+Confidentiality of Authentication Information

Confidentiality of Authentication Information

If passwords are used as authentication information for the cloud service, their confidentiality is ensured by the following procedures:
• Users can initially create the password themselves or must change an initial password when logging in to the cloud service for the first time. An initial password loses its validity after a maximum of 14 days.
• When creating passwords, compliance with the length and complexity requirements of the Cloud Service Provider (cf. IDM-09) or the cloud customer is technically enforced.
• The user is informed about changing or resetting the password.
• The serverside storage takes place using stateoftheart cryptographically strong hash functions in combination with at least 32-bit long salt values.
Additonal Criteria-
Supplementary Information - About the CriteriaThe stateoftheart regarding cryptographically strong hash functions is described in the current version of the BSI Technical Guideline TR021021 "Cryptographic mechanisms: Recommendations and key lengths". In version 201901 of this guideline these were:
• SHA256, SHA512/256, SHA384, SHA512; and
• SHA3256, SHA3384, SHA3-512.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania

3. Powiązane regulacje

Regulacje