NIAP: View Technical Decision Details
NIAP/CCEVS
  NIAP  »»  Protection Profiles  »»  Technical Decisions  »»  View Details  
TD0771:  Correction to FIA_PSK_EXT.3 EA

Publication Date
2023.07.17

Protection Profiles
MOD_VPNGW_v1.2

Other References
FIA_PSK_EXT.3

Issue Description

The evaluation acitivity for FIA_PSK_EXT.3 states: "The evaluator shall examine the TSS to ensure it describes the process by which the bit-based pre-shared keys are used." The text "bit-based" does not belong in the TSS and Guidance EAs for FIA_PSK_EXT.3. 

Resolution

FIA_PSK_EXT.3 in the MOD_VPNGW_V1.2 Supporting Document is modified as following, with red highlighted strikethrough denoting and green highlighted underlines denoting additions: 

FIA_PSK_EXT.3 Password-Based Pre-Shared Keys

FIA_PSK_EXT.3 
TSS

The evaluator shall examine the TSS to ensure it describes the process by which the  bit-based password-based  pre-shared keys are used.

Support for length: The evaluator shall check to ensure that the TSS describes the allowable ranges for PSK lengths, and that at least 64 characters or a length defined by the platform may be specified by the user.
Support for character set: The evaluator shall check to ensure that the TSS describes the allowable character set and that it contains the characters listed in the SFR.
Support for PBKDF: The evaluator shall examine the TSS to ensure that the use of PBKDF2 is described and that the key sizes match that described by the ST author.
The evaluator shall check that the TSS describes the method by which the PSK is first encoded and then fed to the hash algorithm. The settings for the algorithm (padding, blocking, etc.) shall be described, and the evaluator shall verify that these are supported by the selections in this component as well as the selections concerning the hash function itself.
For the NIST SP 800-132-based conditioning of the PSK, the required evaluation activities will be performed when doing the evaluation activities for the appropriate requirements (FCS_COP.1/KeyedHash).
The evaluator shall confirm that the minimum length is described.
The ST author shall provide a description in the TSS regarding the salt generation. The evaluator shall confirm that the salt is generated using an RBG described in FCS_RBG_EXT.1.
[conditional] If password strength meter or password denylist is selected, the evaluator shall examine the TSS to ensure any password checking functionality provided by the TSF is described and contains details on how the function operates.

Guidance

The evaluator shall confirm the operational guidance contains instructions for entering bit-based password-based pre-shared keys for each protocol identified in the requirement, or generating a bit-based pre-shared key (or both).The evaluator shall confirm that any management functions related to pre-shared keys that are performed by the TOE are specified in the operational guidance.
The guidance must specify the allowable characters for pre-shared keys, and that list must include, at minimum, the same items contained in FIA_PSK_EXT.3.2.
The evaluator shall confirm the operational guidance contains any necessary instructions for enabling and configuring password checking functionality.

Justification

See issue description. 

 
 
Site Map              Contact Us              Home