The TOE, which consists of the Cisco Aggregation Services Router 9000 series (ASR9K) running IOS-XR 7.11, is a network device capable of MACsec encryption. The ASR9K platform is a scalable carrier-class router, designed for redundancy, high security and availability, packaging, power, and other requirements needed by service providers. The TOE includes the hardware models as defined in the Security Target section 1.1.
","evaluation_configuration":"The TOE consists of one or more physical devices as specified in section 1.7 of the Secruity Target along with MACsec-supporting hardware A99-4HG-FLEX, A9K-4HG-FLEX, A9K-8HG-FLEX, A9K-20HG-FLEX, A99-10X400GE-X, A99-4T, ASR9902, ASR9903, A9903-8HG-PEC, A9903-20HG-PEC, non-MACsec line cards A99-32X100GE-X (Non-MACsec), A99-32HG (Non-MACsec), and includes the Cisco IOS-XR software. The TOE has two or more network interfaces and is connected to at least one internal and one external network. The Cisco IOS-XR configuration determines how packets are handled to and from the TOE’s network interfaces. The router configuration will determine how traffic flows received on an interface will be handled. Typically, packet flows are passed through the internetworking device and forwarded to their configured destination.
\r\n\r\n
An external syslog server must be used to store audit records. The TOE authenticates those devices with X.509v3 certificates and protects communication channels with the TLS protocol. Secure remote administration is protected with SSH which is implemented with authentication failure handling.
\r\n\r\n
For remote administration, a secure session using SSHv2 must be established.
\r\n\r\n
The following figure provides a visual depiction of an example TOE deployment:
\r\n\r\n
The previous figure includes the following:
\r\n\r\n
NOTE: While the previous figure includes several non-TOE IT environment devices, the TOE is only the ASR9K device. Only one TOE device is required for deployment in an evaluated configuration.
","security_evaluation_summary":"The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The evaluation demonstrated that the product meets the security requirements contained in the Security Target. The criteria against which the Cisco Aggregation Services Router 9000 (ASR9K) was judged are described in the Common Criteria for Information Technology Security Evaluation, Version 3.1, Revision 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 5. The product, when configured as identified in the Cisco Aggregation Services Router 9000 (ASR9K) running IOS-XR 7.11, Common Criteria Operational User Guidance, Version 0.4, November 26, 2024, satisfies all of the security functional requirements stated in the Cisco Aggregation Services Router 9000 (ASR9K) running IOS-XR 7.11 Security Target, Version 1.1, January 17, 2025. The project underwent CCEVS Validator review. The evaluation was completed in January 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11484-2024) prepared by CCEVS.
","environmental_strengths":"The TOE is comprised of several security features. Each of the security features identified above consists of several security functionalities, as identified below.
\r\n\r\n
\r\n
These features are described in more detail in the subsections below. In addition, the TOE implements all SFRs of the NDcPP v2.2e and MOD_MACSEC_V1.0 as necessary to satisfy testing/assurance measures prescribed therein.
\r\n\r\n
The TOE provides extensive auditing capabilities. The TOE can audit events related to cryptographic functionality, identification and authentication, and administrative actions. The TOE generates an audit record for each auditable event. Each security relevant audit event has the date, timestamp, event description, and subject identity. The administrator configures auditable events, performs back-up operations and manages audit data storage. The TOE provides the administrator with a circular audit trail. The TOE is configured to transmit its audit messages to an external syslog server over an encrypted channel using TLS.
\r\nThe TOE provides cryptography in support of other TOE security functionality. All the algorithms claimed have CAVP certificates (Operational Environment – Intel Xeon D-1533N (Broadwell Intel Xeon D-1573N (Broadwell), Intel Xeon Silver 4109T (Skylake). In addition, the TOE supports MACsec using the Microchip META-DX1 PM6110 processor (see the Table below for certificate references).
\r\n\r\n
| \r\n Algorithm \r\n | \r\n\r\n Description \r\n | \r\n\r\n Supported Mode \r\n | \r\n\r\n Module \r\n | \r\n\r\n CAVP Cert. # \r\n | \r\n\r\n SFR \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used for symmetric encryption/decryption \r\n | \r\n\r\n CBC (128 and 256) \r\n AES Key Wrap and CMAC (128 and 256) \r\n | \r\n\r\n FOM 7.3a \r\n | \r\n\r\n A4446 \r\n | \r\n\r\n FCS_COP.1/DataEncryption FCS_COP.1/MACSEC \r\n | \r\n
| \r\n GCM (128 and 256) \r\n | \r\n\r\n MACsec \r\n | \r\n\r\n A1104 \r\n | \r\n|||
| \r\n SHS (SHA1, SHA-256, SHA-384, SHA-512) \r\n | \r\n\r\n Cryptographic hashing services \r\n | \r\n\r\n Byte Oriented \r\n | \r\n\r\n FOM 7.3a \r\n | \r\n\r\n A4446 \r\n | \r\n\r\n FCS_COP.1/Hash \r\n | \r\n
| \r\n HMAC (SHA1, SHA-256, SHA-384, SHA-512) \r\n | \r\n\r\n Keyed hashing services and software integrity test \r\n | \r\n\r\n Byte Oriented \r\n | \r\n\r\n FOM 7.3a \r\n | \r\n\r\n A4446 \r\n | \r\n\r\n FCS_COP.1/KeyedHash \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n Deterministic random bit generation services in accordance with ISO/IEC 18031:2011 \r\n | \r\n\r\n CTR_DRBG (AES 256) \r\n | \r\n\r\n FOM 7.3a \r\n | \r\n\r\n A4446 \r\n | \r\n\r\n FCS_RBG_EXT.1 \r\n | \r\n
| \r\n RSA \r\n | \r\n\r\n Signature Verification and Key Transport \r\nKey Generation \r\n | \r\n\r\n PKCS#1 v.1.5, 2048 and 3072 bit key \r\n\r\n FIPS 186-4 Key Gen \r\n | \r\n\r\n FOM 7.3a \r\n | \r\n\r\n A4446 \r\n | \r\n\r\n FCS_CKM.1 | \r\n
| \r\n ECDSA \r\n | \r\n\r\n Key Generation \r\n | \r\n\r\n FIPS 186-4 Key Gen \r\n | \r\n\r\n FOM 7.3a \r\n | \r\n\r\n A4446 \r\n | \r\n\r\n FCS_CKM.1 \r\n | \r\n
| \r\n KAS-ECC \r\n | \r\n\r\n Key Agreement \r\n | \r\n\r\n NIST Special Publication 800-56A \r\n | \r\n\r\n FOM 7.3a \r\n | \r\n\r\n A4446 \r\n | \r\n\r\n FCS_CKM.2 \r\n | \r\n
The TOE provides cryptography in support of remote administrative management via SSHv2 and secures the session between the ASR9K and remote syslog server using TLS.
\r\n\r\n
The TOE authenticates and encrypts packets between itself and a MACsec peer. The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys to protect data exchanged by the peers.
The cryptographic services provided by the TOE are described in the Table below:
\r\n\r\n
| \r\n Cryptographic Method \r\n | \r\n\r\n Use within the TOE \r\n | \r\n
| \r\n Secure Shell Establishment \r\n | \r\n\r\n Used to establish initial SSH session. \r\n\r\n | \r\n
| \r\n RSA Signature Services \r\n | \r\n\r\n Used in SSH session establishment. \r\nUsed in TLS session establishment. \r\nX.509 certificate signing. | \r\n
| \r\n SHS \r\n | \r\n\r\n Used to provide SSH traffic integrity verification \r\nUsed for keyed-hash message authentication \r\n\r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used to encrypt SSH session traffic. \r\nUsed to encrypt TLS session traffic. \r\n | \r\n
| \r\n HMAC \r\n | \r\n\r\n Used for keyed hash, integrity services in SSH session establishment. | \r\n
| \r\n TLS \r\n | \r\n\r\n Used to secure traffic to the syslog server. \r\n | \r\n
| \r\n AES-CMAC \r\n | \r\n\r\n Used to encrypt MACsec keys. \r\n | \r\n
| \r\n ISO/IEC 18031:2011 CTR_CRBG (AES) \r\n | \r\n\r\n Used for random number generation, key generation and seeds to asymmetric key generation \r\nUsed in TLS session establishment \r\nUsed in SSH session establishment \r\nUsed in MACsec session establishment \r\n | \r\n
\r\n
The TOE provides authentication services for administrative users wishing to connect to the TOEs secure CLI administrator interface. The TOE requires Authorized Administrators to authenticate prior to being granted access to any of the management functionality. The TOE can be configured to require a minimum password length of 15 characters as well as mandatory password complexity rules.
\r\n\r\n
After a configurable number of incorrect login attempts, ASR9K will lockout the account until a configured amount of time for lockout expires.
\r\n\r\n
The TOE provides administrator authentication against a local user database. Password-based authentication can be performed on the serial console or SSH interfaces. The SSHv2 interface also supports authentication using SSH keys.
\r\n\r\n
The TOE uses X.509v3 certificates as defined by RFC 5280 to support authentication for TLS connections.
\r\nThe TOE provides secure administrative services for management of general TOE configuration and the security functionality provided by the TOE. All TOE administration occurs either through a secure SSHv2 session or via a local console connection. The TOE provides the ability to securely manage all TOE administrative users, all identification and authentication, all audit functionality of the TOE, all TOE cryptographic functionality, the timestamps maintained by the TOE, and updates to the TOE. The TOE supports a privileged administrator role. Only the privileged administrator can perform the above security relevant management functions.
\r\n\r\n
Administrators can create configurable login banners to be displayed at time of login, and can also define an inactivity timeout for each admin interface to terminate sessions after a set period of inactivity.
\r\nThe TOE protects against interference and tampering by untrusted subjects by implementing identification, authentication, and access controls to limit configuration to Authorized Administrators. The TOE prevents reading of cryptographic keys and passwords. Additionally, Cisco IOS-XR is not a general-purpose operating system and access to Cisco IOS-XR memory space is restricted to only Cisco IOS-XR functions.
\r\n\r\n
The TOE is also able to detect replay of information received via secure channels (MACsec). The detection applied to network packets that terminate at the TOE, such as trusted communications between the TOE and an IT entity (e.g., MACsec peer). If replay is detected, the packets are discarded.
\r\n\r\n
The TOE internally maintains the date and time. This date and time is used as the timestamp that is applied to audit records generated by the TOE. Administrators can update the TOE’s clock manually. Finally, the TOE performs testing to verify correct operation of the router itself and that of the cryptographic module.
\r\n\r\n
The TOE is able to verify any software updates prior to the software updates being installed on the TOE to avoid the installation of unauthorized software.
\r\nThe TOE can terminate inactive sessions after an Authorized Administrator configurable time-period. Once a session has been terminated the TOE requires the user to re-authenticate to establish a new session.
\r\n\r\n
The TOE can also display a Security Administrator specified banner on the CLI management interface prior to allowing any administrative access to the TOE.
\r\nThe TOE establishes a trusted path between the appliance and the CLI using SSHv2 and the syslog server using TLS. MACsec is used to secure communication channels between MACsec peers at Layer 2.
","features":[{"id":806,"feature_name":"Asymmetric Key Generation"},{"id":801,"feature_name":"Auditing"},{"id":816,"feature_name":"Certificate Authentication"},{"id":811,"feature_name":"Certificate Validation"},{"id":809,"feature_name":"Cryptographic Hashing"},{"id":807,"feature_name":"Cryptographic Key Establishment"},{"id":808,"feature_name":"Cryptographic Signature Verification"},{"id":805,"feature_name":"DRBG"},{"id":804,"feature_name":"Key Destruction"},{"id":810,"feature_name":"Keyed-hash message authentication"},{"id":840,"feature_name":"MACsec"},{"id":813,"feature_name":"SSH Server"},{"id":838,"feature_name":"TLS 1.2"},{"id":812,"feature_name":"TLS Client"}]}