myDRE Cryptographic Configuration
This document defines the cryptographic architecture and baseline configurations enforced across the myDRE ecosystem. It provides an audit-compliant mapping that satisfies ISO 27001:2023 (A.08.24- Use of Cryptography)* and aligns with the strict standards of the CCN-STIC 825 / 807 (ENS - Esquema Nacional de Seguridad) self-assessment framework.
Cryptographic Domain Enforcement Matrix
The following matrix maps the specific cryptographic requirements of CCN-STIC 807 against the live implementation within our Microsoft Azure tenant architecture.
| Cryptographic Domain | CCN-STIC 807 Standard | Azure Production Configuration | Compliance Status |
|---|---|---|---|
| Symmetric Encryption (Data at Rest) | Algorithm: AES (Advanced Encryption Standard) Key Length: Minimum 128-bit (256-bit strongly mandated for HIGH classification systems). | Azure Storage & Disk Encryption: Built-in platform policies enforce native AES-256 encryption by default across all active storage accounts and virtual disks. No manual configuration is required. | Compliant |
| Symmetric Encryption (Data in Transit) | Protocol: TLS 1.2 or TLS 1.3 Cipher Suites: Must support Perfect Forward Secrecy (PFS). ⚠️ Strictly Prohibited: SSL v2/v3, TLS 1.0, TLS 1.1, RC4, 3DES, and MD5. | Azure App Service & Front Door Load Balancers: The platform minimum incoming handshake TLS version is globally hard-coded to TLS 1.2. TLS 1.3 negotiation is programmatically preferred where supported by the client browser. Legacy protocols and weak ciphers are disabled at the perimeter network layer. | Compliant |
| Asymmetric Encryption (Key Exchange & Signatures) | RSA: Minimum 2048-bit (3072-bit or higher mandated for long-term archival retention). ECC: NIST P-256 or P-384 curves. | Azure Key Vault Integration: Platform orchestration leverages native Key Vault resources supporting RSA (2048, 3072, 4096-bit parameters) and Elliptic Curve cryptographic keys (P-256, P-384, P-521). 👉 Roadmap Directive: Transitioning all core internal services to 3072/4096-bit RSA keys. | Compliant |
| Hashing & Integrity Verification | Algorithm: SHA-2 family (SHA-256, SHA-384, SHA-512) or SHA-3. ⚠️ Strictly Prohibited: SHA-1 (except for historical validation scenarios). | Azure Certificates & Signatures: Standard system components utilize SHA-256 by default for all digital signatures, secure key hashing, and file integrity validation operations. | Compliant |
| Key Management Lifecycle | Cryptographic keys must be derived and stored within a certified cryptographic module matching FIPS 140-2 Level 2 or Common Criteria benchmarks. | Azure Key Vault (Premium Tier / Managed HSM): Vault environments are backed by dedicated hardware security modules (HSMs) validated to FIPS 140-2 Level 2 and Level 3 parameters. ⚠️ Architectural Variance: Because anDREa relies on platform-managed encryption keys for standard at-rest controls, Customer Managed Keys (CMK) are not required. | N/A (Acceptable Design Choice) |
Operational Guidelines for Auditors
- Cryptographic Agility: anDREa tracks upstream Microsoft Azure security baselines to guarantee continuous updates to platform cipher suites, deprecating vulnerable algorithms ahead of regulatory sunset timelines.
- Separation of Duties: Administrative configuration planes for TLS termination and platform encryption are handled inside automated infrastructure-as-code deployment pipelines, preventing unverified manual alterations.