Appears AWS is phasing out 3DES, pointing back to NIST 800-131A that reminds us 3DES moves to "disallowed after 2015."

Seems appropriate that we update our XCCDF and OVAL content to phase out 3DES. We'd be slightly ahead of the end of year, but any objections to writing a patch to phase out 3DES from approved algorithms now?

-------- Forwarded Message -------- Subject: AWS GovCloud (US) Updates for FIPS 140-2 Compliance Date: Fri, 4 Dec 2015 21:55:45 +0000 From: Amazon Web Services, Inc. no-reply-aws@amazon.com To: Shawn Wells <shawn@.....>

Dear AWS Customer,

We are contacting you to explain some configuration changes to enhance FIPS 140-2 security and system performance for the AWS GovCloud (US) region. Please review this information carefully to determine whether your use of services will be affected, and if so what you need to do.

3DES Deprecation ----------------------- Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that used to encrypt data sent over untrusted networks such as the Internet. The TLS protocol is a newer version of the SSL protocol. In this documentation, we refer to both SSL and TLS protocols as the SSL protocol.

In support of our customer’s requirements, AWS GovCloud (US) provides FIPS 140-2 compliant SSL endpoints. NIST Special Publication sp800-131A specifies the approval status of the 3DES block cipher algorithm as "Restricted through 2015" and "Disallowed after 2015" for FIPS 140-2 encryption. AWS GovCloud (US) currently supports AES-128 and AES-256 algorithms compliant with FIPS 140-2, and will be deprecating support for the 3DES algorithm on March 31, 2016. As an intermediate step, AWS GovCloud (US) has deprioritized the 3DES algorithm to the least preferred position in the available cipher options proffered by SSL endpoints.

For most customers there is no action required as a result of this change. However, customers that have either configured their clients specifically to use only 3DES, or which have clients that don’t support AES, will need to update their systems to avoid impact prior to the 3DES deprecation date.

If your client is configured to prefer 3DES, but supports AES, it will continue to work with no interruption in service after the deprecation date. The administrators of your system or Information System Security Officer may know if you have specified 3DES as the only acceptable cipher suite. In that case, you’ll need to make a configuration change to accept AES if your system requires or desires compliance with FIPS 140-2 standards.

Software Load Balancers ------------------------------- AWS is transitioning the FIPS endpoint systems used for AWS GovCloud (US) from hardware load balancers to software load balancers for SSL/TLS offloading. We have measured at least a 4X improvement in performance for data downloads using FIPS approved software load balancers over the current hardware implementation. The new software load balancer is implemented using industry leading TLS 1.2 with AES cipher suites, which represents an improvement in the security of connections to GovCloud while adhering to current compliance requirements.

This transition changes the AWS GovCloud FIPS 140-2 implementation from Level 2 (hardware required) to Level 1. Note that FIPS 140-2 Level 1 implements the same level of security in the encryption as Level 2 and does not impact the AWS GovCloud (US) FedRAMP authorization, as FedRAMP does not specify a required FIPS 140-2 Level. We recommend however, that customers review and update their System Security Plans or other documentation that may refer to AWS GovCloud (US) utilizing Level 2.

For more information, see the list of frequently asked questions (FAQs) below. Of course, AWS Support is always available to assist and can be contacted at https://console.aws.amazon.com/support/. Remember to use the credentials for the standard AWS account that you used to sign up for AWS GovCloud (US) to authenticate to the AWS Support Center. Thank you for being an AWS customer!

Sincerely, The AWS GovCloud (US) Team

-----------------------------------------------

Frequently Asked Questions: AWS GovCloud (US) Updates for FIPS 140-2 Compliance

Q. What is FIPS 140-2? The Federal Information Processing Standard (FIPS) Publication 140-2 is a US government security standard that specifies security requirements for cryptographic modules protecting sensitive information. To support customers with FIPS 140-2 requirements, the AWS GovCloud (US) region provides SSL terminations (a.k.a. service endpoints) that operate using load balancers with FIPS 140-2 certified modules.

Q. Why is AWS deprecating support for the 3DES algorithm? The 3DES algorithm (a.k.a. Triple DES, TDEA, and Triple Data Encryption Algorithm) is an older data encryption standard that will no longer be recognized as a FIPs 140-2 approved cipher after December 31, 2015. After this date, customers with FIPS 140-2 requirements will not be compliant if they bind to the 3DES cipher. The 3DES algorithm was designed for legacy generation hardware implementations and may be vulnerable to brute force attack with increasingly powerful computing technology. AWS is therefore deprecating support for the 3DES cipher in the AWS GovCloud (US) region. To support customers that don’t have FIPS requirements, the region will continue to support the 3DES cipher until at least March 31, 2016. We recommend that customers review their applications to ensure appropriate use of the latest ciphers.

Q. How do I determine if I’m using the 3DES cipher? The algorithm used to encrypt data for transport is determined by your application and the supported client configurations for your application. Your application may be supported by legacy software components that do not support AES cipher suites (although this is not common as AES has been a Federal Government standard since 2002). There are no customer settings to configure for choosing your preferred cipher in AWS GovCloud (US). The FIPS 140-2 compliant load balancers are able to detect which suite is cipher is used.

Q. How do I migrate off of the 3DES cipher? Customers with FIPS 140-2 requirements should review their applications and supported clients to ensure appropriate support for the latest approved encryption ciphers. Customers without FIPS 140-2 requirements can continue to use AWS GovCloud (US) by utilizing the available non-FIPS SSL endpoints.

Q. Could anything break when I change from the 3DES cipher? Customers will need to evaluate the impact of any changes to their application. For example, their users may need to upgrade their web browser or other software dependencies to ensure uninterrupted application availability.

Q. Why is AWS changing from FIPS Level 2 to FIPS Level 1? Is this a lower level of protection? FIPS 140-2 Level 1 implements the same level of security in the encryption as Level 2. This change does not impact the AWS GovCloud (US) FedRAMP authorization, as FedRAMP does not specify a required FIPS 140-2 Level. The updated software load balancers now operate independent of any specific hardware device, which provides improved system performance, easier upgrades, and more flexible scaling to meet the needs of AWS GovCloud (US) customers.

Amazon Web Services, Inc. is a subsidiary of Amazon.com, Inc. Amazon.com is a registered trademark of Amazon.com, Inc. This message was produced and distributed by Amazon Web Services Inc., 410 Terry Ave. North, Seattle, WA 98109-5210