UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The VPN gateway must use AES for IPSec cryptographic encryption operations required to ensure privacy of the IPSec session.


Overview

Finding ID Version Rule ID IA Controls Severity
V-30966 NET-VPN-140 SV-41008r1_rule ECSC-1 High
Description
While there is much debate about the security and performance of Advance Encryption Standard (AES), there is a consensus it is significantly more secure than any of the algorithms supported by IPSec implementations today. AES is available in three key sizes: 128, 192 and 256 bits, versus the 56 bit DES. Therefore, there are approximately 1021 times more AES 128-bit keys than DES 56-bit keys. In addition, AES uses a block size of 128 bits—twice the size of DES or 3DES. Hence, AES must be used to ensure the privacy of the IPSec tunnel.
STIG Date
IPSec VPN Gateway Security Technical Implementation Guide 2013-10-08

Details

Check Text ( C-39626r3_chk )
Review all transform sets defined in IPSec profiles and crypto maps and verify that AES has been enabled for performing cryptographic encryption operations.
Fix Text (F-34775r2_fix)
Configure all IPSec transform sets to use AES for performing cryptographic encryption operations.