NIAP: Archived U.S. Government Approved Protection Profile - Department of Defense Public Key Infrastructures and Key Management In...

NIAP Oversees Evaluations of Commercial IT Products for Use in National Security Systems
Questions?  We're here to help
  NIAP  »»  Protection Profiles  »»  Archived PPs  »»  Details  
Archived U.S. Government Approved Protection Profile - Department of Defense Public Key Infrastructures and Key Management Infrastructures Token Protection Profile (Medium Robustness), Version 3.0

Medium Robustness Update

Please note that this PP was developed when “Medium Robustness” was defined as being of notably less assurance than it currently is. As such, although this PP (and products compliant to it) was considered “Medium Robustness” at the time of evaluation, it does not meet what we currently define Medium Robustness to be. For additional information on Robustness, see the Robustness FAQ .

Short Name: pp_pkikmi_tkn_mr_v3.0

Technology Type: PKI/KMI

CC Version: 2.x

Date: 2002.03.22

Sunset Date: 2008.03.21 [Sunset Icon]

Conformance Claim: EAL4 Augmented

Protection Profile [PDF]

Validation Report [PDF]



Herewith a brief summary, sufficiently detailed to enable a potential user to detemine whether the PP is of interest.

This PP specifies the information technology (IT) security requirements for a token to be used with sensitive but unclassified (SBU) applications (Class 4) in the DoD Public Key Infrastructure (PKI). The services provided by the DoD PKI include the generation, distribution, control, tracking, and destruction of public key certificates. The DoD PKI's primary goal is the secure transport of sensitive but unclassified or unclassified information using unprotected networks. The DoD PKI token carries public key certificates used to authenticate its user in public key transactions and applications.

The security requirements in this PP apply to the DoD PKI token as issued to the token holder. These requirements cover the token's integrated circuit, operating software, and specific applications when processing DoD information. This PP does not cover security requirements for token terminals or networks interfacing with them. Throughout the requirements section in this protection profile, references are made to requirements for FIPS 140-2 Level 2 for Subscribers/Level 3 for Registration Authorities and Certificate Authorities. If the DoD Common Access Card (CAC) issuing infrastructure is not capable of issuing two different levels of cards, then all CACs will be required to meet FIPS 140-2 Level 3.

This U.S. Government Approved Protection Profile is not assigned to any Validated Products

This U.S. Government Approved Protection Profile does not have any related Technical Decisions

Please forward any Protection Profile specific comments to the applicable Technical Rapid Response Team (TRRT).

Please forward any general questions to our Q&A tool.

Site Map              Contact Us              Home