+V11 Cryptography
---+V11.1 Cryptographic Inventory and Documentation
------+V11.1.1 Verify that there is a documented policy for management of cryptographic keys and a cryptographic …
------+V11.1.2 Verify that a cryptographic inventory is performed, maintained, regularly updated, and includes all …
------+V11.1.3 Verify that cryptographic discovery mechanisms are employed to identify all instances of …
------+V11.1.4 Verify that a cryptographic inventory is maintained. This must include a documented plan that …
---+V11.2 Secure Cryptography Implementation
------+V11.2.1 Verify that industry-validated implementations (including libraries and hardware-accelerated …
------+V11.2.2 Verify that the application is designed with crypto agility such that random number, authenticated …
------+V11.2.3 Verify that all cryptographic primitives utilize a minimum of 128-bits of security based on the …
------+V11.2.4 Verify that all cryptographic operations are constant-time, with no 'short-circuit' operations in …
------+V11.2.5 Verify that all cryptographic modules fail securely, and errors are handled in a way that does not …
---+V11.3 Encryption Algorithms
------+V11.3.1 Verify that insecure block modes (e.g., ECB) and weak padding schemes (e.g., PKCS#1 v1.5) are not …
------+V11.3.2 Verify that only approved ciphers and modes such as AES with GCM are used.
------+V11.3.3 Verify that encrypted data is protected against unauthorized modification preferably by using an …
------+V11.3.4 Verify that nonces, initialization vectors, and other single-use numbers are not used for more than …
------+V11.3.5 Verify that any combination of an encryption algorithm and a MAC algorithm is operating in …
---+V11.4 Hashing and Hash-based Functions
------+V11.4.1 Verify that only approved hash functions are used for general cryptographic use cases, including …
------+V11.4.2 Verify that passwords are stored using an approved, computationally intensive, key derivation …
------+V11.4.3 Verify that hash functions used in digital signatures, as part of data authentication or data …
------+V11.4.4 Verify that the application uses approved key derivation functions with key stretching parameters …
---+V11.5 Random Values
------+V11.5.1 Verify that all random numbers and strings which are intended to be non-guessable must be generated …
------+V11.5.2 Verify that the random number generation mechanism in use is designed to work securely, even under …
---+V11.6 Public Key Cryptography
------+V11.6.1 Verify that only approved cryptographic algorithms and modes of operation are used for key …
------+V11.6.2 Verify that approved cryptographic algorithms are used for key exchange (such as Diffie-Hellman) …
---+V11.7 In-Use Data Cryptography
------+V11.7.1 Verify that full memory encryption is in use that protects sensitive data while it is in use …
------+V11.7.2 Verify that data minimization ensures the minimal amount of data is exposed during processing, and …

V11 Cryptography

Control Objective

The objective of this chapter is to define best practices for the general use of cryptography, as well as to instill a fundamental understanding of cryptographic principles and inspire a shift toward more resilient and modern approaches. It encourages the following:

  • Implementing robust cryptographic systems that fail securely, adapt to evolving threats, and are future-proof.
  • Utilizing cryptographic mechanisms that are both secure and aligned with industry best practices.
  • Maintaining a secure cryptographic key management system with appropriate access controls and auditing.
  • Regularly evaluating the cryptographic landscape to assess new risks and adapt algorithms accordingly.
  • Discovering and managing cryptographic use cases throughout the application's lifecycle to ensure that all cryptographic assets are accounted for and secured.

In addition to outlining general principles and best practices, this document also provides more in-depth technical information about the requirements in Appendix C - Cryptography Standards. This includes algorithms and modes that are considered "approved" for the purposes of the requirements in this chapter.

Requirements that use cryptography to solve a separate problem, such as secrets management or communications security, will be in different parts of the standard.

References

For more information, see also:

1. Overview

V11.1 Cryptographic Inventory and Documentation

Applications need to be designed with strong cryptographic architecture to protect data assets according to their classification. Encrypting everything is wasteful; not encrypting anything is legally negligent. A balance must be struck, usually during architectural or high-level design, design sprints, or architectural spikes. Designing cryptography "on the fly" or retrofitting it will inevitably cost much more to implement securely than simply building it in from the start.

It is important to ensure that all cryptographic assets are regularly discovered, inventoried, and assessed. Please see the appendix for more information on how this can be done.

The need to future-proof cryptographic systems against the eventual rise of quantum computing is also critical. Post-Quantum Cryptography (PQC) refers to cryptographic algorithms designed to remain secure against attacks by quantum computers, which are expected to break widely used algorithms such as RSA and elliptic curve cryptography (ECC).

Please see the appendix for current guidance on vetted PQC primitives and standards.
V11.2 Secure Cryptography Implementation

This section defines the requirements for the selection, implementation, and ongoing management of core cryptographic algorithms for an application. The objective is to ensure that only robust, industry-accepted cryptographic primitives are deployed, in alignment with current standards (e.g., NIST, ISO/IEC) and best practices. Organizations must ensure that each cryptographic component is selected based on peer-reviewed evidence and practical security testing.
V11.3 Encryption Algorithms

Authenticated encryption algorithms built on AES and CHACHA20 form the backbone of modern cryptographic practice.
V11.4 Hashing and Hash-based Functions

Cryptographic hashes are used in a wide variety of cryptographic protocols, such as digital signatures, HMAC, key derivation functions (KDF), random bit generation, and password storage. The security of the cryptographic system is only as strong as the underlying hash functions used. This section outlines the requirements for using secure hash functions in cryptographic operations.

For password storage, as well as the cryptography appendix, the OWASP Password Storage Cheat Sheet will also provide useful context and guidance.
V11.5 Random Values

Cryptographically secure Pseudo-random Number Generation (CSPRNG) is incredibly difficult to get right. Generally, good sources of entropy within a system will be quickly depleted if over-used, but sources with less randomness can lead to predictable keys and secrets.
V11.6 Public Key Cryptography

Public Key Cryptography will be used where it is not possible or not desirable to share a secret key between multiple parties.

As part of this, there exists a need for approved key exchange mechanisms, such as Diffie-Hellman and Elliptic Curve Diffie-Hellman (ECDH) to ensure that the cryptosystem remains secure against modern threats. The "Secure Communication" chapter provides requirements for TLS so the requirements in this section are intended for situations where Public Key Cryptography is being used in use cases other than TLS.
V11.7 In-Use Data Cryptography

Protecting data while it is being processed is paramount. Techniques such as full memory encryption, encryption of data in transit, and ensuring data is encrypted as quickly as possible after use is recommended.

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations
  • OWASP -

    EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

    DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.