TÜV Rheinland Nederland B.V. Headoffice: Westervoortsedijk 73 NL-6827 AV Arnhem P.O. Box 2220 NL-6802 CE Arnhem The Netherlands Location Leek: Eiberkamp 10 NL-9351 VT Leek P.O. Box 37 NL-9350 AA Leek The Netherlands info@nl.tuv.com www.tuv.com/nl Tel. +31 (0)88 888 7 888 Fax +31 (0)88 888 7 879 TÜV Rheinland Nederland B.V. is a registered company at the Dutch Chamber of Commerce under number 27288788 VAT number: NL815820380B01 IBAN: NL61DEUT0265155096 Version 2020-2 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. Certification Report Huawei BaseBIOS V1.5 Sponsor and developer: Huawei Technologies Co., Ltd. 2F D4 D Area Administration Building, Southern Factory of Huawei Technologies Co., Ltd., No. 6 Xincheng Avenue, Songshan Lake Technology Industrial Park, Dongguan City, 523808, China Evaluation facility: Brightsight Brassersplein 2 2612 CT Delft The Netherlands Report number: NSCIB-CC-0209055-CR Report version: 1 Project number: 0209055 Author(s): Hans-Gerd Albertsen Date: 9 November 2020 Number of pages: 11 Number of appendices: 0 Reproduction of this report is authorized provided the report is reproduced in its entirety. Page: 2/11 of report number: NSCIB-CC-0209055-CR, dated 9 November 2020 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. CONTENTS: Foreword 3 Recognition of the certificate 4 International recognition 4 European recognition 4 1 Executive Summary 5 2 Certification Results 6 2.1 Identification of Target of Evaluation 6 2.2 Security Policy 6 2.3 Assumptions and Clarification of Scope 6 2.4 Architectural Information 7 2.5 Documentation 7 2.6 IT Product Testing 7 2.7 Re-used evaluation results 8 2.8 Evaluated Configuration 8 2.9 Results of the Evaluation 8 2.10 Comments/Recommendations 9 3 Security Target 10 4 Definitions 10 5 Bibliography 11 Page: 3/11 of report number: NSCIB-CC-0209055-CR, dated 9 November 2020 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. Foreword The Netherlands Scheme for Certification in the Area of IT Security (NSCIB) provides a third-party evaluation and certification service for determining the trustworthiness of Information Technology (IT) security products. Under this NSCIB, TÜV Rheinland Nederland B.V. has the task of issuing certificates for IT security products, as well as for protection profiles and sites. Part of the procedure is the technical examination (evaluation) of the product, protection profile or site according to the Common Criteria assessment guidelines published by the NSCIB. Evaluations are performed by an IT Security Evaluation Facility (ITSEF) under the oversight of the NSCIB Certification Body, which is operated by TÜV Rheinland Nederland B.V. in cooperation with the Ministry of the Interior and Kingdom Relations. An ITSEF in the Netherlands is a commercial facility that has been licensed by TÜV Rheinland Nederland B.V. to perform Common Criteria evaluations; a significant requirement for such a license is accreditation to the requirements of ISO Standard 17025 “General requirements for the accreditation of calibration and testing laboratories”. By awarding a Common Criteria certificate, TÜV Rheinland Nederland B.V. asserts that the product or site complies with the security requirements specified in the associated (site) security target, or that the protection profile (PP) complies with the requirements for PP evaluation specified in the Common Criteria for Information Security Evaluation. A (site) security target is a requirements specification document that defines the scope of the evaluation activities. The consumer should review the (site) security target or protection profile, in addition to this certification report, in order to gain an understanding of any assumptions made during the evaluation, the IT product's intended environment, its security requirements, and the level of confidence (i.e., the evaluation assurance level) that the product or site satisfies the security requirements stated in the (site) security target. Reproduction of this report is authorized provided the report is reproduced in its entirety. Page: 4/11 of report number: NSCIB-CC-0209055-CR, dated 9 November 2020 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. Recognition of the certificate Presence of the Common Criteria Recognition Arrangement and SOG-IS logos on the certificate indicates that this certificate is issued in accordance with the provisions of the CCRA and the SOG-IS agreement and will be recognised by the participating nations. International recognition The CCRA has been signed by the Netherlands in May 2000 and provides mutual recognition of certificates based on the CC. Starting September 2014 the CCRA has been updated to provide mutual recognition of certificates based on cPPs (exact use) or STs with evaluation assurance components up to and including EAL2+ALC_FLR. The current list of signatory nations and approved certification schemes can be found on: http://www.commoncriteriaportal.org. European recognition The European SOGIS-Mutual Recognition Agreement (SOGIS-MRA) version 3 effective from April 2010 provides mutual recognition of Common Criteria and ITSEC certificates at a basic evaluation level for all products. A higher recognition level for evaluation levels beyond EAL4 (resp. E3-basic) is provided for products related to specific technical domains. This agreement was initially signed by Finland, France, Germany, The Netherlands, Norway, Spain, Sweden and the United Kingdom. Italy joined the SOGIS-MRA in December 2010. The current list of signatory nations, approved certification schemes and the list of technical domains for which the higher recognition applies can be found on: http://www.sogisportal.eu. Page: 5/11 of report number: NSCIB-CC-0209055-CR, dated 9 November 2020 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. 1 Executive Summary This Certification Report states the outcome of the Common Criteria security evaluation of the Huawei BaseBIOS V1.5. The developer of the Huawei BaseBIOS V1.5 is Huawei Technologies Co., Ltd. located in Dongguan, China and they also act as the sponsor of the evaluation and certification. A Certification Report is intended to assist prospective consumers when judging the suitability of the IT security properties of the product for their particular requirements. The TOE is a secure bootloader, it is the second piece of software code that is used in the start-up process of a secure embedded hardware product, such as an integrated secure element or SoC, to ensure the product securely initializes into a secure state. The TOE has been evaluated by Brightsight B.V. located in Delft, The Netherlands. The evaluation was completed on 3 November 2020 with the approval of the ETR. The certification procedure has been conducted in accordance with the provisions of the Netherlands Scheme for Certification in the Area of IT Security [NSCIB]. The scope of the evaluation is defined by the security target [ST], which identifies assumptions made during the evaluation, the intended environment for the Huawei BaseBIOS V1.5, the security requirements, and the level of confidence (evaluation assurance level) at which the product is intended to satisfy the security requirements. Consumers of the Huawei BaseBIOS V1.5 are advised to verify that their own environment is consistent with the security target, and to give due consideration to the comments, observations and recommendations in this certification report. The results documented in the evaluation technical report [ETR] 1 for this product provides sufficient evidence that the TOE meets the EAL4 augmented (EAL4+) assurance requirements for the evaluated security functionality. This assurance level is augmented with ALC_DVS.2 (Sufficiency of security measures) and AVA_VAN.5 (Advanced methodical vulnerability analysis). The evaluation was conducted using the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 5 [CEM] for conformance to the Common Criteria for Information Technology Security Evaluation, version 3.1 Revision 5 [CC]. TÜV Rheinland Nederland B.V., as the NSCIB Certification Body, declares that the evaluation meets all the conditions for international recognition of Common Criteria Certificates and that the product will be listed on the NSCIB Certified Products list. It should be noted that the certification results only apply to the specific version of the product as evaluated. 1 The Evaluation Technical Report contains information proprietary to the developer and/or the evaluator, and is not releasable for public review. Page: 6/11 of report number: NSCIB-CC-0209055-CR, dated 9 November 2020 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. 2 Certification Results 2.1 Identification of Target of Evaluation The Target of Evaluation (TOE) for this evaluation is the Huawei BaseBIOS V1.5 from Huawei Technologies Co., Ltd. located in Dongguan, China. The TOE is comprised of the following main components: Delivery item type Identifier Version Software Huawei BaseBIOS V1.5 To ensure secure usage a set of guidance documents is provided together with the Huawei BaseBIOS V1.5. Details can be found in section 2.5 of this report. 2.2 Security Policy The TOE is used by integrating it into a software stack running on a compatible hardware platform. As part of the initialization procedure of this hardware and software stack, the TOE will be used to ensure that the higher layers of software are securely loaded. In order to support this, the TOE provides the following security features:  Boot failure handling  Sensitive data handling  Debug functionality (for software development) 2.3 Assumptions and Clarification of Scope 2.3.1 Assumptions The assumptions defined in the Security Target are not covered by the TOE itself. These aspects lead to specific Security Objectives to be fulfilled by the TOE-Environment. Detailed information on these security objectives that must be fulfilled by the TOE environment can be found in section 4.2 of the [ST]. 2.3.2 Clarification of scope The evaluation did not reveal any threats to the TOE that are not countered by the evaluated security functions of the product. Page: 7/11 of report number: NSCIB-CC-0209055-CR, dated 9 November 2020 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. 2.4 Architectural Information The logical architecture, originating from the Security Target [ST] of the TOE can be depicted as follows: The TOE is located in Secure Partition (SP), which ensures that different layers of software are securely loaded. The TOE is a secure bootloader code and stored in SRAM of SP. 2.5 Documentation The following documentation is provided with the product by the developer to the customer: Identifier Version Huawei BaseBIOS CC EAL4+ Guidance Document V1.3 2.6 IT Product Testing Testing (depth, coverage, functional tests, independent testing): The evaluators examined the developer’s testing activities documentation and verified that the developer has met their testing responsibilities. 2.6.1 Testing approach and depth The developer has performed extensive testing on functional specification, subsystem and module level. All parameter choices have been addressed at least once. All boundary cases identified have been tested explicitly, and additionally the near-boundary conditions have been covered probabilistically. The testing was largely automated using industry standard and proprietary test suites. Test scripts were extensively used to verify that the functions return the expected values. The evaluators have reproduced a selection of the developer tests, as well as a small number of test cases designed by the evaluator. 2.6.2 Independent Penetration Testing The methodical analysis performed was conducted along the following steps:  When evaluating the evidence in the classes ASE, ADV and AGD the evaluator considers whether potential vulnerabilities can already be identified due to the TOE type and/or specified behaviour in such an early stage of the evaluation.  For ADV_IMP a thorough implementation representation review is performed on the TOE. During this attack oriented analysis the protection of the TOE is analysed using the knowledge gained from all previous evaluation classes. This results in the identification of (additional) Page: 8/11 of report number: NSCIB-CC-0209055-CR, dated 9 November 2020 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. potential vulnerabilities. For this analysis will be performed according to the attack methods in [JIL-AAPS].  All potential vulnerabilities are analysed using the knowledge gained from all evaluation classes and information from the public domain. A judgment was made on how to assure that these potential vulnerabilities are not exploitable. The potential vulnerabilities are addressed by penetration testing, a guidance update or in other ways that are deemed appropriate. The overall testing effort is 1 week, which corresponds to the total duration of the logical software attack test; no attacks including exploitation of test features were defined. No perturbation and side- channel attacks were defined as the TOE is not claimed to be resistant against these types of attacks. 2.6.3 Test Configuration The evaluator-defined tests were performed on the test chip. The test board environment consists of the test chip, flash, and power supply. The TOE runs on the test chip and the flash stores the eXtensibleBIOS as well as IMU Firmware images. There are two UARTs in this test board (UART1 and UART2). The UART1 is used to load the eXtensibleBIOS image, and UART2 is used to load the IMU Firmware image. The following test tools were used:  MobaXterm v20.2  IPOP v4.0  VSCode-huawei v1.43.2  gcc7.5.0  gcov7.5.0.  Icov 1.13 2.6.4 Testing Results The testing activities, including configurations, procedures, test cases, expected results and observed results are summarised in the [ETR], with references to the documents containing the full details. The developer’s tests and the independent functional tests produced the expected results, giving assurance that the TOE behaves as specified in its [ST] and functional specification. No exploitable vulnerabilities were found with the independent penetration tests. For composite evaluations, please consult the [ETRfC] for details. 2.7 Re-used evaluation results There has been re-use of the ALC aspects for one site involved in the development of the TOE. This is the Dongguan Data Center which has been audited as part of a different certification. 2.8 Evaluated Configuration The TOE is defined uniquely by its name and version number Huawei BaseBIOS V1.5. 2.9 Results of the Evaluation The evaluation lab documented their evaluation results in the [ETR], which references an ASE Intermediate Report and other evaluator documents, and a Site Technical Audit Report for one of the sites [STAR] 2 . To support composite evaluations according to [CCDB-2007-09-01] a derived document [ETRfC] was provided and approved. This document provides details of the TOE evaluation that have to be considered when this TOE is used as component in a composite evaluation. The verdict of each claimed assurance requirement is “Pass”. Based on the above evaluation results the evaluation lab concluded the Huawei BaseBIOS V1.5, to be CC Part 2 extended, CC Part 3 conformant, and to meet the requirements of EAL 4 augmented 2 The Site Technical Audit Report contains information necessary to an evaluation lab and certification body for the reuse of the site audit report in a TOE evaluation. Page: 9/11 of report number: NSCIB-CC-0209055-CR, dated 9 November 2020 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. with ALC_DVS.2 and AVA_VAN.5. This implies that the product satisfies the security requirements specified in Security Target [ST]. 2.10 Comments/Recommendations The user guidance as outlined in section 2.5 contains necessary information about the usage of the TOE. Certain aspects of the TOE’s security functionality, in particular the countermeasures against attacks, depend on accurate conformance to the user guidance of both the software and the hardware part of the TOE. There are no particular obligations or recommendations for the user apart from following the user guidance. Please note that the documents contain relevant details with respect to the resistance against certain attacks. In addition, all aspects of assumptions, threats and policies as outlined in the Security Target not covered by the TOE itself need to be fulfilled by the operational environment of the TOE. The customer or user of the product shall consider the results of the certification within his system risk management process. In order for the evolution of attack methods and techniques to be covered, he should define the period of time until a re-assessment for the TOE is required and thus requested from the sponsor of the certificate. Page: 10/11 of report number: NSCIB-CC-0209055-CR, dated 9 November 2020 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. 3 Security Target The Huawei BaseBIOS Security Target, Version 1.6, 06. October 2020 [ST] is included here by reference. 4 Definitions This list of Acronyms and the glossary of terms contains elements that are not already defined by the CC or CEM: IT Information Technology ITSEF IT Security Evaluation Facility JIL Joint Interpretation Library NSCIB Netherlands Scheme for Certification in the area of IT security PP Protection Profile TOE Target of Evaluation Page: 11/11 of report number: NSCIB-CC-0209055-CR, dated 9 November 2020 ® TÜV, TUEV and TUV are registered trademarks. Any use or application requires prior approval. 5 Bibliography This section lists all referenced documentation used as source material in the compilation of this report: [CC] Common Criteria for Information Technology Security Evaluation, Parts I, II and III, Version 3.1 Revision 5, April 2017. [CEM] Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 5, April 2017. [ETR] Evaluation Technical Report Huawei BaseBIOS V1.5, 20-RPT-854, Version 4.0, 3. November 2020. [ETRfC] Evaluation Technical Report for Composition Huawei BaseBIOS v1.5, 20-RPT- 1070, Version 3.0, 3 November 2020. [JIL-AAPS] JIL, (Mandatory) Application of Attack Potential to Smartcards, Version 3.1, June 2020. [NSCIB] Netherlands Scheme for Certification in the Area of IT Security, Version 2.5, 28 March 2019. [ST] Huawei BaseBIOS Security Target, Version 1.6, 06. October 2020. [STAR] Site Technical Audit Report Huawei Shenzhen Site, 20-RPT-971, Version 2.0, 30 October 2020. (This is the end of this report).