TOSS 5 must implement DoW or other applicable U.S. Government agency-approved TLS encryption in the GnuTLS package.

Without cryptographic integrity protections, information can be altered by unauthorized users without detection.

Transport Layer Security (TLS) encryption is a required security setting as a number of known vulnerabilities have been reported against Secure Sockets Layer (SSL) and earlier versions of TLS. Encryption of private information is essential to ensuring data confidentiality. If private information is not encrypted, it can be intercepted and easily read by an unauthorized party. SQL Server must use a minimum of FIPS 140-3-approved TLS version 1.2, and all non-FIPS-approved SSL and TLS versions must be disabled. NIST 800-53 specifies the preferred configurations for government systems.

Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

Satisfies: SRG-OS-000250-GPOS-00093, SRG-OS-000423-GPOS-00187

Verify if GnuTLS uses defined DoW-approved TLS Crypto Policy using the following command:

$ update-crypto-policies --show FIPS

If the systemwide crypto policy is not set to "FIPS", this is a finding.

Configure the TOSS 5 GnuTLS library to use only NIST-approved encryption by enabling FIPS mode using the following command:

$ sudo fips-mode-setup --enable

Restart the system for the changes to take effect.