Security & Cryptography

Details of the cryptographic algorithms and protection layers used by KUTIM-CSIRT services.

TLP:CLEAR ·  56 views

Last updated 24 October 2026

This page details the cryptography used by KUTIM-CSIRT services. The algorithms are aligned with the Indonesian Cryptographic Algorithms (AKI), the list set by BSSN Head Decree No. 443 of 2025 in implementation of BSSN Regulation No. 11 of 2024. Algorithms not on that list are rejected, not merely given lower preference.

Connection (TLS)

Protocol TLS 1.3, TLS 1.2 TLS 1.0 and TLS 1.1 are rejected entirely.
Cipher Suite TLS_AES_256_GCM_SHA384 On TLS 1.2: ECDHE-ECDSA/RSA-AES256-GCM-SHA384.
Key Exchange X25519, secp384r1 Curve25519 and P-384, both included in the AKI list.
Post-Quantum X25519MLKEM768 Hybrid X25519 + ML-KEM-768. Traffic recorded today stays protected even if quantum computers become available in the future.
Rejected AES-128, ChaCha20, P-256 Outside the AKI list, so never negotiated at all.
Certificate RSA 4096 bit · SHA-256 A publicly trusted wildcard certificate, renewed on 31 August 2026. The AKI list sets a minimum RSA key length of 3072 bits; the key in use exceeds that threshold.
HSTS max-age=31536000 includeSubDomains; preload.
Session Resumption off Session tickets and the session cache are disabled, so session keys never leave the server and forward secrecy is preserved.

Application protection

This service sits behind several layers of filtering that act before requests reach the application. Technical details and configuration are deliberately not published.

  • Filtering of malicious requests in front of the application, covering commonly known web attack patterns.
  • Automated visitor checks to hold back automated traffic that abuses the service.
  • Browser security headers are active on all public pages, including a content security policy.
  • Request rate limiting and browser-based proof-of-work anti-automation verification on all public forms, without any third-party service.
  • Public pages are served as static pages, with no session cookies for general visitors. The administration panel is separated from the public website and can only be accessed from the internal network of the East Kutai Regency Government.
  • Monitoring and logging run continuously and are connected to the security operations center of Diskominfo East Kutai.

Protecting your reports

  • The database sits on an internal network isolated from the internet and can only be reached by application components. Each component uses separate access rights limited to what it needs.
  • Evidence files attached to incident reports are not publicly accessible and are available only to staff authorized to handle them.
  • Visitor statistics do not store IP addresses. Visits are counted using a daily random code (HMAC-SHA256) that cannot be reversed to the original address and changes every day.
  • Incidents can be reported anonymously, and ticket status tracking uses a random token that is checked in a way that resists guessing.
  • The KUTIM-CSIRT PGP key is available for reporters who wish to send sensitive information in encrypted form.

References

  • National Cyber and Crypto Agency Regulation No. 11 of 2024.
  • Decree of the Head of the National Cyber and Crypto Agency No. 443 of 2025 on the Indonesian Cryptographic Algorithms.

Found a security flaw in our services? Please report it through the Vulnerability Disclosure Policy or the Report Incident form. We follow up on responsible reports and credit the reporters.