The Target of Evaluation (TOE) is NetApp Volume Encryption (NVE) Appliances running ONTAP 9.14.1. The TOE provides both authorization acquisition and encryption engine components in support of full drive encryption. The authorization acquisition component derives a Border Encryption Value (BEV) from an administrator-supplied authorization factor (namely, a passphrase) and provides it to the encryption engine, which uses it to unlock the Drive Encryption Key (DEK) used to encrypt data on disk storage devices.
","evaluation_configuration":"The TOE comprises a range of disk storage appliances, consisting of storage controllers and one or more enclosures of disk storage devices, running ONTAP 9.14.1. Supported disk storage devices include hard disk drive (HDD), solid state drive (SSD) and non-volatile memory express (NVMe) flash drives.
\r\nThe NetApp appliances included in the evaluated configuration are as follows:
\r\n| \r\n NetApp Controllers \r\n | \r\n\r\n Disk Type \r\n | \r\n\r\n Controller Form Factor \r\n | \r\n
| \r\n AFF A150 \r\n | \r\n\r\n SSD \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n AFF A220 \r\n | \r\n\r\n SSD \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n AFF A250 \r\n | \r\n\r\n NVMe/SSD \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n AFF A300 \r\n | \r\n\r\n SSD \r\n | \r\n\r\n 3U \r\n | \r\n
| \r\n AFF A320 \r\n | \r\n\r\n NVMe \r\n | \r\n\r\n 2U \r\n | \r\n
| \r\n AFF A400 \r\n | \r\n\r\n NVMe/SSD \r\n | \r\n\r\n 4U \r\n | \r\n
| \r\n AFF A800 \r\n | \r\n\r\n NVMe/SSD \r\n | \r\n\r\n 4U/48 internal drives \r\n | \r\n
| \r\n AFF A900 \r\n | \r\n\r\n NVMe/SSD \r\n | \r\n\r\n 8U \r\n | \r\n
| \r\n AFF C190 \r\n | \r\n\r\n SSD \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n AFF C250 \r\n | \r\n\r\n NVMe \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n AFF C400 \r\n | \r\n\r\n NVME \r\n | \r\n\r\n 4U \r\n | \r\n
| \r\n AFF C800 \r\n | \r\n\r\n NVMe \r\n | \r\n\r\n 4U \r\n | \r\n
| \r\n ASA A150 \r\n | \r\n\r\n SSD \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n ASA A250 \r\n | \r\n\r\n NVMe \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n ASA A400 \r\n | \r\n\r\n NVMe/SSD \r\n | \r\n\r\n 4U \r\n | \r\n
| \r\n ASA A800 \r\n | \r\n\r\n NVMe/SSD \r\n | \r\n\r\n 4U/48 internal drives \r\n | \r\n
| \r\n ASA A900 \r\n | \r\n\r\n NVMe/SSD \r\n | \r\n\r\n 8U \r\n | \r\n
| \r\n ASA C250 \r\n | \r\n\r\n NVMe \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n ASA C400 \r\n | \r\n\r\n NVMe \r\n | \r\n\r\n 4U \r\n | \r\n
| \r\n ASA C800 \r\n | \r\n\r\n NVMe \r\n | \r\n\r\n 4U \r\n | \r\n
| \r\n ASA AFF A220 \r\n | \r\n\r\n SSD \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n FAS2720 \r\n | \r\n\r\n HDD/SSD \r\n | \r\n\r\n 2U/12 internal drives \r\n | \r\n
| \r\n FAS2750 \r\n | \r\n\r\n HDD/SSD \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n FAS2820 \r\n | \r\n\r\n HDD/SSD \r\n | \r\n\r\n 2U/12 internal drives \r\n | \r\n
| \r\n FAS500f \r\n | \r\n\r\n NVMe \r\n | \r\n\r\n 2U/24 internal drives \r\n | \r\n
| \r\n FAS8200 \r\n | \r\n\r\n HDD/SSD \r\n | \r\n\r\n 3U \r\n | \r\n
| \r\n FAS8300 \r\n | \r\n\r\n HDD/SSD \r\n | \r\n\r\n 4U \r\n | \r\n
| \r\n FAS8700 \r\n | \r\n\r\n HDD/SSD \r\n | \r\n\r\n 4U \r\n | \r\n
| \r\n FAS9500 \r\n | \r\n\r\n HDD/SSD \r\n | \r\n\r\n 8U \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the TOE was evaluated are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 5. The product, when configured as identified in the guidance documentation, satisfies all of the security functional requirements stated in the NetApp Volume Encryption (NVE) Appliances running ONTAP 9.14.1 Security Target. The evaluation was completed in November 8, 2024 . Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"Cryptographic Support
\r\nThe TOE includes NIST CAVP-validated cryptographic algorithms supporting cryptographic functions. The TOE provides key wrapping, key derivation, validation of the Border Encryption Value (BEV), and data encryption.
\r\nUser Data Protection
\r\nThe TOE performs full drive encryption, such that the drive contains no plaintext user data. The TOE performs user data encryption by default in the out-of-the-box configuration using 256 bit AES in XTS mode.
\r\nSecurity Management
\r\nThe TOE supports management functions for changing and erasing the DEK and initiating TOE firmware updates, using a command line interface.
\r\nProtection of the TSF
\r\nThe TOE provides trusted firmware updates, protects keys and key material, and supports Compliant power saving states. The TOE runs a suite of self-tests during initial start-up (on power on).
","features":[{"id":2692,"feature_name":"Cryptographic Hashing"},{"id":2691,"feature_name":"Cryptographic Signature Verification"},{"id":2803,"feature_name":"DRBG"},{"id":2688,"feature_name":"Full Drive Encryption"},{"id":2687,"feature_name":"Key Destruction"},{"id":2693,"feature_name":"Keyed-hash message authentication"},{"id":2689,"feature_name":"Symmetric Key Generation"}]}