Encryption

This standard defines the security criteria and guidelines to be considered when encrypting data in information assets in LATAM Group systems.

1. Scope

This standard applies to all LATAM Group system components, whether managed by the company or third parties.

2. References

References to internal LATAM documents:

• PO.03.07.0002-V1.0 - LATAM Group Information Classification Policy

• ST.03.07.0011-V1.0 - LATAM Group Logical Information Access Control

• PCI-DSS Security Standards**

• External references:

  • PCI DSS v3.2.1, Payment Card Industry Data Security Standard.

3. Responsibilities

3.1 Information Security Management

Responsible for:

• Ensuring compliance with this standard and reviewing and updating this document at least annually;

• Periodically reviewing approved encryption algorithms described in this standard;

• Complying with key management provisions in this standard for operated systems.

• Managing encryption and data encryption key systems such as tokenization or other available systems.

3.2 LATAM IT Infrastructure Management

Responsible for:

• Complying with key management provisions in this standard for systems operating in its infrastructure.

• Managing cryptographic keys ensuring compliance with the procedure throughout the lifecycle.

3.3 Operational Continuity Management

Responsible for:

• Complying with key management provisions in this standard for operated systems.

3.4 IT project managers

Responsible for:

• Complying with key management provisions in this standard for systems operated and implemented within their projects.

3.5 Encryption key custodians

Sign the Key Custody Commitment.

4. Detail

4.1 Information encryption

All information assets containing RESTRICTED, CONFIDENTIAL, and PII information described in the LATAM Group Information Classification Policy must keep information encrypted, such as stored passwords, banking data in transit, or other. For PII information, data should preferably be encrypted at rest, or at minimum kept confidential in compliance with local data protection laws. Information in pre-production systems must be encrypted; if not possible, it must at least be masked.

4.2 Key management

Each process owner managing cryptographic keys must develop, establish, and maintain a procedure throughout the lifecycle, including generation, storage, protection, retrieval, distribution, and retirement, as well as recovery in case of loss, damage, or compromise of cryptographic keys.

Cryptographic key management must be performed through the system formalized by the LATAM Group under Infrastructure area responsibility.

Controls must allow only authorized personnel access to the system, as defined in the LATAM Group Logical Information Access Control standard.

Equipment used to generate, load, store, and archive cryptographic keys must be physically protected against unauthorized access or modification.

Redundancy and recovery of cryptographic keys must be considered for disaster scenarios on information systems where RESTRICTED and CONFIDENTIAL information described in the LATAM Group Information Classification Policy is processed or stored.

4.3 Encryption keys

Compliance with the LATAM Group cryptography standard is required. Additionally, the following guidelines apply:

DEK (Data Encryption Key) are keys used to encrypt card data.

KEK (Key Encryption Key) are keys used to encrypt DEKs when storing them.

Keys must be generated according to organization-approved procedures through fully automated processes. Only the following algorithms and key sizes may be used:

Encryption algorithm	Minimum acceptable key length (bits)
[4] RSA	2048
[5] ECC	224
[6] AES	128
[7] SHA-2	224

Encryption keys must always be distributed securely according to organization procedures.

Access to encryption keys must be restricted to the minimum number of custodians required to ensure both security and proper organizational operation.

Encryption keys must be protected with file system permissions. Keys must be read-only and only the application may use them by accessing the repository where they are stored.

Encryption keys must be stored securely in the minimum number of locations.

Card data encryption keys (DEK) must be stored encrypted using a key encryption key (KEK). KEK strength must be equal to or greater than that used for DEKs.

Card data encryption keys (DEK) must be stored separately from key encryption keys (KEK).

Encryption keys must be changed through automated processes every 2 years.

If compromise is suspected, integrity weakness, or any other situation where information security considers key rotation necessary, keys must be replaced immediately through automated processes that generate new keys and re-encrypt card data. Old encryption keys must be securely destroyed.

Generation, distribution, storage, replacement, retirement, or withdrawal of encryption keys must be performed through previously authorized, auditable programmatic processes. When this is not possible and manual plaintext key management is required, key management operations must include:

• Split knowledge of keys, so key components are divided among at least two people who only know their own components

• Split control of keys, so at least two people are required to perform any key operation and no person has access to another's authentication elements

Unauthorized substitution of encryption keys must be prevented through physical and logical procedures and mechanisms. All access to encryption keys is audited and automatically and immediately reported to information security.

Keys are segregated with divided access between administrators of servers handling card data encryption keys (DEK) and servers handling key encryption keys (KEK).

All encryption key custodians must understand their responsibilities regarding key protection in generation, distribution, storage, retirement or replacement, and distribution. Custodians must acknowledge and accept their responsibilities by signing the Key Custody Form document. Google cipher suites used for secure encryption in TLS 1.2 are:

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_256_GCM_SHA384

4.4 Encryption algorithms

Only encryption algorithms approved by security management may be used, as shown in the table below:

Algorithm	Minimum length	Typical use
Symmetric algorithms
AES	AES 512	Data and key encryption
Skipjack	80-bits, with 32 iterations	Data encryption
Triple DES	112-bits	Data and key encryption
scrypt	256-bits	Data encryption
Asymmetric algorithms
Elliptic Curve	160-bits	Data and key encryption
RSA	2048-bits	Data and key encryption
MACs and Hashes
AES MAC	128-bits	Message authentication
MD51	128-bits, with 16 iterations	Message authentication message digest (MD)
SHA-12	N/A	Message authentication message digest (MD)
SHA-2	N/A	Message authentication message digest (MD)
TDES (Triple DES) MAC	112-bits	Message authentication
Argon2	128-bits	Message authentication
Digital signature
DSA (Digital Signature Algorithm)	1024-bits	Digital signature
Elliptic Curve DSA	160-bits	Digital signature
RSA DSA	2048-bits	Digital signature
Digital certificates
X.509 v3 compliant	N/A	Associates a public key with a specific identity.
Key transport
Diffie-Hellman	1024-bits	Digital session key establishment
Elliptic Curve Diffie-Hellman	160-bits	Digital session key establishment
Cryptographic protocols
TLS 1.3 or higher	N/A	Protocol to authenticate and encrypt communication between authenticated parties.

5. Consequences management

LATAM Group employees, collaborators, and third parties who fail to comply with this standard are subject to disciplinary measures ranging from verbal warning to termination of employment and subsequent legal action, according to applicable local regulations.

6. Definitions

Employee: Any employee, intern, or apprentice with an established contract with Group companies, affiliates, and branches/subsidiaries worldwide.

Collaborator: Interns or students in practice are students who maintain a contract with the LATAM Group or with third parties according to applicable law in each country.

Cryptography: Study of algorithms and protocols used to protect information.

Strong cryptography: Cryptography based on industry-proven and accepted algorithms, key length, and proper key management practices, such as AES (128 bits and above), ECC (224 bits and above), RSA (2048 bits and above), and El Gamal (2048 bits and above).

Encryption: Implementation of cryptography. Once encrypted, information can only be read by applying a key and is used to store or transfer sensitive information that should not be accessible to third parties. Data masking: Data transformation process that preserves the same structure without allowing reversal to recover the original data, protecting the contained information.

Encrypt: Data encryption is a security method that encodes data using mathematical algorithms, raising security and confidentiality. It is generally performed using a key so encrypted data is not readable to those without the key. This technique protects an organization's sensitive information, preventing data leakage or interception.

Decrypt: The inverse process of encryption, through which encoded data is recovered to its original state using a key. Data is only accessible and readable to those who possess the key. Private key (Symmetric): A cryptographic method that uses the same key to encrypt and decrypt, which must be exchanged through a secure channel. Public key (Asymmetric): Cryptographic method that uses a key pair. Both keys belong to the same user; one is a public key that can be shared with anyone, while the other is a private key that must be safeguarded and known only by the owner.

Plaintext: Data in its original form, i.e. unencrypted.

AES: Abbreviation for "Advanced Encryption Standard". Block cipher used in symmetric-key cryptography adopted by NIST in November 2001 as U.S. FIPS PUB 197 (or "FIPS 197").

RSA: Algorithm for asymmetric cryptography described in 1977 by Ron Rivest, Adi Shamir, and Len Adleman at MIT (Massachusetts Institute of Technology).

ECC: Abbreviation for "Elliptic Curve Cryptography". Public-key cryptography method based on elliptic curves over finite fields. SHA: Abbreviation for "Secure Hash Algorithm".

Hashing: Process that makes data unreadable by converting it into a fixed-length message summary. Hashing is a (mathematical) function in which a known algorithm takes a message of arbitrary length as input and produces a fixed-length result (usually called a "hash code" or "message digest").

7. History

Version	Modified item	Purpose of modification	Date
1.0	Document creation	Document creation and consolidation of the "Encryption Key Management Standard"	12/09/2019