% usage of crypt()
\begin{enumerate}[label={V7.\arabic*}]

  \addtocounter{enumi}{1}
    \item
    \pass{}
    Verify that all cryptographic modules fail securely, and errors are handled
    in a way that does not enable oracle padding.
    \begin{result}
    The only cryptographic operation is the hashing of the password, which can
      not be vulnerable to a padding attack as it does not use a block cipher.
    \end{result}


  \addtocounter{enumi}{3}
  \notapplicable{
    \item
    Verify that all random numbers, random file names, random \GUID{}s, and random
    strings are generated using the cryptographic module’s approved random
    number generator when these random values are intended to be not guessable
    by an attacker.
  }

    \item
    \fail{}
    Verify that cryptographic algorithms used by the application have been
    validated against FIPS 140{-}2 or an equivalent standard.
    \begin{result}
    The application uses MD5 for password hashing, which is insecure by current
    standards
    \end{result}

  \notapplicable{
    \item
    Verify that cryptographic modules operate in their approved mode according
    to their published security policies.
  }

  \notapplicable{
    \item
    Verify that there is an explicit policy for how cryptographic keys are
    managed (e.g., generated, distributed, revoked, and expired). Verify that
    this key lifecycle is properly enforced.
  }

  \addtocounter{enumi}{1}
  \notapplicable{
    \item
    Verify that all consumers of cryptographic services do not have direct
    access to key material. Isolate cryptographic processes, including master
    secrets and consider the use of a virtualized or physical hardware key vault
    (HSM).
  }

  \notapplicable{
    \item
    \textit{Personally Identifiable Information} should be stored encrypted at
    rest and ensure that communication goes via protected channels.
  }

  \notapplicable{
    \item
    Verify that sensitive passwords or key material maintained in memory is
    overwritten with zeros as soon as it no longer required, to mitigate memory
    dumping attacks.
    % FIXME(dsprenkels) Passwords should be zero'd?
  }

  \notapplicable{
    \item
    Verify that all keys and passwords are replaceable, and are generated or
    replaced at installation time.
    % FIXME(dsprenkels) This *is* relevant (passwords)
  }

  \notapplicable{
    \item
    Verify that random numbers are created with proper entropy even when the
    application is under heavy load, or that the application degrades gracefully
    in such circumstance.
    % FIXME(dsprenkels) This *is* relevant: password generation of the admin
    %                   password in the install script uses a Mersenne twister!
  }

\end{enumerate}
