NIAP: View Technical Decision Details
NIAP/CCEVS
  NIAP  »»  Protection Profiles  »»  Technical Decisions  »»  View Details  
TD0577:  Ciphersuite corrections

Publication Date
2021.02.16

Protection Profiles
MOD_STIP_V1.0

Other References
FCS_TTTC_EXT.1.1, FCS_TTTS_EXT.1.1

Issue Description

Ciphersuites improperly specified in FCS_TTTC_EXT.1.1 and FCS_TTTS_EXT.1.1.

Resolution

Replace FCS_TTTC_EXT.1.1 as follows.

FCS_TTTC_EXT.1.1           The TSF shall implement [TLS 1.2 (RFC 5246), TLS 1.0 (RFC 2246), and [selection: TLS 1.1 (RFC 4346), no other TLS versions]] as a client to the requested server that supports the following cipher suites: [

·         TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289

·         TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 as defined in RFC 5289

·         TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289

·         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 as defined in RFC 5289

·         TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5288

·         TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 as defined in RFC 5246

·         TLS_RSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5288

·         TLS_RSA_WITH_AES_256_CBC_SHA256 as defined in RFC 5246

·         TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289

·         TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 as defined in RFC 5289

·         TLS_DHE_RSA_WITH_AES_256_CCM as defined in RFC 6655

·         TLS_RSA_WITH_AES_256_CCM as defined in RFC 6655

·         TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289

·         TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5289

·         TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289

·         TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5289

·         TLS_DHE_RSA_WITH_AES_128_CCM as defined in RFC 6655

·         TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5288

·         TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246

·         TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289

·         TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5289

·         TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289

·         TLS_RSA_WITH_AES_128_CCM as defined in RFC 6655

·         TLS_RSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5288

·         TLS_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246

·         TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA as defined in RFC 8422

·         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA as defined in RFC 8422

·         TLS_DHE_RSA_WITH_AES_256_CBC_SHA as defined in RFC 5246

·         TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA as defined in RFC 8422

·         TLS_RSA_WITH_AES_256_CBC_SHA as defined in RFC 5246

·         TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA as defined in RFC 8422

·         TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA as defined in RFC 8422

·         TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA as defined in RFC 8422

·         TLS_DHE_RSA_WITH_AES_128_CBC_SHA as defined in RFC 5246

·         TLS_RSA_WITH_AES_128_CBC_SHA as defined in RFC 5426

·         TLS_RSA_WITH_AES_128_CCM_8 as defined in RFC 6655

·         TLS_DHE_WITH_RSA_AES_128_CCM_8 as defined in RFC 6655

·         TLS_DHE_RSA_WITH_AES_256_CCM_8 as defined in RFC 6655

·         TLS_RSA_WITH_AES_256_CCM_8 as defined in RFC 6655

·         [selection: [assignment: other ciphersuites supported], TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA as defined in RFC 8422, TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA as defined in RFC 5246, TLS_RSA_WITH_3DES_EDE_CBC_SHA as defined in RFC 5246, no other cipher suites]]

and also supports functionality for [selection:

·         mutual authentication,

·         session renegotiation,

·         none].

 

 

Replace FCS_TTTS_EXT.1.1 as follows.

FCS_TTTS_EXT.1.1           The TSF shall implement [TLS 1.2 (RFC 5246), TLS 1.0 (RFC 2246), and [selection: TLS 1.1 (RFC 4346), no other TLS versions]] as a server to the monitored client that supports the following cipher suites: [

·         TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289

·         TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 as defined in RFC 5289

·         TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289

·         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 as defined in RFC 5289

·         TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5288

·         TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 as defined in RFC 5246

·         TLS_RSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5288

·         TLS_RSA_WITH_AES_256_CBC_SHA256 as defined in RFC 5246

·         TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289

·         TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 as defined in RFC 5289

·         TLS_DHE_RSA_ WITH_AES_256_CCM as defined in RFC 6655

·         TLS_RSA_ WITH_AES_256_CCM as defined in RFC 6655

·         TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289

·         TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5289

·         TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289

·         TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5289

·         TLS_DHE_RSA_WITH_AES_128_CCM as defined in RFC 6655

·         TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5288

·         TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246

·         TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289

·         TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5289

·         TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289

·         TLS_RSA_WITH_AES_128_CCM as defined in RFC 6655

·         TLS_RSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5288

·         TLS_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246

·         TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA as defined in RFC 8422

·         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA as defined in RFC 8422

·         TLS_DHE_RSA_WITH_AES_256_CBC_SHA as defined in RFC 5246

·         TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA as defined in RFC 8422

·         TLS_RSA_WITH_AES_256_CBC_SHA as defined in RFC 5246

·         TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA as defined in RFC 8422

·         TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA as defined in RFC 8422

·         TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA as defined in RFC 8422

·         TLS_DHE_RSA_WITH_AES_128_CBC_SHA as defined in RFC 5246

·         TLS_RSA_WITH_AES_128_CBC_SHA as defined in RFC 5426

·         TLS_RSA_WITH_AES_128_CCM_8 as defined in RFC 6655

·         TLS_DHE_RSA_WITH_AES_128_CCM_8 as defined in RFC 6655

·         TLS_DHE_RSA_WITH_AES_256_CCM_8 as defined in RFC 6655

·         TLS_RSA_WITH_AES_256_CCM_8 as defined in RFC 6655

·         [selection: [assignment: other cipher suites supported], TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA as defined in RFC 8422, TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA as defined in RFC 5246, TLS_RSA_WITH_3DES_EDE_CBC_SHA as defined in RFC 5246, no other cipher suites]]

and no other cipher suites, and also supports functionality for [selection:

·         mutual authentication,

·         session renegotiation,

·         none].

 

 

 

Justification

Resolves any inconsistencies in cipher specification between the PP Module and the RFCs (and as referenced in IANA). Ensures proper RFC reference and clarity.

 

 
 
Site Map              Contact Us              Home