{
  "url": "https://openlegislation.uk/eu-decision-2007-170/annex/division-8/division-8.1",
  "json_url": "https://openlegislation.uk/eu-decision-2007-170/annex/division-8/division-8.1.json",
  "legislation": "eudn/2007/170",
  "legislation_title": "Commission Decision of 16 March 2007 laying down the network requirements for the Schengen Information System II (1st pillar) (notified under document number C(2007) 845) (Only the Bulgarian, Czech, Dutch, German, Estonian, Finnish, French, Greek, Hungarian, Italian, Latvian, Lithuanian, Maltese, Polish, Portuguese, Romanian, Slovak, Slovenian, Spanish, and Swedish text is authentic) (2007/170/EC)",
  "legislation_url": "https://openlegislation.uk/eu-decision-2007-170",
  "path": "annex/division/8/division/8.1",
  "kind": "division",
  "number": "8.1",
  "heading": "Network encryption",
  "text": "The Central SIS II does not allow data with high or very high protection requirements to be transferred outside the LAN without encryption. It should be ensured that the network provider will not have an access to the SIS II operational data as well as to the related Sirene exchange by any means.\nTo maintain a high level of security, the Communication Infrastructure must allow to manage the certificates/keys. Remote administration and remote monitoring of the encryption boxes must be possible. Encryption algorithms at least must comply with the following requirements:\nSymmetric encryption algorithms:\n3DES (128 bits) or better,\nkey generation must depend on random value that does not allow for key space reduction while under attack,\nencryption keys or information that can be used for deriving the keys are always protected while in storage 002E;\nAsymmetric encryption algorithms:\nRSA (1 024 bit modulus) or better,\nkey generation must depend on random value that does not allow for key space reduction while under attack.\nThe Encapsulated Security Payload (ESP, RFC2406) protocol shall be used. It shall be used in tunnel mode. The Payload and the original IP-header shall be encrypted.\nFor exchange of session keys the Internet Key Exchange (IKE) protocol shall be used.\nIKE keys shall not be valid longer than one day.\nSession keys shall not be longer than one hour.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2007/170/annex/division/8/division/8.1",
    "retrieved_at": "2026-11-01T15:17:14.878276+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}