MYS8-00-011500 - The MySQL Database Server 8.0 must use NSA-approved cryptography to protect classified information in accordance with the data owner's requirements - tls_ciphersuites TLSv1.3

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

It is the responsibility of the data owner to assess the cryptography requirements in light of applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

NSA-approved cryptography for classified networks is hardware based. This requirement addresses the compatibility of a DBMS with the encryption devices.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure cryptographic functions to use NSA-approved cryptography-compliant algorithms.

Turn on MySQL FIPS mode.
Edit my.cnf
[mysqld]
ssl_fips_mode=ON

or
[mysqld]
ssl_fips_mode=STRICT

To restrict TLS versions:

[mysqld]
tls_version='TLSv1.2,TLSv1.3'

Example to define ciphers for TLSv1.2:

[mysqld]
ssl_ciphers='ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-RSA-AES256-GCM-SHA384,DHE-RSA-AES128-GCM-SHA256,DHE-DSS-AES128-GCM-SHA256,DHE-DSS-AES256-GCM-SHA384,DHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-RSA-CHACHA20-POLY1305'

If TLSv1.3 is enabled, the 'tls_ciphersuites' setting must contain all or a subset of following ciphers based on certificates being used by server and client. Enabling FIPS mode will limit the OpenSSL library to operate within the FIPS object module.

Example to define TLS ciphers for TLSv1.3:

[mysqld]
tls_ciphersuites='TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_CCM_SHA256,TLS_AES_128_CCM_8_SHA256'

After adding any entries to the my.cnf file, restart mysqld.

Create and use DoD-approved certificates for asymmetric keys used by the database.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_MySQL_8-0_V1R2_STIG.zip

Item Details

References: CAT|II, CCI|CCI-002450, Rule-ID|SV-235187r810842_rule, STIG-ID|MYS8-00-011500, Vuln-ID|V-235187

Plugin: Unix

Control ID: fe60fd30dd24531d7a012d7b3b3760a91539e7e1d32e25439ea544e481c4a1a6