IBM z/OS must use NIST FIPS-validated cryptography to protect passwords in the security database.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
high	V-223887	SRG-OS-000073-GPOS-00041	TSS0-ES-000140	SV-223887r998488_rule	2025-03-11	9

Description
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Satisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000074-GPOS-00042

ℹ️ Check
From the ISPF command shell line enter: TSS MODIFY(STATUS) If either of the following is included, this is not a finding. AES_ENCRYPTION(Active,128) AES_ENCRYPTION(Active,256)

✔️ Fix
Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified below: Convert passwords/password phrases from Triple-DES encryption to 128-bit AES or 256-bit encryption by running TSSMAINT (with the AESENCRYPT option specified) and then running TSSXTEND to copy the old security file to the new security file. Please consult CA-TSS Installation guide for more information.

✔️ Fix

Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified below: Convert passwords/password phrases from Triple-DES encryption to 128-bit AES or 256-bit encryption by running TSSMAINT (with the AESENCRYPT option specified) and then running TSSXTEND to copy the old security file to the new security file. Please consult CA-TSS Installation guide for more information.