The TOE consists of one or more physical devices as specified in section 1.7 of the ST along with MACsec-supporting hardware (8800-LC-48H) and includes the Cisco IOS-XR software. The TOE has two or more network interfaces and is connected to at least one internal and one external network. The Cisco IOS-XR configuration determines how packets are handled to and from the TOE’s network interfaces. The router configuration will determine how traffic flows received on an interface will be handled. Typically, packet flows are passed through the internetworking device and forwarded to their configured destination.
\r\nAn external syslog server must be used to store audit records. The TOE authenticates those devices with X.509v3 certificates and protects communication channels with the TLS protocol. Secure remote administration is protected with SSH which is implemented with authentication failure handling.
\r\nFor remote administration, a secure session using SSHv2 must be established.
","evaluation_configuration":"The following figure provides a visual depiction of an example TOE deployment:
\r\nThe previous figure includes the following:
\r\n· The following are considered to be in the IT Environment:
\r\no MACsec Peer
\r\no Management Workstation
\r\no Audit (Syslog) Server
\r\no Local Console
\r\no Certificate Authority
\r\nNOTE: While the previous figure includes several non-TOE IT environment devices, the TOE is only the C8000 device. Only one TOE device is required for deployment in an evaluated configuration.
","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Cisco 8000 Series Routers running IOS-XR Version 7.3 was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered configured as identified in the Cisco 8000 Series Routers running IOS-XR Version 7.3 Common Criteria Operational User Guidance, satisfies all of the security functional requirements stated in the Cisco 8000 Series Routers running IOS-XR Version 7.3 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in November 2022. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE is comprised of several security features. Each of the security features identified above consists of several security functionalities, as identified below.
\r\n· Security Audit
\r\n· Cryptographic Support
\r\n· Identification and Authentication
\r\n· Security Management
\r\n· Protection of the TSF
\r\n· TOE Access
\r\n· Trusted Path/Channels
\r\n\r\n
These features are described in more detail in the subsections below. In addition, the TOE implements all SFRs of the NDcPP v2.2e and MACsec EP v1.2 as necessary to satisfy testing/assurance measures prescribed therein.
\r\nThe TOE provides extensive auditing capabilities. The TOE can audit events related to cryptographic functionality, identification and authentication, and administrative actions. The TOE generates an audit record for each auditable event. Each security relevant audit event has the date, timestamp, event description, and subject identity. The administrator configures auditable events, performs back-up operations and manages audit data storage. The TOE provides the administrator with a circular audit trail. The TOE is configured to transmit its audit messages to an external syslog server over an encrypted channel using TLS.
\r\nThe TOE provides cryptography in support of other TOE security functionality. All the algorithms claimed have CAVP certificates (Operational Environment – Intel Xeon D-1530 (Broadwell)). In addition, the TOE supports MACsec using the CoMIRA Mentor Questa Sim 10.7 processor (see Table 1 for certificate references).
\r\n\r\n| \r\n Algorithm \r\n | \r\n\r\n Description \r\n | \r\n\r\n Supported Mode \r\n | \r\n\r\n Module \r\n | \r\n\r\n CAVP Cert. # \r\n | \r\n\r\n SFR \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used for symmetric encryption/decryption \r\n | \r\n\r\n CBC (128 and 256) GCM (128 and 256) CTR (128 and 256) | \r\n\r\n FOM 6.2 \r\n | \r\n\r\n A388 \r\n | \r\n\r\n FCS_COP.1/DataEncryption FCS_COP.1(2) Cryptographic Operation \r\n | \r\n
| \r\n GCM (128 and 256) \r\n | \r\n\r\n MACsec \r\n | \r\n\r\n C1668 \r\n | \r\n|||
| \r\n SHS (SHA-1, SHA-256, SHA-512) \r\n | \r\n\r\n Cryptographic hashing services \r\n | \r\n\r\n Byte Oriented \r\n | \r\n\r\n FOM 6.2 \r\n | \r\n\r\n A388 \r\n | \r\n\r\n FCS_COP.1/Hash \r\n | \r\n
| \r\n HMAC (HMAC-SHA-1, HMAC-SHA-256, SHA-512) \r\n | \r\n\r\n Keyed hashing services and software integrity test \r\n | \r\n\r\n Byte Oriented \r\n | \r\n\r\n FOM 6.2 \r\n | \r\n\r\n A388 \r\n | \r\n\r\n FCS_COP.1/KeyedHash \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n Deterministic random bit generation services in accordance with ISO/IEC 18031:2011 \r\n | \r\n\r\n CTR_DRBG (AES 256) \r\n | \r\n\r\n FOM 6.2 \r\n | \r\n\r\n A388 \r\n | \r\n\r\n FCS_RBG_EXT.1 \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n Signature Verification and key transport \r\n | \r\n\r\n PKCS#1 v.1.5, 3072 bit key, \r\nFIPS 186-4 Key Gen \r\n | \r\n\r\n FOM 6.2 \r\n | \r\n\r\n A388 \r\n | \r\n\r\n FCS_CKM.1 | \r\n
The TOE provides cryptography in support of remote administrative management via SSHv2 and secures the session between the C8000 and remote syslog server using TLS.
\r\nThe TOE authenticates and encrypts packets between itself and a MACsec peer. The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys to protect data exchanged by the peers.
\r\nThe cryptographic services provided by the TOE are described in Table 2 below:
\r\nTable 2: TOE Provided Cryptography
\r\n| \r\n Cryptographic Method \r\n | \r\n\r\n Use within the TOE \r\n | \r\n
| \r\n Secure Shell Establishment \r\n | \r\n\r\n Used to establish initial SSH session. \r\n\r\n | \r\n
| \r\n RSA Signature Services \r\n | \r\n\r\n Used in SSH session establishment. X.509 certificate signing. \r\n\r\n | \r\n
| \r\n SHS \r\n | \r\n\r\n Used to provide SSH traffic integrity verification \r\nUsed for keyed-hash message authentication \r\n\r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used to encrypt SSH session traffic. \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n Used to provide cryptographic signature services \r\n\r\n | \r\n
| \r\n HMAC \r\n | \r\n\r\n Used for keyed hash, integrity services in SSH session establishment. | \r\n
| \r\n TLS \r\n | \r\n\r\n Used to secure traffic to the syslog server. | \r\n
The TOE provides authentication services for administrative users wishing to connect to the TOEs secure CLI administrator interface. The TOE requires Authorized Administrators to authenticate prior to being granted access to any of the management functionality. The TOE can be configured to require a minimum password length of 15 characters as well as mandatory password complexity rules.
\r\nAfter a configurable number of incorrect login attempts, C8000 will lockout the account until a configured amount of time for lockout expires.
\r\nThe TOE provides administrator authentication against a local user database. Password-based authentication can be performed on the serial console or SSH interfaces. The SSHv2 interface also supports authentication using SSH keys.
\r\nThe TOE uses X.509v3 certificates as defined by RFC 5280 to support authentication for TLS connections.
\r\nThe TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. All TOE administration occurs either through a secure SSHv2 session or via a local console connection. The TOE provides the ability to securely manage all TOE administrative users, all identification and authentication, all audit functionality of the TOE, all TOE cryptographic functionality, the timestamps maintained by the TOE, and updates to the TOE. The TOE supports a privileged administrator role. Only the privileged administrator can perform the above security relevant management functions.
\r\nAdministrators can create configurable login banners to be displayed at time of login and can also define an inactivity timeout for each admin interface to terminate sessions after a set period of inactivity.
\r\nThe TOE protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to Authorized Administrators. The TOE prevents reading of cryptographic keys and passwords. Additionally, Cisco IOS-XR is not a general-purpose operating system and access to Cisco IOS-XR memory space is restricted to only Cisco IOS-XR functions.
\r\nThe TOE is also able to detect replay of information received via secure channels (MACsec). The detection applied to network packets that terminate at the TOE, such as trusted communications between the TOE and an IT entity (e.g., MACsec peer). If replay is detected, the packets are discarded.
\r\nThe TOE internally maintains the date and time. This date and time is used as the timestamp that is applied to audit records generated by the TOE. Administrators can update the TOE’s clock manually. Finally, the TOE performs testing to verify correct operation of the router itself and that of the cryptographic module.
\r\nThe TOE is able to verify any software updates prior to the software updates being installed on the TOE to avoid the installation of unauthorized software.
\r\nThe TOE can terminate inactive sessions after an Authorized Administrator configurable time-period. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session.
\r\nThe TOE can also display a Security Administrator specified banner on the CLI management interface prior to allowing any administrative access to the TOE.
\r\nThe TOE establishes a trusted path between the appliance and the CLI using SSHv2 and the syslog server using TLS. MACsec is used to secure communication channels between MACsec peers at Layer 2.
","features":[]}