Advisory Notes and Best Practices
This page lists some constraints, requirements and best practices with respect to security to be followed when using CADP for .Net Core.
Single DES and two-key Triple DES should not be used unless the EMV standard requires it.
SHA-1 shall not be used to hash a message for signature purpose.
When using block ciphers, CBC mode is preferable to ECB when data exceeds the block size. More specifically: when using block ciphers , you should always use these ciphers in CBC mode, unless you have a compelling reason to use ECB mode.
For RSA encryption, the Optimal Asymmetric Encryption Padding (OAEP) should be used.
IV should not be re-used.
Use cipher suites with strong key exchange for SSL communication.
It is recommended to avoid using cipher algorithms RSA for Key Exchange, CBC mode, SHA1 in TLSv1.2 protocol while communicating with Key Manager.
It is recommended to use only trusted Third party signed certificates for TLS channel.
For AES-GCM algorithm, same combination of nonce (IV) and key must not be reused during encryption/decryption operations.
