The TOE is the Enveil ZeroReveal Compute Fabric Server (otherwise referred to as the ZeroReveal Server, or the TOE) software application which communicates to one or more instances of the Enveil ZeroReveal Compute Fabric Client software application via REST API over mutually authenticated HTTPS over TLS.
\r\nThe TOE is a homomorphic encryption engine for database queries. In normal database operation, a query is submitted in plain text, and a plain text answer retrieved for the querier. While the communication between the querier and the database engine itself may be transmitted through a tunnel such as IPsec, TLS, or SSH, the contents of the query are always in plaintext. The ZeroReveal Compute Fabric Client (evaluated separately) takes an authenticated user’s database query and encrypts it using Enveil’s proprietary homomorphic encryption process. This encrypted query is passed via a mutually authenticated TLS trusted channel from ZeroReveal Client to ZeroReveal Server. The encrypted query is never decrypted during this process, which prevents ZeroReveal Server and its owners/administrators from being able to tell what the query was searching for and what items in the database (if any) matched the query. The output of this process is an encrypted response that is sent back to ZeroReveal Client. In this way, the database itself is not strictly aware of what the query was and no individual point in the chain between the user and the information know what was requested.
\r\nThe ZeroReveal Server (the TOE) and ZeroReveal Client are evaluated as software applications only and the homomorphic encryption techniques used for the ZeroReveal Client and ZeroReveal Server operations are outside the scope this evaluation.
\r\nThe diagram below depicts a representative TOE deployment.
\r\nFigure 1: Representative TOE Deployment
\r\n\r\n
The TOE has been evaluated on the following host platform:
\r\n· Rocky Linux 8.7 OS on Intel Core i7-10710U (Comet Lake)
\r\nNote: The TOE is the application software and required libraries only. The host platforms are not part of the evaluation.
\r\nThe TOE supports secure connectivity with several other IT environment devices as described below.
\r\n| \r\n Components \r\n | \r\n\r\n Mandatory/ \r\nOptional \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n Hardware \r\n | \r\n||
| \r\n Enveil ZeroReveal® Compute Fabric Server v4.6.3 Host \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n The hardware running the TOE. The Server platform must include OpenJDK and Rocky Linux operating system installed. \r\n | \r\n
| \r\n Local Access \r\n | \r\n\r\n Mandatory \r\n\r\n | \r\n\r\n Local access to the ZeroReveal Server platform that enables an administrator to modify configuration files using a text editor and read log files. Access is via the local keyboard. \r\n | \r\n
| \r\n Enveil ZeroReveal® Compute Fabric Client v4.6.3 software and host platform \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n The Enveil ZeroReveal Client application which communicates with the ZeroReveal Server to process data queries in a way that does not disclose the nature of the query to any observer. The TOE communicates with the ZeroReveal Client by receiving REST API commands sent using HTTPS over TLS. \r\n | \r\n
| \r\n Remote Data Repository \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n A remotely installed and configured database containing information against which ZeroReveal queries are executed. The TOE communicates with the remote database using TLS. \r\n | \r\n
| \r\n Software \r\n | \r\n||
| \r\n Rocky Linux OS 8.7 \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n The operating system installed on the TOE’s host. \r\n | \r\n
| \r\n OpenJDK 8 \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n Java Platform that includes the Java Runtime Environment (JRE) \r\n | \r\n
\r\n
Table 1 IT Environment Components
","evaluation_configuration":"","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Enveil ZeroReveal® Compute Fabric Server v4.6.3 was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. Acumen Security determined that the evaluation assurance level (EAL) for the product is EAL 1. The product, when delivered and configured as identified in the Enveil ZeroReveal® Compute Fabric Configuration Guide for Common Criteria v3.1, Version 4.6.3 satisfies all of the security functional requirements stated in the Enveil ZeroReveal® Compute Fabric Server v4.6.3 Security Target, v2.1. The project underwent CCEVS Validator review. The evaluation was completed in May 2024. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
\r\nThe TOE is the ZeroReveal Compute Fabric Server software that includes the following libraries:
\r\n· Java JSSE Library 8
\r\n· Bouncy Castle FIPS Provider v1.0.2.3
\r\n· Bouncy Castle FIPS TLS Provider v1.0.12.3
\r\n· GMP Library v6.2.0
\r\n· SEAL Homomorphic Encryption Library v3.7.2.0
\r\nAdditionally, the TOE boundary includes configuration files that include key strings that must be completed to configure the TOE in the evaluated configuration. The configuration files are modified by administrators and are accessed using the local keyboard.
\r\nThe TOE’s operational environment requires the TOE platform to have:
\r\n· Rocky Linux 8.7 with SELinux installed and running and
\r\n· OpenJDK 8 JRE installed.
\r\nThe following diagram depicts the TOE and the Operational Environment of the ZeroReveal Compute Fabric Server Host.
\r\nFigure 2: ZeroReveal Server Host
\r\nThe TOE provides the security functionality required by [AppPP] and [TLSPkg].
\r\n\r\nThe TOE performs two kinds of cryptographic functions: those necessary to the operation of the TOEs homomorphic encrypted search function, and those necessary to the operation of the trusted path and trusted channels. Because the homomorphic encryption functionality is outside the scope of this evaluation, only those cryptographic functions necessary to support the trusted path and trusted channels are described below.
\r\n\r\n
| \r\n Cryptographic Method \r\n | \r\n\r\n Use within the TOE \r\n | \r\n
| \r\n AES-GCM \r\n | \r\n\r\n TLS encryption \r\n | \r\n
| \r\n ECDSA \r\n | \r\n\r\n TLS key generation, signature generation and verification \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n TLS key generation, signature generation and verification \r\n | \r\n
| \r\n HMAC \r\n | \r\n\r\n Message integrity and authentication for TLS \r\n | \r\n
| \r\n AES-CCM \r\n | \r\n\r\n Storage of credentials \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n Random bit generation for all cryptographic functions \r\n | \r\n
Table 2 TOE Provided Cryptography
\r\nEach of these cryptographic algorithms have been validated for conformance to the requirements specified in their respective standards, as identified below.
\r\n\r\n
| \r\n Algorithm \r\n | \r\n\r\n Standard \r\n | \r\n\r\n Mode/Keysize \r\n | \r\n\r\n CAVP Cert. # \r\n | \r\n
| \r\n Cryptographic Asymmetric Key Generation (FCS_CKM.1/AK) \r\n | \r\n|||
| \r\n RSA KeyGen \r\n\r\n | \r\n\r\n FIPS PUB 186-4, \"Digital Signature Standard (DSS)”, Appendix B.3 \r\n | \r\n\r\n 2048 and 3072 bits \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n ECDSA KeyGen \r\n\r\n | \r\n\r\n FIPS PUB 186-4, “Digital Signature Standard (DSS)”, Appendix B.4 \r\n | \r\n\r\n Curves P-256 and P-384 \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n Cryptographic Key Establishment (FCS_CKM.2) \r\n | \r\n|||
| \r\n ECDH Key Establishment \r\n\r\n | \r\n\r\n NIST SP 800-56A, “Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography” \r\n | \r\n\r\n Curves P-256 and P-384 \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n Cryptographic Operation – Hashing (FCS_COP.1/Hash) \r\n | \r\n|||
| \r\n SHA2-256 \r\n | \r\n\r\n FIPS Pub 180-4 \r\n | \r\n\r\n Digest size 256 bits \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n SHA2-384 \r\n | \r\n\r\n FIPS Pub 180-4 \r\n | \r\n\r\n Digest size 384 bits \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n SHA2-512 \r\n | \r\n\r\n FIPS Pub 180-4 \r\n | \r\n\r\n Digest size 512 bits \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n Cryptographic Operation - Keyed-Hash Message Authentication (FCS_COP.1/KeyedHash) \r\n | \r\n|||
| \r\n HMAC-SHA2-256 \r\n\r\n | \r\n\r\n FIPS Pub 198-1, ‘The Keyed-Hash Message Authentication Code’ and FIPS Pub 180-4 ‘Secure Hash Standard’ \r\n | \r\n\r\n Key size 256 bits, block size 512 bits, digest size 256 bits \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n HMAC-SHA2-384 \r\n\r\n | \r\n\r\n Key size 384 bits, block size 1024 bits, digest size 384 bits \r\n | \r\n\r\n A4651 \r\n | \r\n|
| \r\n HMAC-SHA-512 \r\n | \r\n\r\n Key size 512 bits, block size 1024 bits, digest size 512 bits \r\n | \r\n\r\n A4651 \r\n | \r\n|
| \r\n Cryptographic Operation – Signing (FCS_COP.1/Sig) \r\n | \r\n|||
| \r\n RSA Digital Signature Algorithm (rDSA) \r\n | \r\n\r\n FIPS PUB 186-4, “Digital Signature Standard (DSS)”, Section 5. \r\n | \r\n\r\n 2048-bit and 3072 bits or greater \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n ECDSA schemes \r\n | \r\n\r\n FIPS PUB 186-4, “Digital Signature Standard (DSS)”, Section 6. \r\n | \r\n\r\n P-256 and P-384 curves \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n SKC Cryptographic Operation – Encryption/Decryption (FCS_COP.1/SKC) \r\n | \r\n|||
| \r\n AES-CCM \r\n | \r\n\r\n NIST SP 800-38C \r\n | \r\n\r\n 256 bits \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n AES-CCM \r\n | \r\n\r\n NIST SP 800-38D \r\n | \r\n\r\n 256 bits \r\n | \r\n\r\n A4651 \r\n | \r\n
| \r\n Random Bit Generation from Application (FCS_RBG_EXT.2) \r\n | \r\n|||
| \r\n HMAC_DRBG \r\n | \r\n\r\n NIST SP 800-90A \r\n | \r\n\r\n SHA2-512 \r\n | \r\n\r\n A4651 \r\n | \r\n
Table 3 CAVP Algorithm Testing References
\r\n\r\n\r\n
The ZeroReveal Server network communication is restricted to user-initiated communication for responses to API requests from ZeroReveal Clients and accessing the remote database using TLS. Credentials are stored locally, encrypted using AES algorithm in CCM mode.
\r\nIdentification and Authentication
\r\nThe ZeroReveal server performs X.509v3 certificate validation functions to authenticate the certificate(s) during the establishment of the TLS trusted channels.
\r\n\r\nAdministrators manages the TOE via configuration files on each installation platform. The access interface and file editor used to modify the files is outside the scope of the TOE.
\r\nThe TOE does not include any predefined or default credentials and utilizes the platform recommended storage process for configuration files.
\r\nPrivacy
\r\nThe TOE does not collect or transmit Personally Identifiable Information (PII) over the network.
\r\nProtection of the TSF
\r\nThe TOE leverages platform provided package management for secure installation and updates. The TOE installation package includes only those third-party libraries necessary for its intended operation. The TOE utilizes compiler-provided anti-exploitation capabilities.
\r\nTrusted Path/Channels
\r\nThe TOE communicates to the ZeroReveal® Compute Fabric Client via REST API over mutually authenticated HTTPS over TLS and stores data in a remote database using TLS. Administrators configure the TOE via local access only, making changes to configuration files.
","features":[{"id":1790,"feature_name":"Certificate Authentication"},{"id":1792,"feature_name":"Certificate Validation"},{"id":1793,"feature_name":"Credential Storage"},{"id":1795,"feature_name":"DRBG"},{"id":1796,"feature_name":"DTLS 1.0"},{"id":1797,"feature_name":"DTLS Server with Mutual Authentication"},{"id":1798,"feature_name":"HTTPS Client"},{"id":1799,"feature_name":"HTTPS Server with Mutual Authentication"},{"id":1801,"feature_name":"PBKDF"},{"id":1802,"feature_name":"TLS 1.1"}]}