NIAP: View Technical Decision Details
NIAP/CCEVS
  NIAP  »»  Protection Profiles  »»  Technical Decisions  »»  View Details  
Archived TD0092:  FCS_KYC_EXT.1 - Key Integrity

Publication Date
2016.06.30

Protection Profiles
PP_APP_SWFE_EP_v1.0, PP_SWFDE_v1.1

Other References
PP_APP_SWFE_EP_v1.0, PP_SWFDE_v1.1, FCS_KYC_EXT.1

Issue Description

In the Application Software Protection Profile (ASPP) Extended Package: File Encryption (SWFE) v1.0, FCS_KYC_EXT.1 specifies the requirements for protecting key chains.  Key combining and key wrapping options are included.  Is it also acceptable to use key encryption within the key chain?

Resolution

Change key chaining to the following (changes are in bold):

FCS_KYC_EXT.1       Key Chaining and Key Storage

FCS_KYC_EXT.1.1        The TSF shall maintain a primary key chain of:

[selection:

·         a conditioned password as the FEK;

·         KEKs originating from one or more authorization factors(s) to the FEK(s) using the following method(s):

[selection:

utilization of the platform key storage;

utilization of platform key storage that performs key wrap with a TSF provided key;

implement key wrapping as specified in FCS_COP.1(5);

implement key combining as specified in FCS_SMC_EXT.1;

implement key encryption as specified in FCS_COP.1(1) in CBC mode

]

while maintaining an effective strength of [selection:

·         [selection: 128 bits, 256 bits] for symmetric keys;

·         [selection: 112 bits, 128 bits, 192 bits, 256 bits] for asymmetric keys;

] commensurate with the strength of the FEK

]

and [selection:

·         no supplemental key chains,

·         other supplemental key chains that protect a key or keys in the primary key chain using the following method(s):

[selection:

utilization of the platform key storage,

utilization of the platform key storage that performs key wrap with a TSF provided key,

implement key wrapping as specified in FCS_COP.1(5),

implement key combining as specified in FCS_SMC_EXT.1;

implement key encryption as specified in FCS_COP.1(1) in CBC mode

]

].

Justification

Key integrity is not necessary as part of a data at rest implementation, so keys may be protected with AES in CBC mode.

 
 
Site Map              Contact Us              Home