IA-07 Cryptographic Module Authentication
NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
All changes in this version
Title
Cryptographic Module Authentication
Control
Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
Discussion
Authentication mechanisms may be required within a cryptographic module to authenticate an operator accessing the module and to verify that the operator is authorized to assume the requested role and perform services within that role.
Related controls
ac-3, ia-5, sa-4, sc-12, sc-13
Assessment objective
IA-07 mechanisms for authentication to a cryptographic module are implemented that meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
STIG rules that implement this control 33
Apple iOS/iPadOS 26 V1R3
- AIOS-26-007200 CAT II Apple iOS/iPadOS 26 must not include applications with the following characteristics: access to Siri when the device is locked.
- AIOS-26-007400 CAT II Apple iOS/iPadOS 26 allow list must be configured to not include applications with the following characteristics: - Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DOD servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a re…
Apple iOS/iPadOS 27 V1R1
- AIOS-27-006800 CAT II The Apple iOS/iPadOS 27 allow list must be configured to not include applications with the following characteristics: - Backs up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to…
- AIOS-27-006900 CAT II Apple iOS/iPadOS 27 must not include applications with the following characteristics: access to Siri when the device is locked.
Apple macOS 15 (Sequoia) V1R8
- APPL-15-000054 CAT I The macOS system must limit SSHD to FIPS-compliant connections.
- APPL-15-000057 CAT I The macOS system must limit SSH to FIPS-compliant connections.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-000054 CAT I The macOS system must limit SSHD to FIPS-compliant connections.
- APPL-26-000057 CAT I The macOS system must limit SSH to FIPS-compliant connections.
Application Security and Development V6R5
- APSC-DV-001860 CAT I The application must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-611070 CAT II Ubuntu 22.04 LTS must encrypt all stored passwords with a FIPS 140-3-approved cryptographic hashing algorithm.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-400400 CAT II Ubuntu 24.04 LTS must encrypt all stored passwords with a FIPS 140-3 approved cryptographic hashing algorithm.
Google Android 16 COBO Y26M10
- GOOG-16-006700 CAT II Google Android 16 allowlist must be configured to not include applications with the following characteristics: - Backs up mobile device (MD) data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; -…
- GOOG-16-006750 CAT II Google Android 16 allowlist must be configured to not include artificial intelligence (AI) applications that process device data in the cloud, including Google Gemini.
Google Android 17 COBO Y26M06
- GOOG-17-005600 CAT II Google Android 17 allow list must be configured to not include applications with the following characteristics: - Backs up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; - Payment process…
- GOOG-17-005700 CAT II Google Android 17 allow list must be configured to not include artificial intelligence (AI) applications that process device data in the cloud, including Google Gemini.
Microsoft Windows 11 V2R11
- WN11-CC-000052 CAT II Windows 11 must be configured to prioritize ECC Curves with longer key lengths first.
- WN11-SO-000190 CAT II Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
Microsoft Windows Server 2022 V2R11
- WN22-SO-000290 CAT II Windows Server 2022 Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
Microsoft Windows Server 2025 V1R4
- WN25-SO-000290 CAT II Windows Server 2025 Kerberos encryption types must be configured to prevent the use of DES and RC4 encryption suites.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200650 CAT II RHEL 10 must have the packages required for encrypting off-loaded audit logs installed.
- RHEL-10-200680 CAT II RHEL 10 must have the "libreswan" package installed.
- RHEL-10-600650 CAT II RHEL 10 must ensure that the pam_unix.so module is configured in the password-auth file to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication.
- RHEL-10-600700 CAT II RHEL 10 must be configured to use a sufficient number of hashing rounds for the shadow password suite.
- RHEL-10-600710 CAT II RHEL 10 must be configured to use a FIPS 140-3-approved cryptographic hashing algorithm for system authentication by ensuring that the pam_unix.so module is configured in the "system-auth" file.
- RHEL-10-600720 CAT II RHEL 10 must be configured so that password-auth uses a sufficient number of hashing rounds.
- RHEL-10-600730 CAT I RHEL 10 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-252065 CAT II RHEL 9 libreswan package must be installed.
- RHEL-09-611050 CAT II RHEL 9 password-auth must be configured to use a sufficient number of hashing rounds.
- RHEL-09-611055 CAT II RHEL 9 system-auth must be configured to use a sufficient number of hashing rounds.
- RHEL-09-652015 CAT II RHEL 9 must have the packages required for encrypting offloaded audit logs installed.
- RHEL-09-671015 CAT II RHEL 9 must employ FIPS 140-3-approved cryptographic hashing algorithms for all stored passwords.
Samsung Android 16 COBO Y26M10
- KNOX-16-005600 CAT II Samsung Android's Work profile must be configured to not allow installation of applications with the following characteristics: - Back up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmit MD diagnostic data to non-DoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; and…
- KNOX-16-005700 CAT II Samsung Android allowlist must be configured to not include artificial intelligence (AI) applications that process device data in the cloud, including Google Gemini.