The Axway Validation Authority Server (Server) is part of Axway’s Validation Authority Suite, which provides a comprehensive, scalable, and reliable framework for real-time validation of digital certifications for the Public Key Infrastructure (PKI). The Axway VA Suite provides a variety of PKI and certificate management functionality to prevent revoked credentials from being used for secure email, smart card login, network access (including wireless), or other sensitive electronic transactions. The administrator can configure the Axway VA Server to act in one of two manners: Repeater or Responder. One can think of the Repeater, conceptually the simpler configuration, as a revocation caching proxy (locally caching CRLs and OCSP responses). While the Responder can locally cache CRLs and generate new OCSP responses (using the certificate statuses within the CRLs) for clients.
\r\nThe TOE provides the following functionality:
\r\n[1] The use of a Hardware Security Module (HSM) is not included in the evaluated configuration.
\r\n\r\n
The Axway Validation Authority Server runs on the following platforms:
\r\nThe Windows and RHEL platforms are part of the operating environment of the TOE. The TOE can execute on any Intel Xeon processor, however the lab tested the TOE on an Intel Xeon E5-2670. The lab also tested the TOE on Windows Server 2022 (64 bit) and RHEL 8 (64 bit) in the evaluated configuration. The TOE binaries remain unchanged for each flavor of operating systems. Thus, the same TOE binaries compiled as Windows executables are used for all claimed Windows operating systems, and the same TOE binaries compiled as 64-bit ELF executables are used for all claimed Red Hat Linux distributions.
\r\nThe Axway VA Suite is composed of the following applications:
\r\nThe focus of the evaluation is the Validation Authority Server (VA Server).
","security_evaluation_summary":"The evaluation was carried out in accordance to the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. The criteria against which the TOE was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Evaluation Methodology, Version 3.1, Revision 5, April 2017. The product, when delivered and configured as identified in the Axway Validation Authority Common Criteria Guide, Version 5.2, July 1, 2024 document, satisfies all of the security functional requirements stated in the Axway Validation Authority Server, version 5.2 Security Target, Version .04, July 2, 2024. The project underwent CCEVS Validator review. The evaluation was completed in July 2024. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11452-2024) prepared by CCEVS.
","environmental_strengths":"The logical boundaries of the Axway Validation Authority Server are realized in the security functions that it implements. Each of these security functions is summarized below.
\r\n\r\n
Cryptographic support:
\r\nThe TOE uses CAVP-validated cryptographic algorithm implementations, provided by the Axway Security Kernel, a cryptographic module built from OpenSSL 3.0.0, to support asymmetric key generation, encryption/decryption, signature generation and verification and establishment of trusted channels to protect data in transit. The TOE provides a web server for TLS/HTTPS to facilitate trusted remote communications and implements functionality to securely store key data related to secure communications. The TOE also relies on the underlying platform to generate entropy that is used as input data for the TOE’s deterministic random bit generator (DRBG).
\r\nUser data protection:
\r\nThe TOE does not access any hardware resources (other than network connectivity) or sensitive information repositories. The TOE does not store any sensitive data in non-volatile memory. Inbound and outbound network communications are restricted to those that are application initiated.
\r\nIdentification and authentication:
\r\nThe TOE implements X509 certificate validation to validate the revocation status of certificates using CRL. The TOE uses X509 certificates to support HTTPS/TLS authentication of administrators.
\r\nSecurity management:
\r\nThe TOE provides a Web-based Graphical User Interface (Web GUI) to access and manage the TOE security functions. When configured with default credentials or no credentials, the TOE restricts its functionality and only allows the ability to set new credentials. By default, the TOE is configured with file permissions to protect itself and its data from unauthorized access.
\r\nPrivacy:
\r\nThe TOE does not transmit personally identifiable information (PII) over any network interfaces.
\r\nProtection of the TSF:
\r\nThe TOE protects itself against exploitation by implementing address space layout randomization (ASLR) and by not allocating any memory region for both write and execute permission. The TOE is compiled for both Windows and Linux with stack-based buffer overflow protection and does not allow user-modifiable files to be written to directories that contain executable files. The TOE uses standard platform APIs and includes a number of third party libraries used to perform its functions.
\r\nThe TOE includes mechanisms to check for updates and to query the current version of the application software. TOE software is digitally signed and distributed using the platform-supported package manager (Windows or Linux). The TOE does not update its own binary code in any way and when removed, all traces of the TOE application software are deleted.
\r\nTrusted path/channels:
\r\nThe TOE protects communications between itself and remote administrators using HTTPS/TLS.
","features":[{"id":562,"feature_name":"Certificate Authentication"},{"id":563,"feature_name":"Certificate Validation"},{"id":564,"feature_name":"Credential Storage"},{"id":565,"feature_name":"DRBG"},{"id":566,"feature_name":"DTLS 1.0"},{"id":567,"feature_name":"DTLS Server with Mutual Authentication"},{"id":568,"feature_name":"HTTPS Client"},{"id":569,"feature_name":"HTTPS Server with Mutual Authentication"},{"id":570,"feature_name":"PBKDF"},{"id":571,"feature_name":"TLS 1.1"}]}