Division 8.1 Network encryption

The Central SIS II does not allow data with high or very high protection requirements to be transferred outside the LAN without encryption. It should be ensured that the network provider will not have an access to the SIS II operational data as well as to the related Sirene exchange by any means.

To maintain a high level of security, the Communication Infrastructure must allow to manage the certificates/keys. Remote administration and remote monitoring of the encryption boxes must be possible. Encryption algorithms at least must comply with the following requirements:

• Symmetric encryption algorithms:

  • 3DES (128 bits) or better,

  • key generation must depend on random value that does not allow for key space reduction while under attack,

  • encryption keys or information that can be used for deriving the keys are always protected while in storage 002E;

• Asymmetric encryption algorithms:

  • RSA (1 024 bit modulus) or better,

  • key generation must depend on random value that does not allow for key space reduction while under attack.

The Encapsulated Security Payload (ESP, RFC2406) protocol shall be used. It shall be used in tunnel mode. The Payload and the original IP-header shall be encrypted.

For exchange of session keys the Internet Key Exchange (IKE) protocol shall be used.

IKE keys shall not be valid longer than one day.

Session keys shall not be longer than one hour.