cryptography and encryption

there are two main types of Encryption 

Symmetric encryption

• AES128 or higher must be used
• AES256 must be used with external cloud service providers
• Other algorithms must not be used

Asymmetric encryption

• RSA with a minimum key length of 2048 must be used
• The DH key exchange protocol should be used where appropriate for key exchange and must use a minimum key size of 2048
• Private keys must be subject to periodic review to identify compromise
• Other Asymmetric Encryption must not be used

Hash functions

• SHA-2 with a digest value of 256 or higher should be used
• SHA-3 may be used in place of SHA-2
• MD5, SHA-1 must not be used except for file validation
• Other algorithms not listed must not be used
• Cryptographic salt should be used in combination with all implementations of hash functions except for file validation

Cipher suites for SSL/TLS

• EECDH+AESGCM
• EDH+AESGCM
• AES256+EECDH
• AES256+EDH
• TLS v1.1 may be used to support legacy implementations
• TLS v1.2 should be used
• TLS v1.3 can be used once standard ratified
• Other cipher suKey genites must be disabled

2. Key generation

Cryptographic keys must be generated and stored in a secure manner that prevents loss, theft, or compromise. Keys need to be communicated by reliable and secure methods and kept confidential.

Key generation must be seeded from an industry standard random number generator (RNG).

Where user-generated passwords are required to decrypt data – either as the key or as input to a key derivation function – these should follow the University’s Control Procedure for Password Management. It is important that local procedures are put in place to ensure that passwords used to encrypt devices are communicated to teams on a need to know basis, so that if an individual leaves the University access can still be gained to the University’s data.

3. Client device encryption

All University managed computers require encryption for the protection of vulnerable and sensitive data. Computers running Microsoft Windows will use Bitlocker drive encryption. Access to the list of the keys in the Active Directory is restricted to the Server Management Team. Computers running alternative operating systems will have native encryption enabled where available.

Mobile devices synchronising email with the University email system must be forced to use encryption by the Active Sync settings pushed to the device.

Devices not under University management should have encryption enabled where possible at the user's discretion, but the University reserves the right to restrict devices from the network or defined network resources where they do not meet these and other security requirements.

4. Database encryption

University managed databases will have Transparent Database Encryption enabled by default unless an exception has been agreed with the Head of Information Security. As newer versions of database technology include more native encryption options, these should be enabled by default unless an exception has been agreed with the Head of Information Security.

5. Transferring data

Sensitive information shall only be removed from the University network with adequate protection, in line with the Information Classification Scheme. Tools for protecting information are offered by ISDS, including built-in encryption in Microsoft Office products, 7-Zip for file an folder encryption, encrypted USB devices, and use of Criminal Justice Secure Mail (CJSM) for email encryption to secure Government and public sector networks. Further information is available from ISDS.

6. Remote network access

Facilities for connection to the University’s IT systems and services via networks not fully within the control of the organisation’s security management (such as the internet or wireless access), will be secured according to the standards in this procedure.