NIAP: View Technical Decision Details
NIAP/CCEVS
  NIAP  »»  Protection Profiles  »»  Technical Decisions  »»  View Details  
TD0398:  NIT Technical Decision for FCS_SSH*EXT.1.1 RFCs for AES-CTR

Publication Date
2019.02.24

Protection Profiles
CPP_FW_V2.0E, CPP_ND_V2.0E, CPP_ND_V2.1

Other References
FCS_SSHC_EXT.1.1, FCS_SSHS_EXT.1.1

Issue Description

The NIT issued a technical decision for FCS_SSH*_EXT.1.1 RFCs for AES-CTR.

Resolution

Updated 3/13/2019 to also apply to NDcPP V2.1

 

The following changes shall be performed:

NDcPPv2.0E, FWcPPv2.0E FCS_SSHC_EXT.1 and FCS_SSHS_EXT.1 SFR shall be modified as follows:

"FCS_SSH*_EXT.1.1 The TSF shall implement the SSH protocol that complies with RFC(s) [selection: 4251, 4252, 4253, 4254, 4344, 5647, 5656, 6187, 6668]."

NDcPPv2.0E FCS_SSHC_EXT.1 and FCS_SSHS_EXT.1 Application Note 90 and 97 shall be modified as follows:

The following paragraphs shall be added to the application notes:

If claiming aes128-ctr or aes256-ctr encryption methods as part of FCS_SSH*_EXT.1.4 select RFC 4344. If claiming AEAD_AES_128_GCM or AEAD_AES_256_GCM (but not @openssh variants) encryption methods as part of FCS_SSH*_EXT.1.4 select RFC 5647.

If claiming ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, or ecdsa-sha2-nistp521 public key algorithms as part of FCS_SSH*_EXT.1.5 select RFC 5656. If claiming ecdh-sha2-nistp256, ecdh-sha2-nistp384, or ecdh-sha2-nistp521 key exchange methods as part of FCS_SSH*_EXT.1.7 select RFC 5656.

If claiming x509v3_* public key authentication as part of FCS_SSH*_EXT.1.5 select RFC 6187.

If claiming hmac-sha2-256 or hmac-sha2-512 algorithms as part of FCS_SSH*_EXT.1.6 select RFC 6668. If claiming hmac-sha1 or hmac-sha1-96 algorithms as part of FCS_SSH*_EXT.1.6 claim RFC 4253.

Future versions of this cPP will include additional key exchange algorithms specified in RFC 8268 and additional RSA-based public key algorithms specified in RFC 8332.

For further information, please see the NIT interpretation at: https://www.niap-ccevs.org/Documents_and_Guidance/ccevs/NITDecisionRfI201817.pdf

Justification

See issue description.

 
 
Site Map              Contact Us              Home