Archon Linux Unified Key Setup (LUKS) is a software Full Drive Encryption (FDE) product that is integrated into Archon Operating System (a Red Hat Enterprise Linux (RHEL) v8.10 derivative). It provides an FDE solution for the single hard drive installed in laptop models.
\r\n
Archon LUKS is used to encrypt a block device. The contents of the encrypted device are arbitrary, and therefore any filesystem can be encrypted, including swap partitions. There is an unencrypted header at the beginning of an encrypted volume, which allows up to 32 encryption keys to be stored (in an encrypted form) along with encryption parameters such as cipher type and key size.
By default, the option to encrypt the block device is selected during the Archon OS installation. The system prompts users for a LUKS passphrase every time the system is booted. This passphrase unlocks the bulk encryption key that decrypts the data.
Archon LUKS provides a set of tools that simplifies managing the encrypted devices. With Archon LUKS, you can encrypt block devices and enable multiple user keys to decrypt a master key.
","evaluation_configuration":"The TOE is a software TOE and has been evaluated on the following host platforms.
\r\nTable 1: Archon Linux Unified Key Setup (LUKS) v3.0.0.2 Hardware Platforms
\r\n| \r\n Vendor \r\n | \r\n\r\n TOE’s Model \r\n | \r\n\r\n Central Processing Unit (CPU) \r\n | \r\n\r\n CPU Microarchitecture \r\n | \r\n\r\n CPU Family \r\n | \r\n
| \r\n Dell Inc. \r\n | \r\n\r\n Latitude 5430 \r\n | \r\n\r\n Intel® Core™ i7-1265U \r\n | \r\n\r\n Golden Cove \r\n | \r\n\r\n Alder Lake \r\n | \r\n
| \r\n Precision 3260 \r\n | \r\n\r\n Intel® Core™ i7-12700 \r\n | \r\n\r\n Golden Cove \r\n | \r\n\r\n Alder Lake \r\n | \r\n|
| \r\n Precision 3570 \r\n | \r\n\r\n Intel® Core™ i7-1265U \r\n | \r\n\r\n Golden Cove \r\n | \r\n\r\n Alder Lake \r\n | \r\n|
| \r\n Precision 5570 \r\n | \r\n\r\n Intel® Core™ i7-12700 \r\n | \r\n\r\n Golden Cove \r\n | \r\n\r\n Alder Lake \r\n | \r\n|
| \r\n Latitude 5440 \r\n | \r\n\r\n Intel® Core™ i5-1335U \r\n | \r\n\r\n Raptor Cove \r\n | \r\n\r\n Raptor Lake \r\n | \r\n|
| \r\n Latitude 5540 \r\n | \r\n\r\n Intel® Core™ i5-1335U \r\n | \r\n\r\n Raptor Cove \r\n | \r\n\r\n Raptor Lake \r\n | \r\n|
| \r\n Precision 3580 \r\n | \r\n\r\n Intel® Core™ i5-1355U \r\n | \r\n\r\n Raptor Cove \r\n | \r\n\r\n Raptor Lake \r\n | \r\n|
| \r\n Precision 3590 \r\n | \r\n\r\n Intel® Core™ Ultra 7 155U \r\n | \r\n\r\n Ultra/Redwood Cove \r\n | \r\n\r\n Meteor Lake \r\n | \r\n
The diagram below depicts a representative TOE deployment.
\r\nFigure 1: Representative TOE Deployment
\r\nThe following items are required for the operational environment.
\r\nTable 2: Hardware and Software Environmental Components
\r\n| \r\n Components \r\n | \r\n\r\n Mandatory/ \r\nOptional \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n End User Device (EUD) \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n The hardware running Archon OS with LUKS enabled (the TOE). The evaluated systems are identified in Table 1 above. \r\n | \r\n
| \r\n Update Server \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n Provides the ability to check for TOE software updates as well as providing signed updates. The communication is performed by the Operational Environment (Archon OS). \r\n | \r\n
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Archon Linux Unified Key Setup (LUKS) v3.0.0.2 was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the Common Criteria Administrator Guidance, satisfies all of the security functional requirements stated in the Archon Linux Unified Key Setup (LUKS) v3.0.0.2 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in May 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functions required by the FDE_AA cPP and FDE_EE cPP.
\r\nThe TOE includes NIST CAVP-validated cryptographic algorithms supporting cryptographic functions. The TOE provides Key Derivation, BEV (Border Encrypt Value) Validation, and data encryption.
\r\nThe TOE performs Full Drive Encryption such that the drive contains no plaintext user data. The TOE performs user data encryption by default in the out-of-the-box configuration using XTS-AES-256 mode.
\r\nThe TOE supports management functions for changing and erasing the DEK (Data Encryption Key), modifying the passphrase, and initiating the TOE updates using a command line interface.
\r\nThe TOE provides trusted firmware updates, protects Key and Key Material; and supports power saving states. The TOE runs a suite of self-tests during initial start-up (on power on).
","features":[{"id":1967,"feature_name":"Asymmetric Key Generation"},{"id":1970,"feature_name":"Cryptographic Hashing"},{"id":1969,"feature_name":"Cryptographic Signature Verification"},{"id":1963,"feature_name":"DRBG"},{"id":1961,"feature_name":"Full Drive Encryption"},{"id":1962,"feature_name":"Key Destruction"},{"id":1971,"feature_name":"Keyed-hash message authentication"},{"id":1968,"feature_name":"Symmetric Key Generation"}]}