The Target of Evaluation (TOE) is Samsung Knox File Encryption 1.3. The TOE is a service built into the Knox work profile that can provide an additional layer of file encryption when a work profile is created with File Encryption enabled. This is available on devices that launch with Android 11 and Knox 3.7.
\r\nThe Knox File Encryption service runs in the background and utilizes Samsung Android cryptographic modules to provide file encryption services for the Knox work profile. The service is designed to run without any user intervention as all files in the Knox work profile will be encrypted automatically
","evaluation_configuration":"The evaluated configuration consists of Samsung Knox File Encryption 1.3 (the version is listed as “DualDAR”) on the following devices:
\r\n| \r\n Device Name \r\n | \r\n\r\n Model | \r\n\r\n Chipset Vendor \r\n | \r\n\r\n CPU \r\n | \r\n\r\n Android | \r\n\r\n TEE OS \r\n | \r\n\r\n Knox Version \r\n | \r\n\r\n DualDAR Version \r\n | \r\n
| \r\n Galaxy S21 Ultra 5G \r\n | \r\n\r\n SM-G998B \r\n | \r\n\r\n Samsung \r\n | \r\n\r\n Exynos 2100 \r\n | \r\n\r\n 11 \r\n | \r\n\r\n TEEGRIS 4.2 \r\n | \r\n\r\n 3.7 \r\n | \r\n\r\n 1.3.0 \r\n | \r\n
| \r\n Galaxy S21 Ultra 5G \r\n | \r\n\r\n SM-G998U \r\n | \r\n\r\n Qualcomm \r\n | \r\n\r\n Snapdragon 888 \r\n | \r\n\r\n 11 \r\n | \r\n\r\n QSEE 5.11 \r\n | \r\n\r\n 3.7 \r\n | \r\n\r\n 1.3.0 \r\n | \r\n
| \r\n Galaxy S20+ \r\n | \r\n\r\n SM-G986B \r\n | \r\n\r\n Samsung \r\n | \r\n\r\n Exynos 990 \r\n | \r\n\r\n 11 \r\n | \r\n\r\n TEEGRIS 4.1 \r\n | \r\n\r\n 3.7 \r\n | \r\n\r\n 1.3.0 \r\n | \r\n
| \r\n Galaxy S20+ \r\n | \r\n\r\n SM-G986U \r\n | \r\n\r\n Qualcomm \r\n | \r\n\r\n Snapdragon 865 \r\n | \r\n\r\n 11 \r\n | \r\n\r\n QSEE 5.8 \r\n | \r\n\r\n 3.7 \r\n | \r\n\r\n 1.3.0 \r\n | \r\n
| \r\n Galaxy S10e \r\n | \r\n\r\n SM-G970F \r\n | \r\n\r\n Samsung \r\n | \r\n\r\n Exynos 9820 \r\n | \r\n\r\n 11 \r\n | \r\n\r\n TEEGRIS 3.1 \r\n | \r\n\r\n 3.7 \r\n | \r\n\r\n 1.3.0 \r\n | \r\n
| \r\n Galaxy S10+ \r\n | \r\n\r\n SM-G975U \r\n | \r\n\r\n Qualcomm \r\n | \r\n\r\n Snapdragon 855 \r\n | \r\n\r\n 11 \r\n | \r\n\r\n QSEE 5.2 \r\n | \r\n\r\n 3.7 \r\n | \r\n\r\n 1.3.0 \r\n | \r\n
| \r\n Galaxy Tab Active3 \r\n | \r\n\r\n SM-T575 \r\n | \r\n\r\n Samsung \r\n | \r\n\r\n Exynos 9810 \r\n | \r\n\r\n 11 \r\n | \r\n\r\n TEEGRIS 4.0 \r\n | \r\n\r\n 3.7 \r\n | \r\n\r\n 1.3.0 \r\n | \r\n
Table 1 - Evaluated Devices
\r\nIn addition to the evaluated devices, the following device models are claimed as equivalent with a note about the differences between the evaluated device and the equivalent models.
\r\n| \r\n\r\n | \r\n\r\n CPU \r\n | \r\n\r\n Equivalent Devices \r\n | \r\n\r\n Differences \r\n | \r\n
| \r\n Galaxy S21 Ultra (Samsung) \r\n | \r\n\r\n Exynos 2100 \r\n | \r\n\r\n Galaxy S21+ (Samsung) \r\nGalaxy S21 (Samsung) \r\n | \r\n\r\n · All devices have same software environments (Android, Kernel, TEE) \r\n | \r\n
| \r\n Galaxy S21 Ultra (Qualcomm) \r\n | \r\n\r\n Snapdragon 888 \r\n | \r\n\r\n Galaxy S21+ (Qualcomm) \r\nGalaxy S21 (Qualcomm) \r\n | \r\n\r\n · All devices have same software environments (Android, Kernel, TEE) \r\n | \r\n
| \r\n Galaxy S20+ (Samsung) \r\n | \r\n\r\n Exynos 990 \r\n | \r\n\r\n Galaxy S20 Ultra (Samsung) \r\nGalaxy S20 (Samsung) \r\nGalaxy Note20 Ultra 5G/LTE (Samsung) \r\nGalaxy Note20 5G/LTE (Samsung) \r\n | \r\n\r\n · All devices have same software environments (Android, Kernel, TEE) \r\n | \r\n
| \r\n Galaxy S20+ (Qualcomm) \r\n | \r\n\r\n Snapdragon 865 \r\n | \r\n\r\n Galaxy S20 Ultra (Qualcomm) \r\nGalaxy S20 (Qualcomm) \r\nGalaxy S20 TE (Qualcomm) \r\nGalaxy Note20 Ultra 5G (Qualcomm) \r\nGalaxy Note20 5G (Qualcomm) \r\nGalaxy Tab S7+ \r\nGalaxy Tab S7 \r\n | \r\n\r\n · All devices have same software environments (Android, Kernel, TEE) \r\n | \r\n
| \r\n Galaxy S10e (Samsung) \r\n | \r\n\r\n Exynos 9820 \r\n | \r\n\r\n Galaxy S10+ (Samsung) \r\nGalaxy S10 5G (Samsung) \r\nGalaxy S10 (Samsung) \r\nGalaxy Note10+ 5G (Samsung) \r\nGalaxy Note10+ (Samsung) \r\nGalaxy Note10 5G (Samsung) \r\n | \r\n\r\n · All devices have same software environments (Android, Kernel, TEE) \r\n· Note10 (Samsung) devices have Exynos 9825 CPU \r\n | \r\n
| \r\n Galaxy S10+ (Qualcomm) \r\n | \r\n\r\n Snapdragon 855 \r\n | \r\n\r\n Galaxy S10 5G (Qualcomm) \r\nGalaxy S10 (Qualcomm) \r\nGalaxy S10e (Qualcomm) \r\nGalaxy Note10+ 5G (Qualcomm) \r\nGalaxy Note10+ (Qualcomm) \r\nGalaxy Note10 (Qualcomm) \r\n | \r\n\r\n · All devices have same software environments (Android, Kernel, TEE) \r\n | \r\n
| \r\n Galaxy Tab Active3 \r\n | \r\n\r\n Exynos 9810 \r\n | \r\n\r\n Galaxy Tab Active3 \r\n | \r\n\r\n · All devices have same software environments (Android, Kernel, TEE) \r\n | \r\n
Table 2 - Equivalent Devices
","security_evaluation_summary":"The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Samsung File Encryption 1.3 Administrator Guide, Version 1.3, 04/19/2021 document, satisfies all of the security functional requirements stated in the Samsung Electronics Co., Ltd. Samsung Knox File Encryption 1.3 (PP_APP_V1.3/MOD_FE_V1.0) Security Target, Version 1.0, 04/19/2021. The project underwent CCEVS Validator review. The evaluation was completed in June 2021. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-11161-2021) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of Samsung Knox File Encryption 1.3 are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\nCryptographic support:
\r\nThe TOE runs as part of Samsung Android 11 with Knox 3.7 and includes several cryptographic libraries for encryption/decryption/cryptographic hashing functions for securing file contents and TOE keys.
\r\nUser data protection:
\r\nThe TOE protects all user data within the Knox work profile by providing an automatic encryption service for all files stored within the container; applications do not have to be made aware of the Knox File Encryption service to be protected. All keys are AES 256-bit, using AES-GCM for FEK protection and AES-CBC for file content protection.
\r\nIdentification and authentication:
\r\nThe TOE utilizes the authentication services provided by the Knox work profile to unlock the Master Key. Unsuccessful authentication to the Knox work profile will prevent the Master Key from being unlocked, and hence no files in the container can be accessed.
\r\nSecurity management:
\r\nThe services provided by the TOE are not available until a Knox work profile with File Encryption enabled is created on the device. Authentication management and the container lock settings are handled by the Knox work profile management and are generic for all Knox work profile configurations.
\r\nPrivacy:
\r\nThe TOE does not transmit Personally Identifiable Information over any network interfaces nor does it request access to any applications that may contain such information.
\r\nProtection of the TSF:
\r\nThe TOE relies on the physical boundary of the evaluated platform as well as the Samsung Android operating system for the protection of the TOE’s components.
\r\nThe TOE relies on the Samsung Android operating system to provide updates as the software is incorporated as part of the device image. The version of the Knox File Encryption software can be seen in the About Device page with the Knox version information (as the DualDAR version).
\r\nThe TOE is a Samsung component, and all code is maintained solely by Samsung. Only documented APIs available in Samsung Android (which includes the Knox work profile and Samsung cryptographic libraries) are used.
\r\nTrusted path/channels:
\r\nThe TOE does not transmit information over any network interfaces.
","features":[]}