NIAP Oversees Evaluations of Commercial IT Products for Use in National Security Systems

Short Name: mod_vpn_cli_v2.1

Technology Type: Virtual Private Network

CC Version: 3.1

Date: 2017.10.05

Preceded By: ep_vpn_cli_v2.0

Succeeded By: mod_vpnc_v2.2

Sunset Date: 2021.05.05

Conformance Claim: None

Protection Profile 

Supporting Docs 

PP-Configuration for MDF-VPNC_V1.0 

PP Configuration for GPOS-VPNC_v1.0 

Control Mapping 

PP Configuration for MDF-MDM_AGENT-VPNC_V1.0  

PP OVERVIEW

The scope of this PP-Module is to describe the security functionality of a virtual private network (VPN) client in terms of [CC] and to define functional and assurance requirements for such products. This PP-Module is intended for use with the following Base-PPs:

·         Protection Profile for General Purpose Operating Systems (GPOS PP); or

·         Protection Profile for Mobile Device Fundamentals (MDF PP); or

·         Protection Profile for Application Software (App PP).

These Base-PPs are all valid because a VPN client may be a specific type of stand-alone software application or a built-in component of an operating system, whether desktop or mobile. Regardless of which Base-PP is claimed, the VPN client functionality defined by this PP-Module will rely on the Base-PP. Sections 5.1, 5.2, and 5.3 of this PP-Module describe the relevant functionality for each Base-PP, including specific selections, assignments, or inclusion of optional requirements that must be made as needed to support the VPN client functionality.

Assigned to the following Validated Products

• VID11146 – Apple iOS 14: iPhones
• VID11147 – Apple iPadOS 14: iPads
• Microsoft Windows 10 version 2004 (May 2020 Update), Microsoft Windows Server version 2004 (May 2020 Update) and others

Archived Related Technical Decisions

• 0508 – Conformance Claim to allow for a PP-Module
• 0504 – Cryptographic selections and updates for use with VPN Client PP-Module w/MDF PP
• 0503 – Cryptographic selections and updates for use with VPN Client PP-Module w/OS PP
• 0485 – PP-Configuration for Application Software and Virtual Private Network (VPN) Clients not allowed
• 0404 – Cryptographic selections and updates for use with App PP v1.3
• 0387 – VPN Client Required SFR for GPOS as Base PP
• 0385 – FTP_DIT_EXT.1 Assurance Activity Clarification
• 0379 – Updated FCS_IPSEC_EXT.1.11 Tests for VPN Client
• 0378 – TOE/TOE Platform Selection in FCS_IPSEC_EXT.1 SFRs
• 0373 – RSA-based Key Establishment
• 0362 – "Failure of the randomization process" audit
• 0355 – FCS_CKM.1/VPN for IKE authentication
• 0330 – Curve25519 scheme moved to optional and FFC scheme using DH Group 14 added
• 0303 – IKEv1 and support for XAUTH