V-239985

Discussion

Use of improperly configured or lower assurance equipment and solutions could compromise high-value information. The National Security Agency/Central Security Service's (NSA/CSS) CSfC program enables commercial products to be used in layered solutions to protect classified National Security Systems (NSS) data. Based on an analysis of the impact of quantum computing, cryptographic algorithms specified by CNSSP-15 and approved for use in products in the CSfC program have been changed to more stringent protocols and configured with increased bit sizes and other secure characteristics to protect against quantum computing threats. The Commercial National Security Algorithm Suite (CNSA Suite) replaces Suite B.

Check Content

Verify the ASA uses an approved High Assurance CSfC cryptographic algorithm for remote access to a classified network.

Step 1: Verify IKE Phase 1 is configured in compliance with CSNA/CNSSP-15 parameters as shown in the example below.
 
crypto ikev2 policy 2
 encryption aes-256
 integrity null
 group 19
 prf sha384

Step 2: Determine the crypto map for IKE Phase 2 used is in compliance with CSNA/CNSSP-15 as in the example below.

crypto map CSNA_MAP 10 set ikev2 ipsec-proposal AES-256

Step 3: Verify the proposal specifies CSNA/CNSSP-15 parameters.

crypto ipsec ikev2 ipsec-proposal AES-256
 protocol esp encryption aes-256

If the ASA is not configured to use an approved High Assurance CSfC cryptographic algorithm for remote access to a classified network, this is a finding.