STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API keys must be securely generated using a FIPS-validated Random Number Generator (RNG).

DISA Rule

SV-274603r1143636_rule

Vulnerability Number

V-274603

Group Title

SRG-APP-000224

Rule Version

SRG-APP-000224-API-000475

Severity

CAT II

CCI(s)

• CCI-001188 - Generate a unique session identifier for each session with organization-defined randomness requirements.

Weight

10

Fix Recommendation

This requirement is applicable only to devices that use a web interface for device management.

Build or configure the API to use FIPS 140-3-validated cryptographic modules when the API implements RNGs for key generation.

Check Contents

This requirement is applicable only to devices that use a web interface for device management.

Verify the API keys are securely generated using a FIPS-validated RNG.

Review the API documentation and interview the API administrator.

Identify the cryptographic modules utilized by the API for key generation.

Identify the cryptographic service provider utilized by the API and reference the NIST validation website to ensure the algorithms utilized are approved: https://csrc.nist.gov/projects/cryptographic-module-validation-program.

If the API does not use a FIPS 140-3-approved RNG, this is a finding.

Vulnerability Number

V-274603

Documentable

False

Rule Version

SRG-APP-000224-API-000475

Severity Override Guidance

This requirement is applicable only to devices that use a web interface for device management.

Verify the API keys are securely generated using a FIPS-validated RNG.

Review the API documentation and interview the API administrator.

Identify the cryptographic modules utilized by the API for key generation.

Identify the cryptographic service provider utilized by the API and reference the NIST validation website to ensure the algorithms utilized are approved: https://csrc.nist.gov/projects/cryptographic-module-validation-program.

If the API does not use a FIPS 140-3-approved RNG, this is a finding.

Check Content Reference

M

Target Key

5703