Skip to main content

10 - Cryptography

  • Last updated:

10.1 Cryptographic controls

Objective : To ensure proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of information

 

10.1.1 Policy on the use of cryptographic controls

Data in transit :

The data transfer between the browser of a Client's User and the Service relies on HTTPs encryption mechanisms. HSTS is enforced.

For the data transfers performed through data exchange services between the Clients and 365Talents :

  • All sFTP transfers relies on SSH-2 encryption mechanisms.
  • All API data transfer relies on HTTPs encryption mechanisms (see below).

HTTPs connections use on TLSv1.2 or TLSv1.3, depending on the client capabilities. Usage of previous version of TLS is forbidden. Authorized TLS cipher suites are :

  • TLS_AES_256_GCM_SHA384 (TLSv1.3)
  • TLS_AES_128_GCM_SHA256 (TLSv1.3)
  • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (TLSv1.2)
  • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (TLSv1.2)

All HTTPs connections to any 365Talents.com domain (*.365Talents.com) use a certificate signed by a certification authority (no self-signed certificate) with following characteristics :

  • The signature of the certificate follow PKCS #1 standard (SHA-256 hashing with RSA encryption).
  • The public key is 4096bits long and follow RSA PKCS #1 standard.
  • Certificates have a lifetime of 1 year.

All JWT tokens used to authenticate users are protected using HMAC with SHA-256 (HS256)

Data at rest :

Data at rest are encrypted by hosting provider at infrastructure level using AES-256 as described here and here

Data backup are encrypted :

  1. By the hosting provider at infrastructure level as any other data at rest (see above)
  2. Encrypted again by 365Talents using AES-256 algorithm

In the case where Client's SSO is not used, the password of the Users of the Services are stored by 365Talents encrypted using bcrypt hashing function with Blowfish algorithm with random salt for each entry.

 

10.1.2 Key management

The public certificate used to connect to the Service through HTTPs is managed by 365Talents and renewed every year. The certificate is issued by DigiCert.
The keys used to sign "JWT Tokens" are managed by 365Talents
The keys used to encrypt data at rest at the infrastructure level are managed by the hosting provider.
The keys used to encrypt data backup, in addition of encryption at infrastructure level (see above) are managed by 365Talents.