SIST EN 419251-3:2013

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Varnostne zahteve naprav za overjanje - 3. del: Dodatna funkcionalnost za varnostne ciljeSicherheitsanforderungen für
Geräte zur Authentifizierung - Teil 3: zusätzliche Funktionalitäten für SicherheitszieleProfils de protection pour support d'authentification - Partie 3: Fonctionnalités additionnellesSecurity requirements for device for authentication - Part 3: Additional functionality for security targets35.240.15Identifikacijske kartice in sorodne napraveIdentification cards and related devicesICS:Ta slovenski standard je istoveten z:EN 419251-3:2013SIST EN 419251-3:2013en01-maj-2013SIST EN 419251-3:2013SLOVENSKI
STANDARD
EUROPEAN STANDARD NORME EUROPÉENNE EUROPÄISCHE NORM
EN 419251-3
March 2013 ICS 35.240.15 English Version
Security requirements for device for authentication - Part 3: Additional functionality for security targets
Profils de protection pour dispositif d'authentification - Partie 3: Fonctionnalités additionnelles
Sicherheitsanforderungen für Geräte zur Authentisierung - Teil 3: Zusätzliche Funktionalitäten für Sicherheitsziele This European Standard was approved by CEN on 7 December 2012.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre:
Avenue Marnix 17,
B-1000 Brussels © 2013 CEN All rights of exploitation in any form and by any means reserved worldwide for CEN national Members. Ref. No. EN 419251-3:2013: ESIST EN 419251-3:2013

Figures Figure 1 — TOE Security Features . 15 Figure 2 — Personalisation application environment . 16 Figure 3 — Administration application environment . 17 Figure 4 — Authentication application environment . 18 Figure 5 — TOE Life Cycle . 22
Tables Table 1 — Basic configurations . 14 Table 2 — IdTrusted configurations . 14 Table 3 — Protection of sensitive data . 33 Table 4 — Security objectives vs problem definition rationale . 38 Table 5 — Security attributes . 45 Table 6 — Core security attributes . 50 Table 7 — Core operations . 50 Table 8 — Core security attributes − Operation . 51 Table 9 — Core security attributes - initial value . 52 Table 10 — Core security attributes – Updates . 53 Table 11 — TSF data – updates . 53 Table 12 — KeyImp security attributes . 55 Table 13 — KeyImp security attributes - operations . 56 Table 14 — KeyImp security attributes – update authorised roles . 57 Table 15 — KeyImp security attributes – update values . 58 Table 16 — KeyGen operations . 59 Table 17 — KeyGen security attributes . 59 Table 18 — KeyGen operation rules . 60 Table 19 — KeyGen security attributes – update authorised roles . 60 Table 20 — KeyGen security attributes – initial values . 61 Table 21 — KeyGen security attributes – update values . 61 Table 22 — Admin security attributes – update authorised roles . 64 Table 23 — Admin security attributes – initial values . 64 Table 24 — Admin security attributes – update values . 64 Table 25 — Admin TSF data – operations . 65 Table 26 — SFR vs Security objectives retionale . 69 Table 27 — SFR dependencies . 74
ISO/IEC 15408-21), Information technology — Security techniques — Evaluation criteria for IT security — Part 2: Security functional components ISO/IEC 15408-31), Information technology — Security techniques — Evaluation criteria for IT security — Part 3: Security assurance components ISO/IEC 18045, Information technology — Security techniques — Methodology for IT security evaluation 3 Conformance 3.1 CC Conformance Claim These packages are CC Part 2 extended and CC Part 3 conformant and written according to ISO/IEC 15408-1, -2, -3 and ISO/IEC 18045. 3.2 PP Claim These packages do not claim conformance to any other Protection Profile. 3.3 Package Claim The evaluation assurance level for these packages is EAL4-augmented with the assurance components AVA_VAN.5 and ALC_DVS.2. 3.4 Conformance Rationale Since these packages do not claim conformance to any other protection profile, no rationale is necessary here.
1) ISO/IEC 15408-1, -2 and -3 respectively correspond to Common Criteria for Information Technology Security Evaluation, Parts 1, 2 and 3. SIST EN 419251-3:2013

Note 1 to entry: See 7.2 for more details. 4.2 Authentication Protocol sensitive data data used in the process of authentication of the TOE by the external entity Note 1 to entry: These data are linked to the Authentication private key, e.g. Authentication Certificate or APuK. Note 2 to entry: Authentication Protocol sensitive data may be empty if the environment is trusted, and the holder public key known to the system. 4.3 Certificate attestation, which links the APuK to a person and confirms the identity of that person (as defined in the Directive [8], article 2, Clause 9) 4.4 Certificate Info information associated with an Authentication key pair that consists either:  a signer's public key certificate; or
 one or more hash values of a signer's public key certificate together the identifier of the hash function used to compute these hash values, and some information which allows the signer to disambiguate between several signers certificates 4.5 Configuration set of groups Note 1 to entry: Each configuration corresponds to one PP. It has its own rationale. See the rest of the document. 4.6 Group set Assets, threats, objectives, and Requirements, addressing a specific function Note 1 to entry: See the rest of the document. 4.7 Holder legitimate holder of the authentication device
Note 1 to entry: See 7.2 for more details. SIST EN 419251-3:2013

2) In the document the terms authentication device, device and TOE are equivalent. 3) He is a physical person that receives some authenticated data from the users. SIST EN 419251-3:2013

6.6 Groups 6.6.1 General A group is a set of Assets, Threats, Objectives, and Requirements, addressing a specific function, e.g. KeyGen addresses key generation on TOE. 6.6.2 Main groups 6.6.2.1 General This PP has the following main groups: Core, KeyImp, KeyGen, and Admin. 6.6.2.2 Core group Core group applies to all Configurations. It contains the basic security features for all Authentication devices. SIST EN 419251-3:2013

6.6.3.5 Trusted CA Trusted CA group contains the security features directly linked to the transfer of sensitive data between the TOE and the CA, when these transfers take place in a protected environment, i.e. when potential attacks are countered by the environment. This group only applies when KeyGen group belongs to the configuration. 6.6.3.6 Trusted AdminAppli Trusted AdminAppli group contains the security features directly linked to the transfer of sensitive data between the Administration application and the TOE, when these transfers take place in a protected environment, i.e. when potential attacks are countered by the environment. This group only applies when admin group belongs to the configuration. 6.6.3.7 Untrusted PersoAppli Untrusted PersoAppli group contains the security features directly linked to the transfer of sensitive data between the Personalisation application and the TOE, when these transfers do not take place in a protected environment. This means that the TOE has to establish a trusted channel with the Personalisation application. 6.6.3.8 Untrusted AuthAppli Untrusted AuthApp group contains the security features directly linked to the transfer of sensitive data between the Authentication application and the TOE, when these transfers do not take place in a protected environment. This means that the TOE has to establish a trusted channel with the Authentication application. 6.6.3.9 Untrusted Verifier Untrusted Verifier group contains the security features directly linked to the transfer of sensitive data between the Verifier and the TOE for the authentication of TOE, when these transfers do not take place in a protected environment. This means that the TOE has to use a secure protocol for the authentication of TOE by the Verifier. 6.6.3.10 Untrusted CA Untrusted CA group contains the security features directly linked to the export of the Authentication public key to the CA, when thes export does not take place in a protected environment. SIST EN 419251-3:2013

A Configuration including KeyGen group shall include either Trusted CA group or Untrusted CA.group. It cannot include both. SIST EN 419251-3:2013

BC3 BC4 BC5 BC6 Core 1 1 1 1 1 1 KeyImp 1 0 1 1 0 1 KeyGen 0 1 1 0 1 1 Admin 0 0 0 1 1 1
Basic configurations are identified from BC1 to BC6. 6.7.3.3 Transfer configurations They are related to the transfers of sensitive data: Table 2 — IdTrusted configurations Transfers
Trusted PersoApp 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 Trusted AutApp 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1 0 0 1 1 Trusted Verifier 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1 0 0 0 0 1 1 1 1 Trusted CA 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 Trusted AdminApp 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 IdTrusted can have all values from 0 to 1F As there are 5 independent possibilities, IdTrusted has 25 = 32 possibilities A configuration is identified by its Basic configuration and its Transfer configuration: (IdBasic, IdTrusted) Not all combinations of these two arrays are allowed. The only restrictions are: (Trusted CA group or Untrusted CA) group is included only when KeyGen group is included. (Trusted AdminApp group or Untrusted AdminApp) group is included only when Admin group is included.
Therefore there are 6 * 32 *[1/2 * (1+ 2/3)] * [1/2 * (1+1/2)] = 120 possible configurations. The rationale will address all these configurations. The ST writer shall specify the configuration of the TOE. SIST EN 419251-3:2013

Figure 1 — TOE Security Features Figure 1 shows all the security features of the TOE, in the Personnalisation, Usage and Administration environments. The legend explains how different colors identity the security features of the different groups: Core, KeyImp, KeyGen, and Admin. Further details on groups can be found in the rest of the documen
...