internal stages, run the following command:

ALTER ACCOUNT
 SET CLIENT_ENCRYPTION_KEY_SIZE=256;

Impact:

None.

See Also

https://workbench.cisecurity.org/benchmarks/15569

Item Details

Category: IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|IA-5(1), 800-53|SC-28, 800-53|SC-28(1), CSCv7|14.8

Plugin: Snowflake

Control ID: da4d6904e724a193d3e24774b9680da9b6b1cb8b78afa61bba034ffd46eb470d