Versions Compared

Old Version 13

changes.mady.by.user Matthias Rohr

Saved on

compared with

New Version 14

changes.mady.by.user Matthias Rohr

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Info

In the case of cryptographic requirements exist, they should be referenced here.

  1. Only standard and mature cryptographic algorithms, operation modes, key lengths ciphers, and implementations MUST be used.

  2. General Transmission

    1. Transmission of sensitive data SHOULD generally only be possible via TLS/HTTPS.

    2. In cases where access requires HTTPS, requests via HTTP MUST be redirected to HTTPS. This SHOULD be implemented with a permanent redirection (HTTP 301).

    3. HTTPS servers MUST only support current secure ciphers and protocols. Insecure ones (e.g. SSLv2 and RC4 cipher) MUST be deactivated.

    4. Confidential data MUST only be sent within the HTTP Request Body (e.g. via HTTP POST) but not within URLs (exception: object IDs).

  3. Transmission on untrusted channels (e.g. the Internet) MUST

    1. only be possible with HTTPS using valid certificates.

    2. using HTTP Strict Transport Security (HSTS) headers 8.12 13 Client-Side Security and

    3. only be sent with anti-caching response headers (see Appendix A: Requirements for HTTP Security Header).

  4. Encryption at Rest

    1. Confidential data MUST be encrypted before stored on the client-side or on external cloud environments.

    2. User passwords MUST be persisted with suitable methods (see section 8.6 User Passwords I: Strength and Usage).