This document may not be modified or partially reused without prior written consent of HID Global/Arjo Systems. www.hidglobal.com / www.arjo-systems.com Security Target Lite ASapp-eID Machine Readable Electronic Document EAC – PACE – AA Common Criteria version 3.1 revision 4 Assurance Level EAL 4+ Version 1 Date 2017-08-15 Reference TCLE160092 Classification PUBLIC Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 2 of 127 Table of Contents Notations..............................................................................................................................5 1. Introduction ...............................................................................................................6 1.1 ST Overview..........................................................................................................6 1.2 ST reference..........................................................................................................6 1.3 TOE reference.......................................................................................................6 1.4 TOE overview........................................................................................................7 1.4.1 TOE type and usage ......................................................................................7 1.4.2 TOE Usage and security features for operational use....................................8 1.5 TOE Life-cycle.....................................................................................................11 1.5.1 Phase 1: Development .................................................................................14 1.5.2 Phase 2: Manufacturing ...............................................................................15 1.5.3 Phase 3: Personalization..............................................................................16 1.5.4 Phase 4: Operational use.............................................................................17 1.5.5 Non-TOE hardware/software/firmware required by the TOE........................17 1.6 TOE Description ..................................................................................................17 1.6.1 Physical scope of the TOE ...........................................................................17 1.6.2 Other non-TOE physical components ..........................................................18 1.6.3 Logical scope of the TOE .............................................................................18 2. Conformance claims ...............................................................................................19 2.1 Common Criteria Conformance Claim.................................................................19 2.2 Protection Profile Conformance Claim.................................................................19 2.3 Package Conformance Claim..............................................................................19 2.4 Conformance Claim Rationale.............................................................................19 3. Security Problem Definition.....................................................................................25 3.1 Introduction..........................................................................................................25 3.1.1 Assets...........................................................................................................25 3.1.2 Subjects........................................................................................................28 3.2 Assumptions........................................................................................................32 3.3 Threats ................................................................................................................33 3.4 Organizational Security Policies ..........................................................................37 4. Security Objectives .................................................................................................40 4.1 Security Objectives for the TOE ..........................................................................40 4.2 Security Objectives for the Operational Environment ..........................................43 4.3 Security Objective Rationale ...............................................................................47 5. Extended Components Definition............................................................................52 5.1 Definition of the family FAU_SAS........................................................................52 5.2 Definition of the family FCS_RND .......................................................................52 5.3 Definition of the family FIA_API...........................................................................53 5.4 Definition of the family FMT_LIM.........................................................................54 5.5 Definition of the family FPT_EMS........................................................................56 6. Security Requirements............................................................................................57 6.1 Security Functional Requirements for the TOE ...................................................60 6.1.1 Class FAU Security Audit .............................................................................60 6.1.2 Class Cryptographic Support (FCS) .............................................................61 6.1.3 Class FIA Identification and Authentication ..................................................68 6.1.4 Class FDP User Data Protection..................................................................76 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 3 of 127 6.1.5 Class FTP Trusted Path/Channels ...............................................................81 6.1.6 Class FMT Security Management ................................................................82 6.1.7 Class FPT Protection of the Security Functions ...........................................90 6.2 Security Assurance Requirements for the TOE...................................................94 6.3 Security Requirements Rationale ........................................................................95 6.3.1 Security functional requirements rationale....................................................95 6.3.2 Dependency Rationale ...............................................................................100 6.3.3 Security Assurance Requirements Rationale .............................................103 6.3.4 Security Requirements – Mutual Support and Internal Consistency...........104 7. TOE Summary Specification .................................................................................106 7.1 Coverage of SFRs.............................................................................................106 7.1.1 SS.AUTH_IDENT Identification & Authentication ......................................106 7.1.2 SS.SEC_MSG Secure data exchange .......................................................109 7.1.3 SS.ACC_CNTRL Storage and Access Control of Data Objects................109 7.1.4 SS.LFC_MNG Life cycle management.......................................................110 7.1.5 SS.SW_INT_CHECK Software integrity check of TOE’s assets ................110 7.1.6 SS.SF_HW Security features provided by the hardware...........................111 7.1.7 SS.SIG_VER Verification of digital signatures............................................111 7.2 Assurance Measures.........................................................................................113 8. References............................................................................................................116 8.1 Abbreviations.....................................................................................................116 8.2 Glossary ............................................................................................................117 8.3 Technical References........................................................................................123 Appendix A Platform JCOP3 ..................................................................................127 A.1 Platform Identification........................................................................................127 A.2 IC Developer Identification ................................................................................127 A.3 IC Manufacturer Identification............................................................................127 A.4 Operating System Developer Identification .......................................................127 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 4 of 127 List of Tables Table 1 ST Identification ....................................................................................................6 Table 2 TOE Identification .................................................................................................7 Table 3 Legend for deliveries not occurring between consecutive actors........................12 Table 4 Roles Identification..............................................................................................14 Table 5 Identification of recipient actors for the guidance documentation of the TOE .....14 Table 6 Source of assumptions, threats and OSPs .........................................................20 Table 7 Source of security objectives ..............................................................................21 Table 8 Modified/Added components ..............................................................................22 Table 9 Source of Security Functional Requirements.....................................................22 Table 10 Additions, iterations and changes to SFRs .......................................................23 Table 11 Primary assets ..................................................................................................25 Table 12 Secondary assets .............................................................................................26 Table 13 Subjects and external entities according to PACE PP ......................................28 Table 14 Security Objective Rationale.............................................................................48 Table 15 Family FAU_SAS..............................................................................................52 Table 16 Family FCS_RND .............................................................................................53 Table 17 Family FIA_API.................................................................................................54 Table 18 Family FMT_LIM...............................................................................................55 Table 19 Family FPT_EMS..............................................................................................56 Table 20 Definition of security attributes..........................................................................57 Table 21 Keys and certificates.........................................................................................57 Table 22 ECDSA algorithms for signature verification in Terminal Authentication...........67 Table 23 Overview on authentication SFRs.....................................................................68 Table 24 FIA_AFL.1/PACE Refinement...........................................................................69 Table 25 Assurance requirements at EAL4+ ...................................................................94 Table 26 Coverage of Security Objective for the TOE by SFR ........................................95 Table 27 Dependencies between the SFR for the TOE.................................................100 Table 28 Summary of authentication mechanisms ........................................................107 Table 29 Coverage of SFRs by security services ..........................................................112 Table 30 Assurance Requirements documentation .......................................................115 List of Figures Figure 1 TOE life cycle.....................................................................................................13 Figure 2 e-Document physical components.....................................................................18 Figure 3 Advanced Inspection Procedure........................................................................31 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 5 of 127 Notations Numerical values Numbers are printed in decimal, hexadecimal or binary notation. Hexadecimal values are indicated with a ‘h’ suffix as in XXh, where X is a hexadecimal digit from 0 to F. Decimal values have no suffix. Example: the decimal value 179 may be noted as the hexadecimal value B3h. Denoted text The text added to provide details on how the TOE implementation fulfils some security requirements is written in italics and is preceded by the numbered tag “Application Note”. Refinements to the security requirements are denoted by the tag “Refinement” and are written in bold text. Selections and assignments made by the Protection Profile authors are written in underlined text. Selections and assignments made by the authors of this ST are written in underlined bold text. Iterations are denoted by showing a slash “/”, and the iteration indicator after the component indicator. The original text of the selection and assignment components, as defined by the Common Criteria, is given by a footnote. Key words The words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY” and “OPTIONAL” are to be interpreted as described in RFC2119 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 6 of 127 1. Introduction 1.1 ST Overview This Security Target (ST) document defines the security objectives and requirements, as well as the scope of the Common Criteria evaluation of the ASapp-eID Machine Readable Electronic Document. This ST addresses the following advanced security mechanisms: • Extended Access Control (EAC) v1, according to the BSI technical guideline TR- 03110 v2.10 [R8] which includes Chip Authentication and Terminal Authentication, • Password Authenticated Connection Establishment (PACE), according to ICAO Doc 9303 7th ed. 2015 Part 11 [R40], • Active Authentication according to ICAO Doc 9303 7th ed. 2015 Part 11 [R40]. The TOE also supports Basic Access Control (BAC), according to ICAO Doc 9303-11 [R40], which is addressed by another ST [R14]. 1.2 ST reference Table 1 ST Identification Title Security Target ASapp-eID (EAC-PACE-AA) Machine Readable Electronic Document; Public Version Version 1 Authors Arjo Systems Reference TCLE160092 1.3 TOE reference Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 7 of 127 Table 2 TOE Identification Product Name ASapp-eID Product Version 1.0 TOE Identification Data 41h 53h 61h 70h 70h 2Dh 65h 49h 44h 5Fh 31h 5Fh 30h Evaluation Criteria Common Criteria version 3.1 revision 4 Protection Profile BSI-CC-PP-0056-V2-2012 BSI-CC-PP-0068-V2-2011 Evaluation Assurance Level EAL 4 augmented by ALC_DVS.2 and AVA_VAN.5 Developer Arjo Systems – HID Global Evaluation Sponsor Arjo Systems – HID Global Evaluation Facility Systrans Software Laboratory Certification Body OCSI Certification ID ASapp-eID-EAC-PACE-AA The Target of Evaluation (TOE) is identified by the following string, representing the Global Reference: ASapp-eID_1_0 (ASCII codes 41h 53h 61h 70h 70h 2Dh 65h 49h 44h 5Fh 31h 5Fh 30h) The last three bytes encode the applet version (1_0). The ASCII encoding of the TOE identifier constitutes the TOE identification data, located in the persistent memory of the chip. The TOE identification data are located in the non-volatile memory of the chip. Instructions for reading identification data are provided by the guidance documentation. 1.4 TOE overview 1.4.1 TOE type and usage The TOE addressed by this ST is an electronic document containing a chip programmed according to the “Password Authenticated Connection Establishment” (PACE) mechanism described in the ICAO Doc 9303 7th edition 2015 Part 11 [R40], which means amongst others according to the Logical Data Structure (LDS) defined in [R39], and additionally providing the “Extended Access Control” (EAC) according to the ICAO Doc 9303-11 [R40], and BSI TR-03110 [R8]. The communication between terminal and chip shall be protected by PACE according to the Protection Profile “Machine Readable Travel Document using Standard Inspection Procedure with PACE” (PACE PP), BSI-CC-PP-0068-V2 [R7]. The TOE is composed of: • the circuitry of the e-Document’s chip P622J-VB (see Appendix A), • the IC Dedicated Software with the parts IC Dedicated Test Software and IC Dedicated Support Software, Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 8 of 127 • the IC Embedded Chip Operating System (JCOP3), • an ICAO application compliant with ICAO Doc 9303-10 [R39] and Doc 9303-11 [R40], • the associated guidance documentation [R33][R34][R35]. Due to its composite nature, the TOE evaluation builds on the evaluation of the integrated circuit. The TOE supports wired communication, through the IC contacts exposed to the outside, as well as wireless communication through an antenna connected to the IC. Both the TOE and the antenna are embedded in a paper or plastic substrate, that provides mechanical support and protection. Once personalized with the data of the legitimate holder and with security data, the e- Document can be inspected by authorized agents. The TOE adds security features to a document booklet or card, providing machine-assisted identity confirmation and machine- assisted verification of document security. The TOE is mean for “global interoperability”. According to ICAO the term is understood as “the capability of inspection systems (either manual or automated) in different States throughout the world to exchange data, to process data received from systems in other States, and to utilize that data in inspection operations in their respective States”. The TOE is supplied with a file system, that contains all the data used in the context of the ICAO application as described in the Protection Profiles [R5][R6]. 1.4.2 TOE Usage and security features for operational use A State or Organization issues e-Documents to be used by the holder. The user presents an e-Document to the inspection system to prove his or her identity. Being the TOE a general-purpose e-Document, it supports both the following types of PACE passwords: • nonsecret passwords not readable from the logical document, at least without a previous PACE authentication, but printed or displayed on the physical document. An example of this is the Machine-Readable Zone (MRZ) or Card Access Number (CAN) as in the case of a PACE ePassport [R40]); secret passwords not deducible from either the logical document, at least without a previous PACE authentication, or the physical document. The document holder can control access to his user data by consciously presenting his document to organizations deputed to perform inspection1. In the case of a secret PACE password, the document holder can exert further control over access to his data as in addition to his document, he must separately reveal the password in order to authorize inspection. 1 user authentication with PACE password, such as CAN or MRZ or shared secret, see [R40] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 9 of 127 The document’s chip is integrated into a physical (plastic or paper) substrate. The substrate is not part of the TOE. The tying-up of the document’s chip to the plastic/paper document is achieved in accordance with physical and organizational security measures being within the scope of the current security target. The e-Document in context of this security target contains: i. data elements on the e-Document’s chip according to LDS for contactless or contact machine reading. Additionally, the e-Document may bear: ii. visual (eye readable) biographical data and portrait of the holder, iii. a separate data summary (MRZ data) for visual and machine reading using OCR methods in the MRZ. The authentication of the presenter2 is based on: • the possession of a valid e-Document personalized with the claimed identity as given on the biographical data page and • biometrics using the reference data stored in the e-Document. The Issuing State or Organization ensures the authenticity of the data of genuine e- Documents. The receiving state trusts a genuine e-Document of an Issuing State or Organization. For this security target the e-Document is viewed as the unit of: • the physical part of the electronic document in form of paper and/or plastic and chip. It presents visual readable data including (but not limited to) personal data of the e-Document holder: i. the biographical data on the biographical data page of the data surface, ii. the printed data in the MRZ, iii. the printed portrait • the logical e-Document as data of the document holder stored according to the Logical Data Structure as defined in [R12] as specified by ICAO on the integrated circuit. It presents machine readable data including (but not limited to) personal data of the e-Document holder: i. EF.COM lists the existing elementary files (EF) with the user data, ii. the digital MRZ Data (EF.DG1), iii. the digitized portraits (EF.DG2), iv. the biometric reference data of finger(s) (EF.DG3) or iris image(s) (EF.DG4) or both3, v. the other data according to LDS (EF.DG5 to EF.DG16), vi. the Document security object (SOD) and vii. security data objects required for product management. 2 The person presenting the e-Document to the Inspection System. 3 These biometric reference data are optional according to [R39]. This ST assumes that the issuing State or Organization uses this option and protects these data by means of extended access control. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 10 of 127 The Issuing State or Organization implements security features of the e-Document to maintain the authenticity and integrity of the e-Document and its data. The physical part of the e-Document as the e-Document’s chip are uniquely identified by the Document Number. The physical part of the e-Document is protected by physical security measures (e.g. watermark, security printing), logical (e.g. authentication keys of the e-Document’s chip) and organizational security measures (e.g. control of materials, personalization procedure). These security measures can include the binding of the e-Document's chip to the e- Document. The logical e-Document is protected in authenticity and integrity by a digital signature created by the document signer acting for the issuing State or Organization and the security features of the e-Document’s chip. The ICAO defines the baseline required security methods Passive Authentication and the following optional advanced security methods: • Basic Access Control to the logical e-Document, • Active Authentication of the e-Document’s chip, • Extended Access Control to and the Data Encryption of sensitive biometrics as an optional security measure in the ICAO Doc 9303-11 [R40] and • Password Authenticated Connection Establishment [R40]. The Passive Authentication mechanism is performed completely and independently of the TOE by the TOE environment. This security target addresses the protection of the logical e-Document: i. in integrity by write-only-once access control and by physical means and ii. in confidentiality by the Extended Access Control Mechanism. As BAC is also supported by the TOE, the e-Document has to be evaluated and certified separately. This is due to the fact that [R5] does only consider extended basic attack potential to the Basic Access Control Mechanism (i.e. AVA_VAN.3). The confidentiality by Password Authenticated Access Control (PACE) is a mandatory security feature of the TOE. The e-Document shall strictly conform to the “Common Criteria Protection Profile Machine Readable Travel Document using Standard Inspection Procedure with PACE (PACE PP)” [R7]. Note that [R7] considers high attack potential. The TOE supports PACE with Generic Mapping (PACE-GM). For the PACE protocol according to [R40], the following steps shall be performed: i. The e-Document’s chip encrypts a nonce with the shared password, derived from the PACE password (MRZ, CAN or secret password) and transmits the encrypted nonce together with the domain parameters to the terminal; ii. The terminal recovers the nonce using the shared password. If this password is derived from MRZ or CAN, MRZ data or CAN data are physically read; iii. The e-Document’s chip and terminal computer perform a Diffie-Hellman key agreement together with the ephemeral domain parameters to create a shared secret. Both parties derive the session keys KMAC and KENC from the shared secret. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 11 of 127 iv. Each party generates an authentication token, sends it to the other party and verifies the received token. After successful key negotiation the terminal and the e-Document’s chip provide private communication (secure messaging) [R7] [R40]. This security target requires the TOE to implement the EAC as defined in [R39][R8] and additionally the Active Authentication as defined in [R40]. The EAC consists of two parts (i) the Chip Authentication and (ii) the Terminal Authentication Protocol Version 1 (v.1). The Chip Authentication may be performed as part of the PACE protocol (see steps v and vi above), or as a distinct protocol (Chip Authentication protocol version 1). Both modes are detailed in section 4.4 of Doc 9303-11 [R40]. The Chip Authentication (i) authenticates the e-Document’s chip to the inspection system and (ii) establishes secure messaging which is used by Terminal authentication v.1 to protect the confidentiality and integrity of the sensitive biometric reference data during their transmission from the TOE to the inspection system. Therefore, Terminal Authentication v.1 can only be performed if Chip Authentication Protocol v.1 have been successfully executed. The Terminal Authentication Protocol v.1 consists of (i) the authentication of the inspection system as entity authorized by the receiving State or Organization through the issuing State, and (ii) an access control by the TOE to allow reading the sensitive biometric reference data only to successfully authenticated inspection systems. The issuing State or Organization authorizes the receiving State by means of certification the authentication public keys of Document Verifiers who create Inspection System Certificates. The Active Authentication authenticates the e-Document to the inspection system. 1.5 TOE Life-cycle The TOE life cycle is described in terms of the following four life cycle phases, each divided in one or more steps: 1. Phase 1: Development, composed of Step 1) the development of the integrated circuit and of the multi-application operating system Java Card 3 by the IC Manufacturer and Step 2) the development of the eID applet by the Embedded Software Developer; 2. Phase 2: Manufacturing, composed of Step 3) Loading the applet, Step 4) the embedding of the chip in a substrate with an antenna. The antenna may be omitted if the IC contacts are exposed. Step 5) the Initialization and configuration 3. Phase 3: Personalization, comprising Step 6) Personalization of the e-Document for the holder 4. Phase 4: Operational Use, comprising Step 7) Inspection of the e-Document Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 12 of 127 Application Note 1: The entire Development phase, as well as Step 3 “Loading the applet ” of the Manufacturing phase are the only phases covered by assurance as during these phases the TOE is under construction in a protected environment. Figure 1 shows life cycle phases and steps. The picture also identifies the actors involved in each life cycle step. Direct deliveries of items between actors are represented with continuous lines, while deliveries in which intermediate actors may be in charge of receiving the exchanged items and forwarding them to the subsequent actors are represented with dotted lines. Deliveries of items not occurring between consecutive actors are just marked with letters in order to preserve the clarity of the diagram. A legend for these deliveries, which identifies the exchanged items for each of them, is provided in Table 3. Table 3 Legend for deliveries not occurring between consecutive actors Delivery Delivered items (a) • SCP Key1 - DES - mutual authenticate for loading applet (b) • eID Applet load file (c) • SCP Key4 – DES – mutual authentication for initialization agent (initialization key) (d) • Initialization guidance (e) • SCP Key5 – DES – mutual authenticate for personalization agent (personalization key) (f) • Personalization guidance (g) • Operational user guidance Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 13 of 127 Figure 1 TOE life cycle Detailed information about the operations available in each life cycle phase of the TOE is provided in the guidance documentation. - IC manufacturing documentation - IC Dedicated software -multi-application Operating System - eID Applet - Initialization key - TOE - TOE Step 1: Development of the IC and the Operating System Phase 1: Development Step 2: Development of the eID Applet IC Developer and manufacturer Embedded Software Developer Step 3: Loading of the applet IC Developer and manufacturer TOE delivery Phase 1: Development Phase 2: Manufacturing Phase 2: Manufacturing Step 4: Manufacturing of the smart card or document booklet eDocument Manufacturer Phase 2: Manufacturing Step 5: Initialization and configuration Initialization Agent Phase 3: Personalization Personalization Agent Step 6: Personalization eDocument Holder Phase 4: Operational use Step 7: Inspection Delivered self-protected TOE TOE under construction in a secure environment - TOE - TOE - Inspection System (a) (b) (f) (e) (d) (c) (g) Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 14 of 127 Table 4 identifies the roles in each phase of the TOE life cycle. Table 4 Roles Identification Phase Role Identification 1 IC Developer NXP 1 IC Manufacturer NXP 1 Applet Developer Arjo Systems – HID Global 2 e-Document Manufacturer The agent who is acting on behalf of the Issuing State or Organization to assemble the booklet or plastic card by embedding the TOE and antenna into the substrate. 2 Initialization Agent The agent who is acting on behalf of the Issuing State or Organization to configure the applet. 3 Personalization Agent The agent who is acting on the behalf of the Issuing State or Organization to personalize the e-Document for the holder 4 e-Document Holder The rightful owner of the e-Document 4 Inspection System Role operated by government or enforcement organizations e.g. police or government or other state approved agencies. Table 5 identifies, for each guidance document, the actors who are the intended recipients of that item. Table 5 Identification of recipient actors for the guidance documentation of the TOE Guidance document Recipient actors Initialization guidance Initialization Agent Personalization guidance Personalization Agent Operational user guidance Inspection System The phases and steps of the TOE life cycle are described in what follows. The names of the involved actors are emphasized using boldface. 1.5.1 Phase 1: Development (Step 1) The IC Developer develops the integrated circuit, the IC Dedicated Software, the Java Card™ multi-application Operating System and the guidance documentation associated with these TOE components. The IC developer generates SCP Key5. Finally, the following items are securely delivered to the Embedded Software Developer: • the IC manufacturing documentation, • the Java Card™ multi-application Operating System documentation Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 15 of 127 Step 2: Development of the Embedded Software The Embedded Software Developer uses the guidance documentation for the integrated circuit and for relevant parts of the IC Java Card™ multi-application operating system and develops the Embedded Software (consisting of a Java Card™ applet) as well as its associated guidance documentation. Finally, the following items are securely delivered to the IC Manufacturer: • the eID applet Regarding the TOE guidance documentation, either all documents are securely delivered to the Initialization Agent, or each document is securely delivered to the recipient actors as identified in Table 5. 1.5.2 Phase 2: Manufacturing (Step 3) The IC Manufacturer produces the TOE integrated circuit, containing the Java Card™ multi-application operating system, and creates in the IC persistent memory the high-level objects required for the eID applet, including the TOE identification data, configuration data, initialization key and eID package. This is referred to as the loading of the applet. Finally, the TOE is securely delivered to the e-Document Manufacturer. Application Note 2: The point of delivery of the TOE coincides with the completion of Step 3, i.e. with the delivery of the TOE from the IC Manufacturer to the e-Document Manufacturer. (Step 4) The e-Document Manufacturer embeds the programmed IC into a plastic or paper substrate, optionally equipping it with an antenna (for ISO 14443 interface), and optionally exposing IC contacts (for ISO 7816-2 interface). (Step 5) The Initialization Agent use the initialization key to mutual authentication with the TOE to instantiate eID applet. Application Note 3: During TOE initialization, the Initialization Agent establishes a trusted channel with the TOE through the initialization key. After initialization, personalization key will be set to the TOE. For further information, cf. the initialization guidance [R33]. Regarding the TOE guidance documentation, if the Initialization Agent also received the documents intended for the subsequent actors, then either all of these documents are securely delivered to the personalization Agent, or each document is securely delivered to the recipient actors as identified in Table 5. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 16 of 127 1.5.3 Phase 3: Personalization (Step 6) The personalization of the e-Document includes: (i) the survey of the e-Document holder’s biographical data, (ii) the enrolment of the e-Document holder biometric reference data (i.e. the digitized portraits and the optional biometric reference data), (iii) the personalization of the visual readable data onto the physical part of the e- Document, (iv) the writing of the TOE User Data and TSF Data into the logical e-Document and (v) configuration of the TSF if necessary. The step (iv) is performed by the Personalization Agent and includes but is not limited to the creation of (i) the digital MRZ data (EF.DG1), (ii) the digitized portrait (EF.DG2), and (iii) the Document security object. The Personalization Agent authenticates with the TOE using personalization key to gain authorization to perform personalization. The signing of the SOD by the document signer finalizes the personalization of the genuine e-Document for the document holder. The personalized e-Document (together with appropriate guidance for TOE use if necessary) is handed over to the e-Document holder for operational use. Application Note 4: The TSF data (data created by and for the TOE, that might affect the operation of the TOE; cf. [R10]) comprise (but are not limited to) the Initialization key, the Personalization key and the Basic Access Control Key. Application Note 5: This security target distinguishes between the Personalization Agent as an entity known to the TOE and the Document Signer as an entity in the TOE IT environment signing the Document security object as described in [R40]. This approach allows but does not enforce the separation of these roles. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 17 of 127 1.5.4 Phase 4: Operational use (Step 7) “Inspection of the e-Document” The TOE is used as e-Document’s chip by the presenter and the inspection systems in the “Operational Use” phase. The user data can be read according to the security policy of the issuing State or Organization and can be used according to the security policy of the issuing State, but they can never be modified. Application Note 6: This ST considers the phases 1 and parts of phase 2 (i.e. Step1 to Step3) as part of the evaluation and therefore defines the TOE delivery according to CC after this phase. Since specific production steps of phase 2 are of minor security relevance (e.g. card manufacturing and antenna integration) these are not part of the CC evaluation under ALC. Nevertheless, the decision about this has to be taken by the certification body resp. the national body of the issuing State or Organization. In this case the national body of the issuing State or Organization is responsible for these specific production steps. Note that the personalization process and its environment may depend on specific security needs of an issuing State or Organization. All production, generation and installation procedures, after TOE delivery up to the “Operational Use” (phase 4) have to be considered in the product evaluation process under AGD assurance class. Therefore this security target outlines the split up of P.Manufact, P.Personalization and the related security objectives into aspects relevant before vs. after TOE delivery. Some production steps, e.g. Step 5 in Phase 2 may also take place in the Phase 3. 1.5.5 Non-TOE hardware/software/firmware required by the TOE There is no explicit non-TOE hardware, software or firmware required by the TOE to perform its claimed security features. The TOE is defined to comprise the chip and the complete operating system and applet. Note, the substrate holding the chip as well as the antenna (if any) and the booklet or plastic card (holding the printed MRZ or CAN) are needed to represent a complete e-Document, nevertheless these parts are not essential for the secure operation of the TOE. 1.6 TOE Description 1.6.1 Physical scope of the TOE The TOE is composed of: • the circuitry of the e-Document’s chip P6022J-VB (see Appendix A), • the IC Dedicated Software with the parts IC Dedicated Test Software and IC Dedicated Support Software, • the IC Embedded Software (JCOP multi-application Operating System), • an ICAO application compliant with ICAO Doc 9303-10 [R39] and Doc 9303-11 [R40], • the associated guidance documentation [R33][R34][R35]. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 18 of 127 The microcontrollers P6022J VB (and its operating system) containing the ASapp-eID applet is described in Appendix A 1.6.2 Other non-TOE physical components The antenna and the substrate are not part of the TOE. Figure 2 shows the physical e- Document component, distinguishing between TOE components and non-TOE components. Figure 2 e-Document physical components 1.6.3 Logical scope of the TOE The logical part of the TOE comprises the following software components stored in the non- volatile memory units of the microcontroller: • operating system • file system • eID applet • security data objects The file system implemented by the eID applet contains security data objects, and the ICAO Logical Data Structure (LDS). Once the document is in the Operational state, no data concerning the eID applet can be deleted or modified, except for the current date, the trustpoint and the EF.CVCA file which can also be modified. Microcontroller module (TOE component), Antenna (non-TOE component) Substrate material (non-TOE component) Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 19 of 127 2. Conformance claims 2.1 Common Criteria Conformance Claim This Security Target claims conformance to: • Common Criteria version 3.1 revision 4, International English Version [R10][R11][R12], as follows: o Part 2 (security functional requirements) extended o Part 3 (security assurance requirements) conformant The software part of the TOE runs on the chip NXP P6022J-VB (see Appendix A). This integrated circuit is certified against Common Criteria at the assurance level EAL5+ (cf. Appendix A). 2.2 Protection Profile Conformance Claim This ST claims strict conformance to: • BSI-CC-PP-0056-V2-2012 Common Criteria Protection Profile Machine Readable Travel Document with “ICAO Application”, Extended Access Control with PACE (EAC PP), version 1.3.2 05th December 2012 [R6]. • BSI-CC-PP-0068-V2-2011 Common Criteria Protection Profile Machine Readable Travel Document using Standard Inspection Procedure with PACE (PACE PP), version 1.0, 2nd November 2011 [R7] 2.3 Package Conformance Claim This Security Target claims conformance to: • EAL 4 assurance package augmented by ALC_DVS.2, ATE_DPT.2 and AVA_VAN.5 defined in the CC part 3 [R12] 2.4 Conformance Claim Rationale This ST claims strict conformance to the PACE PP [R7] and EAC PP [R6]. The parts of the TOE listed in those Protection Profiles correspond to the ones listed in section 1.4.1 of this ST. This ST adopts as a reference the ICAO Doc 9303 Seventh Edition 2015. This new version includes the specification of the PACE protocol, and no longer uses the terms “Supplemental Access Control” and “SAC”. Due to this update: • any references to the ICAO Doc 9303 2006 specification in the EAC PP and in the PACE PP have been replaced with references to Doc 9303 2015, Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 20 of 127 • any references to the ICAO “Supplemental Access Control” specification have been replaced with references to Doc 9303 2015, • the terms “Supplemental Access Control” and “SAC” in the PACE PP have been replaced with the terms “Password Authenticated Connection Establishment” and “PACE”. For the TOE the Chip Authentication may be performed as a distinct protocol. Consequently, the parts of the EAC PP concerning Chip Authentication have been modified in this ST to take into account the two Chip Authentication modes. The term “Chip Authentication” used without further specification indicates either modes. Being the TOE a general purpose electronic document, all references in the PPs to the use of the TOE for travel have been removed in this ST. For the same reason, with respect to the PPs, in this ST the acronym “MRTD” has been replaced by the term “e-Document”, the term "travel document" has been replaced by the terms "e-Document" or "electronic document", and the term "traveller" has been replaced by the terms "user" or "presenter". With respect to the PP, the role “MRTD Manufacturer” has been split into the roles “e- Document Manufacturer”, “Initialization Agent” acting in Phase 2 “Manufacturing” respectively in Step 4 “Manufacturing of the smart card or document booklet” and Step 5 “Initialization and configuration ”. Note the e-Document Manufacturer is a role performing only the physical preparation of the TOE. In some parts of this ST the roles acting in Phase 2, i.e. the IC Manufacturer, the e-Document Manufacturer and the Initialization Agent are collectively referred to as the Manufacturer. In this ST, the TOE will be delivered from the IC Manufacturer to the e-Document Manufacturer after Step 3 “Loading of the applet” of Phase 2, as a chip, in accordance with Application Note 4 of the EAC PP [R6]. At TOE delivery, there is no user data or machine readable data available. The remaining user data as well as applicative files are written by the Personalization Agent, during Phase 3 “Personalization”. The TOE provides a contact interface according to ISO/IEC 7816-2 [R37]; therefore, in addition to the contactless interface referred in the PPs, this ST makes also references to the contact interface. The security problem definition includes the assets, the subjects, the assumptions, the threats and the organizational security policies of both PPs. Table 6 specifies the source (PACE PP or EAC PP) of assumptions, threats and organizational security policies. Table 6 Source of assumptions, threats and OSPs Source PACE PP [R7] EAC PP [R6] Assumptions • A.Passive_Auth • A.Insp_Sys • A.Auth_PKI Threats • T.Skimming • T.Eavesdropping • T.Read_Sensitive_Data • T.Counterfeit Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 21 of 127 The security objectives of both PPs are included in this ST. Table 7 specifies the source (PACE PP or EAC PP) of security objectives for the TOE and of security objectives for the operational environment. Table 7 Source of security objectives Note that the objective named OE.Auth_Key_Travel_Document in the EAC PP has been renamed to OE.Chip_Auth_Key_e-Document to distinguish it from the similar objective that has been added to this ST to cover the Active Authentication (see Table 8 below). Table 8 lists the assumptions, the security objectives and the policies that have been modified/added in this ST with respect to the PPs. • T.Tracing • T.Forgery • T.Abuse-Func • T.Information_Leakage • T.Phys-Tamper • T.Malfunction Organizational Security Policies • P.Manufact • P.Pre-Operational • P.Card_PKI • P.Trustworthy_PKI • P.Terminal • P.Sensitive_Data • P.Personalization Source PACE PP [R7] EAC PP [R6] Security Objectives for the TOE • OT.Data_Integrity • OT.Data_Authenticity • OT.Data_Confidentiality • OT.Tracing • OT.Prot_Abuse-Func • OT.Prot_Inf_Leak • OT.Prot_Phys-Tamper • OT.Prot_Malfunction • OT.Identification • OT.AC_Pers • OT.Sens_Data_Conf • OT.Chip_Aut_Proof Security Objectives for the operational environment • OE.Personalization • OE-Passive_Auth_Sign • OE.Terminal • OE.e-Document_Holder • OE.Legislative_Compliance • OE.Chip_Auth_Key_e-Document • • OE.Authoriz_Sens_Data • OE.Exam_e-Document • OE.Prot_Logical_e-Document • OE.Ext_Insp_Systems Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 22 of 127 Table 8 Modified/Added components Component Definition Operation OT.Active_Auth_Proof Proof of e-Document’s chip authenticity by Active Authentication Added to cover the proof of IC authenticity for Basic Inspection Systems OE.Active_Auth_Key_e- Document e-Document Active Authentication key OE.Active_Auth_Key_e- Document only ensures the establishment of the PKI necessary for the objective for the TOE OT.Active_Auth_Proof to counter the threat T.Counterfeit, without interfering with either the other threats or the OSPs OE.Initialization Initialization of e- Document Added to take into account responsibilities in Step 5, to deal with applet instantiation, so that it cannot interfere with the objectives for the TOE drawn from the PPs (which are neutral with respect to Java Card technology). OT.Identification Identification of the TOE Modified in a more restrictive way as access to TOE identification data in Phase 4 is restricted to a BAC authenticated Inspection System only (the Personalization Agent cannot access identification data after personalization). P.Manufact Manufacturing of the e- Document’s chip Modified to specify that the IC Manufacturer stores the e- Document’s Manufacturer keys. The functional requirements described in section 6 of this ST include the SFRs of both the PACE PP [R7] and EAC PP [R6]. Table 9 specifies the source (PACE PP or EAC PP) of security functional requirements. Table 9 Source of Security Functional Requirements Source PACE PP [R7] EAC PP [R6] SFRs • FCS_CKM.4 • FCS_COP.1/PACE_ENC • FCS_COP.1/PACE_MAC • FCS_RND.1 • FIA_AFL.1/PACE • FCS_CKM.1/DH_PACE • FCS_CKM.1/CA • FCS_COP.1/CA_ENC • FCS_COP.1/SIG_VER • FCS_COP.1/CA_MAC Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 23 of 127 In the above table, note the following points: • The EAC PP SFRs written in bold text cover the definition in PACE PP and extend them for EAC. These extensions do not conflict with strict conformance to PACE PP. • An iteration label has been added to the EAC PP SFRs printed in underlined text, to distinguish them from the similar SFRs that have been added to this ST (see Table 10 below). The requirement definitions remain unchanged with respect to the PP. Iterations and changes to the SFRs, with respect to PACE PP and EAC PP, are listed in Table 10. These changes do not lower TOE security. Table 10 Additions, iterations and changes to SFRs Security Functional Requirement Operation FIA_API.1/AA Iteration This iteration has been added to cover the proof of identity by means of Active Authentication. • FIA_UID.1/PACE • FIA_UAU.1/PACE • FIA_UAU.4/PACE • FIA_UAU.5/PACE • FIA_UAU.6/PACE • FDP_ACC.1/TRM • FDP_ACF.1/TRM • FDP_RIP.1 • FDP_UCT.1/TRM • FDP_UIT.1/TRM • FTP_ITC.1/PACE • FAU_SAS.1 • FMT_SMF.1 • FMT_SMR.1/PACE • FMT_LIM.1 • FMT_LIM.2 • FMT_MTD.1/INI_ENA • FMT_MTD.1/INI_DIS • FMT_MTD.1/KEY_READ • FMT_MTD.1/PA • FPT_EMS.1 • FPT_FLS.1 • FPT_TST.1 • FPT_PHP.3 • FIA_UID.1/PACE • FIA_UAU.1/PACE • FIA_UAU.4/PACE • FIA_UAU.5/PACE • FIA_UAU.6/PACE • FIA_UAU.6/EAC • FIA_API.1/CA • FDP_ACC.1/TRM • FDP_ACF.1/TRM • FMT_SMR.1/PACE • FMT_LIM.1 • FMT_LIM.2 • FMT_MTD.1/CVCA_INI • FMT_MTD.1/CVCA_UPD • FMT_MTD.1/DATE • FMT_MTD.1/CAPK • FMT_MTD.1/KEY_READ • FMT_MTD.3 • FPT_EMS.1 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 24 of 127 FIA_API.1/CA Iteration An iteration label has been added to the FIA_API.1 SFR in EAC PP, to distinguish it from the FIA_API.1/AA SFR added to this ST. FIA_AFL.1/PACE Refinement A refinement has been added to this SFR to specify failure handling for all the authentication mechanisms provided by the TOE. FCS_COP.1/AA_SIGN Iteration This iteration has been added to cover the signature of Active Authentication data. FMT_MTD.1/AAPK Iteration This iteration has been added to restrict the ability to cover the writing of the Active Authentication private key FMT_MTD.1/ADDTSF_WRITE Management of TSF data – additional TSF data write Iteration This iteration has been added to cover the storage of additional TSF data in personalization FMT_MTD.1/LCS_UPDATE Iteration This iteration has been added to specify the role enabled to update the Life Cycle Status information. FIA_UAU.4/PACE Single use authentication mechanisms – single use authentication of the Terminal by the TOE Change of Application Note The application note now clarifies that this SFR also relates to the authentication of the Initialization Agent (cf. Application Note 58:). FIA_UAU.5/PACE Multiple authentication mechanisms Change of definition the Initialization Agent has been added as users allowed to authenticate to the e-Document (cf. Application Note 58: ). FPT_EMS.1.2 TOE Emanation Refinement A refinement has been added to better specifiy access to data through contact interface. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 25 of 127 3. Security Problem Definition 3.1 Introduction Application Note 7: With respect to the security problem definition defined in the protection profiles, this ST has some additions concerning the Active Authentication. 3.1.1 Assets Due to strict conformance to both EAC PP [R6] and PACE PP [R7], this ST includes, as assets to be protected, all assets listed in section 3.1 of those PPs. 3.1.1.1 Assets to be protected according to PACE PP The primary assets to be protected by the TOE as long as they are in scope of the TOE are listed in Table 11 (please refer to the glossary in chap. 7 for the term definitions). Table 11 Primary assets Object No. Asset Definition Generic security property to be maintained by the current security policy e-Document 1 User data stored on the TOE All data (being not authentication data) stored in the context of the ICAO application of the e-Document as defined in [R40] and being allowed to read out solely by an authenticated terminal acting as Basic Inspection System with PACE (in the sense of [R40]). This asset covers “User Data on the MRTD’s chip”, “Logical MRTD Data” and “sensitive User Data” in [R5]. Confidentiality4 Integrity Authenticity 2 User data transferred between the TOE and the terminal connected (i.e. an authority represented by All data (being not authentication data) being transferred in the context of the ICAO application of the electronic document as defined in [R40] between the TOE and an authenticated terminal acting as Basic Inspection System with PACE (in the sense of [R40]). Confidentiality5 Integrity Authenticity 4 Though note ac data element stored on the TOE represents a secret, the specification [R40] anyway requires securing their confidentiality: only terminals authenticated according to [R40] can get access to the user data stored. They have to be operated according to P.Terminal. 5 Though not each data element being transferred represents a secret, the specification [R40] anyway requires securing their confidentiality: the secure messaging in encrypt-then-authenticate mode is required for all messages according to [R40]. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 26 of 127 Basic Inspection System with PACE) User data can be received and sent (exchange  {receive, send}). 3 e-Document tracing data Technical information about the current and previous locations of the e- Document gathered unnoticeable by the e-Document holder recognising the TOE not knowing any PACE password. TOE tracing data can be provided/gathered. unavailability6 Application Note 8: Please note that user data being referred to in the table above include, amongst other, individual-related (personal) data of the e-Document holder which also include his sensitive (i.e. biometric) data. Hence, the general security policy defined by the current PP also secures these specific e-Document holder’s data as stated in the table above. All these primary assests represent User Data in the sense of CC. The secondary assests also having to be protected by the TOE in order to achieve a sufficient protection of the primary assets are: Table 12 Secondary assets Object No. Asset Definition Property to be maintained by the current security policy e-Document 4 Accessibility to the TOE functions and data only for authorised subjects Property of the TOE to restrict access to TSF and TSF-data stored in the TOE to authorised subjects only. Availability 5 Genuineness of the TOE Property of the TOE to be authentic in order to provide claimed security functionality in a proper way. This asset also covers “Authenticity of the MRTD’s chip” in [R5]. Availability 6 TOE internal secret cryptographic keys Permanently or temporarily stored secret cryptographic material used by the TOE in order to enforce its security functionality. Confidentiality Integrity 6 Represents a prerequisite for anonymity of the e-Document holder. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 27 of 127 7 TOE internal non- secret cryptographic material Permanently or temporarily stored non-secret cryptographic (public) keys and other on-secret material (Document Security Object SOD containing digital signature) used by the TOE in order to enforce its security functionality. Integrity Authenticity 8 e-Document communication establishment authorisation data Restricted-revealable7 authorisation information for a humanuser being used for verification of the authorisation attempts as authorised user (PACE password). These data are stored in the TOE and are not to be sent to it. Confidentiality Integrity Application Note 9: Since the e-Document does not support any secret document holder authentication data and the latter may reveal, if necessary, his or her verification values of the PACE password to an authorised person or device, a successful PACE authentication of a terminal does not unambiguously mean that the e-Document holder is using TOE. Application Note 10: e-Document communication establishment authorisation data are represented by two different entities: (i) reference information being persistently stored in the TOE and (ii) verification information being provided as input for the TOE by a human user as an authorisation attempt. The TOE shall secure the reference information as well as – together with the terminal connected8 - the verification information in the “TOE  terminal” channel, if it has to be transferred to the TOE. Please note that PACE passwords are not to be sent to the TOE. The secondary assets represent TSF and TSF-data in the sense of CC. 3.1.1.2 Assets to be protected according to EAC PP Logical e-Document sensitive User Data Sensitive biometric reference data (EF.DG3, EF.DG4) Application Note 11: Due to interoperability reasons the ICAO Doc 9303-11 [R40] requires that Basic Inspection Systems may have access to logical e-Document data DG1, DG2, DG5 to DG16. The TOE is not in certified mode according to this ST, if it is accessed using BAC [R40] (conformance to the BAC certification [R14] is kept, though). Note that the BAC mechanism cannot resist attacks with high attack potential (cf. [R5]). If supported, it is therefore recommended to use PACE instead of BAC. If nevertheless BAC has to be used, 7 The e-Document holder may reveal, if necessary, his or her verification values of CAN and MRZ to an authorised person or device who definitely act according to respective regulations and are trustworthy. 8 The e-Document holder mayreveal, if necessary, his or her verification values of CAN and MRZ to an authorised person or device who definitely act according to respective regulations and are trustworthy. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 28 of 127 it is recommended to perform Chip Authentication v.1 before getting access to data (except DG14), as these mechanisms are resistant to potential attacks. A sensitive asset is the following more general one. Authenticity of the e-Document’s chip The authenticity of the e-Document’s chip personalised by the issuing State or Organization for the e-Document holder is used by the presenter to prove his possession of a genuine e- Document. 3.1.2 Subjects This security target considers the subjects defined in the PACE PP, and in the EAC PP. The subjects considered in accordance with the PACE PP are listed in Table 13. Table 13 Subjects and external entities according to PACE PP External Entity No. Subject No. Role Definition 1 1 e-Document holder A person for whom the e-Document Issuer has personalised the e-Document9. This entity is commensurate with e-Document Holder in [R5]. Please note that an e-Document holder can also be an attacker (see below external entity No.9). 2 - e-Document presenter A person presenting the e-Document to a terminal10 and claiming the identity of the e-Document holder. This external entity is commensurate with “Traveller” in [R5]. Please note that an e-Document presenter can also be an attacker (see below external entity No.9). 3 2 Terminal A terminal is any technical system communicating with the TOE through the contact or contactless interfaces. The role “Terminal” is the default role for any terminal being recognised by the TOE as not being PACE authenticated (“Terminal” is used by the e- Document presenter). This entity is commensurate with “Terminal” in [R5]. 4 3 Basic Inspection System with PACE (BIS- PACE) A technical system being used by an inspection authority11 and verifiying the e-Document presenter as the e-Document holder (for e-Document: by comparing the real biometric data (face) of the e- 9 i.e. this person is uniquely associated with a concrete electronic Passport 10 In the sense of [R40] 11 Concretely, by a control officer Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 29 of 127 Document presenter with the stored biometric data (DG2) of the e-Document holder). BIS-PACE implements the terminal’s part of the PACE protocol and authenticates itself to the e- Document using a shared password (PACE password) and supports Passive Authentication. 5 - Document Signer (DS) An organization enforcing the policy of the CSCA and signing the Document Security Object stored on the e-Document for passive authentication. A Document Signer is authorised by the national CSCA issuing the Document Signer Certificate (CDS), see [R41]. This role is usually delegated to a Personalization Agent. 6 - Country Signing Certification Authority (CSCA) An organization enforcing the policy of the e- Document Issuer with respect to confirming correctness of user and TSF data stored in the e- Document. The CSCA represents the country specific root of the PKI for the e-Document and creates the Document Signer Certificates within this PKI. The CSCA also issues the self-signed CSCA Certificate (CCSCA) having to be distributed by strictly secure diplomatic means, see [R41]. 7 4 Personalizati on Agent An organization acting on behalf of the e-Document Issuer to personalise the e-Document for its holder by some or all of the following activities (i) establishing the identity of the e-Document holder, (ii) enrolling the biometric reference data of the e- Document holder, (iii) writing a subset of these data on the physical e-Document (optical personalization) and storing them in the e- Document (electronic personalization) for the e- Document holder as defined in [R40], (iv) writing the document details data, (v) writing the initial TSF data data, (vi) signing the Document Security Object defined in [R39] (in the role fo DS). Please note that the role “Personalization Agent” may be distributed among several institutions according to the operational policy of the e- Document Issuer. This entity is commensurate with “Personalization Agent” in [R39]. 8 5 Manufacturer Generic term collectively identifying the IC Manufacturer, the e-Document Manufacturer, the Initialization Agent. The Manufacturer is the default user of the TOE during the manufacturing life cycle phase. This entity commensurate with “Manufacturer” in [R5]. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 30 of 127 9 - Attacker A threat agent (a person or a process acting on his behalf) trying to undermine the security policy defined by the current PP, especially to change properties of the assets having to be maintained. The attacker is assumed to possess an at most high attack potential. Please note that the attacker might “capture” any subject role recognised by the TOE. This external entity is commensurate to “Attacker” in [R5]. Application Note 12: The subject “Basic Inspection System with BAC” (BIS-BAC) is described in an other ST [R14]. In addition to the subjects defined by the PACE PP, this ST considers the following subjects defined by the EAC PP: • Country Verifying Certification Authority: The Country Verifying Certification Authority (CVCA) enforces the privacy policy of the issuing State or Organization with respect to the protection of sensitive biometric reference data stored in the e- Document. The CVCA represents the country specific root of the PKI of Inspection Systems and creates the Document Verifier Certificates within this PKI. The updates of the public key of the CVCA are distributed in the form of Country Verifying CA Link- Certificates. • Document Verifier: The Document Verifier (DV) enforces the privacy policy of the receiving State with respect to the protection of sensitive biometric reference data to be handled by the Extended Inspection Systems. The Document Verifier manages the authorization of the Extended Inspection Systems for the sensitive data of the e- Document in the limits provided by the issuing States or Organizations in the form of the Document Verifier Certificates. • Terminal: A terminal is any technical system communicating with the TOE through the contact or contactless interfaces. • Inspection system (IS): A technical system used by the border control officer of the receiving State (i) in examining an e-Document presented by the user and verifying its authenticity and (ii) verifying the presenter as e-Document holder. The Extended Inspection System (EIS) performs the Advanced Inspection procedure (see Figure 3) and therefore (i) contains a terminal for the contact or contactless communication with the e-Document’s chip, (ii) implements the terminals part of PACE and/or BAC; (iii) gets the authorization to read the logical e-Document either under PACE or BAC by optical reading the e-Document providing this information. (iv) implements the Terminal Authentication and Chip Authentication Protocols both Version 1 according to [R8] and (v) is authorized by the issuing State or Organization through the Document Verifier of the receiving State to read the sensitive biometric reference data. Security attributes of the EIS are defined by means of the Inspection System Certificates. BAC may only be used if supported by Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 31 of 127 the TOE. If both PACE and BAC are supported by the TOE and the BIS, PACE must be used. • Attacker: Additionally, to the definition in Table 13, the definition of an attacker is refined as follows: A threat agent trying (i) to manipulate the logical e-Document without authorisation, (ii) to read sensitive biometric reference data (i.e. EF.DG3, EF.DG4), (ii) to forge a genuine e-Document, or (iv) to trace an e-Document. Application Note 13: An impostor is attacking the inspection system as TOE IT environment independent on using a genuine, counterfeit or forged e-Document. Therefore the impostor may use results of successful attacks against the TOE but the attack itself is not relevant for the TOE. Figure 3 Advanced Inspection Procedure ICAO Application Selection Basic Access Control (CONDITIONAL) Chip Authentication (CONDITIONAL) Passive Authentication with SOD Terminal Authentication PACE (MRZ/CAN/Password) (CONDITIONAL) Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 32 of 127 3.2 Assumptions The assumptions describe the security aspects of the environment in which the TOE will be used or is intended to be used. • A.Passive_Auth PKI for Passive Authentication The issuing and receiving States or Organizations establish a public key infrastructure for passive authentication i.e. digital signature creation and verification for the logical e- Document. The issuing State or Organization runs a Certification Authority (CA) which securely generates, stores and uses the Country Signing CA Key pair. The CA keeps the Country Signing CA Private Key secret and is recommended to distribute the Country Signing CA Public Key to ICAO, all receiving States maintaining its integrity. The Document Signer: i. generates the Document Signer Key Pair, ii. hands over the Document Signer Public Key to the CA for certification, iii. keeps the Document Signer Private Key secret and iv. uses securely the Document Signer Private Key for signing the Document Security Objects of the e-Documents. The CA creates the Document Signer Certificates for the Document Signer Public Keys and distributes them to the receiving States and Organizations. It is assumed that the Document Security Object contains only the hash values of the genuine user data according to [R39]. • A.Insp_Sys Inspection Systems for global interoperability The Extended Inspection System (EIS) for global interoperability (i) includes the Country Signing CA Public Key and (ii) implements the terminal part of PACE [R40] and/or BAC [R5]. BAC may only be used if supported by the TOE. If both PACE and BAC are supported by the TOE and the IS, PACE must be used. The EIS reads the logical e- Document under PACE or BAC and performs the Chip Authentication v.1 to verify the logical e-Document and establishes secure messaging. EIS supports the Terminal Authentication Protocol v.1 in order to ensure access control and is authorized by the issuing State or Organization through the Document Verifier of the receiving State to read the sensitive biometric reference data. Justification: The assumption A.Insp_Sys does not confine the security objectives of the [R7] as it repeats the requirements of P.Terminal and adds only assumptions for the Inspection Systems for handling the the EAC functionality of the TOE . • A.Auth_PKI PKI for Inspection Systems The issuing and receiving States or Organizations establish a public key infrastructure for card verifiable certificates of the Extended Access Control. The Country Verifying Certification Authorities, the Document Verifier and Extended Inspection Systems hold authentication key pairs and certificates for their public keys encoding the access control rights. The Country Verifying Certification Authorities of the issuing States or Organizations are signing the certificates of the Document Verifier and the Document Verifiers are signing the certificates of the Extended Inspection Systems of the receiving Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 33 of 127 States or Organizations. The issuing States or Organizations distribute the public keys of their Country Verifying Certification Authority to their e-Document’s chip. Justification: This assumption only concerns the EAC part of the TOE. The issuing and use of card verifiable certificates of the Extended Access Control is neither relevant for the PACE part of the TOE nor will the security objectives of the [R7] be restricted by this assumption. For the EAC functionality of the TOE the assumption is necessary because it covers the pre-requisite for performing the Terminal Authentication Protocol Version 1. 3.3 Threats This section describes the threats to be averted by the TOE independently or in collaboration with its IT environment. These threats result from the TOE method of use in the operational environment and the assets stored in or protected by the TOE. The TOE in collaboration with its IT environment shall avert the threats as specified below. • T.Skimming Skimming e-Document/Capturing Card-Terminal Communication Adverse action: An attacker imitates an inspection system in order to get access to the user data stored on or transferred between the TOE and the inspecting authority connected via the contact or contactless interfaces of the TOE. Threat agent: having high attack potential, cannot read and does not know the correct value of the shared password (PACE password) in advance. Asset: confidentiality of logical e-Document data Application Note 14: A product using BIS-BAC cannot avert this threat in the context of the security policy defined in this ST. Application Note 15: The shared PACE password may be printed or displayed on the e- Document. Please note that if this is the case, the password does not effectively represent a secret, but nevertheless it is restricted-revealable, cf. OE.e-Document_Holder. • T.Eavesdropping Eavesdropping on the communication between the TOE and the PACE terminal Adverse action: An attacker is listening to the communication between the e-Document and the PACE authenticated BIS-PACE in order to gain the user data transferred between the TOE and the terminal connected. Threat agent: having high attack potential, cannot read and does not know the correct value of the shared password (PACE password) in advance. Asset: confidentiality of logical e-Document data Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 34 of 127 Application Note 16: A product using BIS-BAC cannot avert this threat in the context of the security policy defined in this ST. • T.Tracing Tracing e-Document Adverse action: An attacker tries to gather TOE tracing data (i.e. to trace the movement of the e-Document) unambiguously identifying it directly by establishing a communication via the contact interface or remotely by establishing or listening to a communication via the contactless interface of the TOE. Threat agent: having high attack potential, cannot read and does not know the correct value of the shared password (PACE password) in advance. Asset: privacy of the e-Document holder Application Note 17: This threat completely covers and extends “T.Chip-ID” from BAC PP [R5]. Application Note 18: A product using BAC (whatever the type of the inspection system is: BIS_BAC) cannot avert this threat in the context of the security policy defined in this ST. Application Note 19: Since the Standard Inspection Procedure does not support any unique-secret-based authentication of the e-Document’s chip (no Chip Authentication), a threat like T.Counterfeit (counterfeiting e-Document)12 cannot be averted by the current TOE. • T.Forgery Forgery of data Adverse action: An attacker fraudulently alters the User Data or/and TSF-data stored on the e-Document or/and exchanged between the TOE and the terminal connected in order to outsmart the PACE authenticated BIS- PACE by means of changed e-Document holder’s related reference data (like biographic or biometric data). The attacker does it in such a way that the terminal connected perceives these modified data as authentic one. Threat agent: having high attack potential Asset: integrity of the e-Document 12 Such a threat might be formulated like: “An attacker produces an unauthorised copy or reproduction of a genuine e-Document to be used as part of a counterfeit Passport: he or she may generate a new data set or extract completely or partially the data from a genuine e-Document and copy them on another functionally appropriate chip to initiate this genuine e-Document. This violates the authenticity of the e-Document being used for authentication of a e-Document presenter as the e-Document holder. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 35 of 127 The TOE shall avert the threat as specified below. • T.Abuse-Func Abuse of Functionality Adverse action: An attacker may use functions of the TOE which shall not be used in TOE operational phase in order (i) to manipulate or to disclose the User Data stored in the TOE, (ii) to manipulate or to disclose the TSF-data stored in the TOE or (iii) to manipulate (bypass, deactivate or modify) soft-coded security functionality of the TOE. This threat addresses the misuse of the functions for the initialisation and personalization in the operational phase after delivery to the e-Document holder. Threat agent: having high attack potential, being in possession of one or more e- Documents Asset: integrity and authenticity of the e-Document, availability of the functionality of the e-Document. Application Note 20: Details of the relevant attack scenarios depend, for instance, on the capabilities of the test features provided by the IC Dedicated Test Software being not specified here. • T.Information_Leakage Information Leakage from e-Document Adverse action: An attacker may exploit information leaking from the TOE during its usage in order to disclose confidential User Data or/and TSF-data stored on the e-Document or/and exchanged between the TOE and the terminal connected. The information leakage may be inherent in the normal operation or caused by the attacker. Threat agent: having high attack potential Asset: confidentiality User Data and TSF data of the e-Document Application Note 21: Leakage may occur through emanations, variations in power consumption, I/O characteristics, clock frequency, or by changes in processing time requirements. This leakage may be interpreted as a covert channel transmission, but is more closely related to measurement of operating parameters which may be derived either from measurements of the contactless interface (emanation) or direct measurements (by contact to the chip) and can then be related to the specific operation being performed. Examples are Differential Electromagnetic Analysis (DEMA) and Differential Power Analysis (DPA). Moreover the attacker may try actively to enforce information leakage by fault injection (e.g. Differential Fault Analysis). • T.Phys_Tamper Physical Tampering Adverse action: An attacker may perform physical probing of the e-Document in order (i) to disclose the TSF-data, or (ii) to disclose/reconstruct the TOE’s Embedded Software. An attacker may physically modify the e- Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 36 of 127 Document in order to alter (I) its security functionality (hardware and software part, as well), (ii) the User Data or the TSF-data stored on the e-Document.. Threat agent: having high attack potential, being in possession of one or more legitimate e-Documents Asset: integrity and authenticity of the e-Document, availability of the functionality of the e-Document, confidentiality of User Data and TSF- data of the e-Document Application Note 22: Physical tampering may be focused directly on the disclosure or manipulation of the user data (e.g. the biometric reference data for the inspection system) or the TSF data (e.g. authentication key of the e-Document) or indirectly by preparation of the TOE to following attack methods by modification of security features (e.g. to enable information leakage through power analysis). Physical tampering requires a direct interaction with the e-Document’s internals. Techniques commonly employed in IC failure analysis and IC reverse engineering efforts may be used. Before that, hardware security mechanisms and layout characteristics need to be identified. Determination of software design including treatment of the user data and the TSF data may also be a pre-requisite. The modification may result in the deactivation of a security function. Changes of circuitry or data can be permanent or temporary. • T.Malfunction Malfunction due to Environmental Stress Adverse action: An attacker may cause a malfunction the e-Document’s hardware and Embedded Software by applying environmental stress in order to (i) deactivate or modify security features or functionality of the TOE’ hardware or to (ii) circumvent, deactivate or modify security functions of the TOE’s Embedded Software. This may be achieved e.g. by operating the e-Document outside the normal operating conditions, exploiting errors in the e-Document’s Embedded Software or misusing administrative functions. To exploit these vulnerabilities an attacker needs information about the functional operation. Threat agent: having high attack potential, being in possession of one or more legitimate e-Documents, having information about the functional operation Asset: integrity and authenticity of the e-Document, availability of the functionality of the e-Document, confidentiality of User Data and TSF- data of the e-Document Application Note 23: A malfunction of the TOE may also be caused using a direct interaction with elements on the chip surface. This is considered as being a manipulation (refer to the threat T.Phys-Tamper) assuming a detailed knowledge about TOE’s internals. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 37 of 127 • T.Read_Sensitive_Data Read the sensitive biometric reference data Adverse action: An attacker tries to gain the sensitive biometric reference data through the communication interface of the e-Document’s chip. The attack T.Read_Sensitive_Data is similar to the threats T.Skimming (cf. [R14]) in respect of the attack path (communication interface) and the motivation (to get data stored on the e-Document’s chip) but differs from those in the asset under the attack (sensitive biometric reference data vs. digital MRZ, digitized portrait and other data), the opportunity (i.e. knowing Document Basic Access Keys) and therefore the possible attack methods. Note, that the sensitive biometric reference data are stored only on the e-Document’s chip as private sensitive personal data whereas the MRZ data and the portrait are visual readable on the physical e-Document as well. Threat agent: having high attack potential, knowing the Document Basic Access Keys, being in possession of a legitimate e-Document Asset: confidentiality of sensitive logical e-Document (i.e. biometric reference) data • T.Counterfeit Counterfeit of e-Document’s chip Adverse action: An attacker with high attack potential produces an unauthorized copy or reproduction of a genuine e-Document’s chip to be used as part of a counterfeit e-Document. This violates the authenticity of the e- Document’s chip used for authentication of a presenter by possession of a e-Document. The attacker may generate a new data set or extract completely or partially the data from a genuine e-Document’s chip and copy them on another appropriate chip to imitate this genuine e- Document’s chip. Threat agent: having high attack potential, being in possession of one or more legitimate e-Documents Asset: authenticity of logical e-Document data 3.4 Organizational Security Policies The TOE and/or its environment shall comply to the following Organizational Security Policies (OSP) as security rules, procedures, practices, or guidelines imposed by an organization upon its operations. • P.Manufact Manufacturing of the e-Document’s chip The Initialization Data are written by the IC Manufacturer to identify the IC uniquely. The MRTD Manufacturer writes the Pre-personalization Data which contains at least the Personalization Agent Key Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 38 of 127 • P.Pre-Operational Pre-operational handling of the e-Document 1. The e-Document Issuer issues the e-Document and approves it using the terminals complying with all applicable laws and regulations. 2. The e-Document Issuer guarantees correctness of the user data (amongst other of those, concerning the e-Document holder) and of the TSF-data permanently stored in the TOE. 3. The e-Document Issuer uses only such TOE’s technical components (IC) which enable traceability of the e-Documents in their manufacturing and issuing life cycle phases, i.e. before they are in the operational phase, cf. section 1.5 above. 4. If the e-Document Issuer authorises a Personalization Agent to personalise the e-Document for e-Document holders, the e-Document Issuer has to ensure that the Personalization Agent acts in accordance with the e-Document Issuer’s policy. • P.Card_PKI PKI for Passive Authentication (issuing branch) Application Note 24: The description below states the responsibilities of involved parties and represents the logical, but not the physical structure of the PKI. Physical distribution ways shall be implemented by the involved parties in such a way that all certificates belonging to the PKI are securely distributed / made available to their final destination, e.g. by using directory services. 1. The e-Document Issuer shall establish a public key infrastructure for the passive authentication, i.e. for digital signature creation and verification for the e-Document. For this aim, he runs a Country Signing Certification Authority (CSCA). The e-Document Issuer shall publish the CSCA Certificate (CCSCA). 2. The CSCA shall securely generate, store and use the CSCA key pair. The CSCA shall keep the CSCA Private Key secret and issue a self-signed CSCA Certificate (CCSCA) having to be made available to the e-Document Issuer by strictly secure means, see [R40]. The CSCA shall create the Document Signer Certificates for the Document Signer Public Keys (CDS) and make them available to the e-Document Issuer, see [R41]. 3. A Document Signer shall (i) generate the Document Signer Key Pair, (ii) hand over the Document Signer Public Key to the CSCA for certification, (iii) keep the Document Signer Private Key secret and (iv) securely use the Document Signer Private Key for signing the Document Security Objects of e-Documents. • P.Trustworthy_PKI Trustworthyness of PKI The CSCA shall ensure that it issues its certificates exclusively to the rightful organizations (DS) and DSs shall ensure that they sign exclusively correct Document Security Objects to be stored on the e-Document. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 39 of 127 • P.Terminal Abilities and trustworthyness of terminals The Basic Inspection Systems with PACE (BIS-PACE) shall operate their terminals as follows: 1. The related terminals (basic inspection system, cf. above) shall be used by terminal operators and by e-Document holders as defined in [R40][R41]. 2. They shall implement the terminal parts of the PACE protocol [R40], of the Passive Authentication [R40] and use them in this order13. The PACE terminal shall use randomly and (almost) uniformly selected nonces, if required by the protocols (for generating ephemeral keys for Diffie-Hellmann). 3. The related terminals need not to use any own credentials. 4. They shall also store the Country Signing Public Key and the Document Signer Public Key (in form of CCSCA and CDS) in order to enable and to perform Passive Authentication (determination of the authenticity of data groups stored in the e-Document, [R39][R40]). 5. The related terminals and their environment shall ensure confidentiality and integrity of respective data handled by them (e.g. confidentiality of PACE passwords, integrity of PKI certificates, etc.), where it is necessary for a secure operation of the TOE according to the current PP. • P.Sensitive_Data Privacy of sensitive biometric reference data The biometric reference data of finger(s) (EF.DG3) and iris image(s) (EF.DG4) are sensitive private personal data of the e-Document holder. The sensitive biometric reference data can be used only by inspection systems which are authorized for this access at the time the e-Document is presented to the inspection system (Extended Inspection Systems). The issuing State or Organization authorizes the Document Verifiers of the receiving States to manage the authorization of inspection systems within the limits defined by the Document Verifier Certificate. The e-Document’s chip shall protect the confidentiality and integrity of the sensitive private personal data even during transmission to the Extended Inspection System after Chip Authentication Version 1. • P.Personalization Personalization of the e-Document by issuing State or Organization only The issuing State or Organization guarantees the correctness of the biographical data, the printed portrait and the digitized portrait, the biometric reference data and other data of the logical e-Document with respect to the e-Document holder. The personalization of the e-Document for the holder is performed by an agent authorized by the issuing State or Organization only. 13 This order is commensurate with [R40] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 40 of 127 4. Security Objectives This chapter describes the security objectives for the TOE and the security objectives for the TOE environment. The security objectives for the TOE environment are separated into security objectives for the development and production environment and security objectives for the operational environment. 4.1 Security Objectives for the TOE This section describes the security objectives for the TOE addressing the aspects of identified threats to be countered by the TOE and organizational security policies to be met by the TOE. • OT.Data_Integrity Integrity of Data The TOE must ensure integrity of the User Data and the TSF-data14 stored on it by protecting these data against unauthorised modification (physical manipulation and unauthorised modifying).The TOE must ensure integrity of the User Data and the TSF- data during their exchange between the TOE and the terminal connected (and represented by PACE authenticated BIS-PACE) after the PACE Authentication. • OT.Data_Authenticity Authenticity of Data The TOE must ensure authenticity of the User Data and the TSF-data15 stored on it by enabling verification of their authenticity at the terminal-side16.The TOE must ensure authenticity of the User Data and the TSF-data during their exchange between the TOE and the terminal connected (and represented by PACE authenticated BIS-PACE) after the PACE Authentication. It shall happen by enabling such a verification at the terminal- side (at receiving by the terminal) and by an active verification by the TOE itself (at receiving by the TOE)17 • OT.Data_Confidentiality Confidentiality of Data The TOE must ensure confidentiality of the User Data and the TSF-data18 by granting read access only to the PACE authenticated BIS-PACE connected. The TOE must ensure confidentiality of the User Data and the TSF-data during their exchange between the TOE and the terminal connected (and represented by PACE authenticated BIS- PACE) after the PACE Authentication. • OT.Tracing Tracing e-Document 14 Where appropriate, see Table 12 above 15 Where appropriate, see Table 12 above 16 Verification od SOD 17 Secure messaqging after PACE authentication, see also [R40] 18 Where appropriate, see Table 12 above Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 41 of 127 The TOE must prevent gathering TOE tracing data by means of unambiguous identifying the e-Document directly through establishing a communication via the contact interface or remotely through establishing or listening to a communication via contactless interface of the TOE without knowledge of the correct values of shared passwords (PACE passwords) in advance. • OT.Prot_Abuse-Func Protection against Abuse of Functionality The TOE must prevent that functions of the TOE, which may not be used in TOE operational phase, can be abused in order (i) to manipulate or to disclose the User Data stored in the TOE, (ii) to manipulate or to disclose the TSF-data stored in the TOE, (iii) to manipulate (bypass, deactivate or modify) soft-coded security functionality of the TOE. • OT.Prot_Inf_Leak Protection against Information Leakage The TOE must provide protection against disclosure of confidential User Data and/or TSF-data stored and/or processed in the e-Document • by measurement and analysis of the shape and amplitude of signals or the time between events found by measuring signals on the electromagnetic field, power consumption, clock, or I/O lines and • by forcing a malfunction of the TOE and/or • by a physical manipulation of the TOE. Application Note 25: This objective pertains to measurements with subsequent complex signal processing due to normal operation of the TOE or operations enforced by an attacker. • OT.Prot_Phys-Tamper Protection against Physical Tampering The TOE must provide protection of the confidentiality and integrity of the User Data, the TSF-data, and the e-Document’s Embedded Software by means of • measuring through galvanic contacts representing a direct physical probing on the chip’s surface except on pads being bonded (using standard tools for measuring voltage and current) or • measuring not using galvanic contacts but other types of physical interaction between charges (using tools used in solid-state physics research and IC failure analysis), • manipulation of the hardware and its security features, as well as, • controlled manipulation of memory contents (User Data, TSF-data) with a prior • reverse-engineering to understand the design and its properties and functionality. • OT.Prot_Malfunction Protection against Malfunctions The TOE must ensure its correct operation. The TOE must prevent its operation outside the normal operating conditions where reliability and secure operation have not been proven or tested. This is to prevent functional errors in the TOE. The environmental conditions may Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 42 of 127 include external energy (esp. electromagnetic) fields, voltage (on any contacts), clock frequency or temperature. The following TOE security objectives address the aspects of identified threats to be countered involving TOE’s environment. • OT.Identification Identification of the TOE The TOE must provide means to store IC Initialization Data19, TOE Initialization Data in its non-volatile memory. The IC Identification Data must provide a unique identification of the IC during the manufacturing and the card issuing life cycle phases of the e-Document. The storage of the IC Initialisation Data includes writing of the Initialization Key. • OT.AC_Pers Access Control for Personalization of logical e-Document The TOE must ensure that the logical e-Document data in EF.DG1 to EF.DG16, the Document security object according to LDS [R39] and the TSF data can be written by an authorized Personalization Agent only. The logical e-Document data in EF.DG1 to EF.DG16 and the TSF data may be written only during and cannot be changed after personalization of the document. Application Note 26: The OT.AC_Pers implies that the data of the LDS groups written during personalization for e-Document holder (at least EF.DG1 and EF.DG2) can not be changed using write access after personalization. • OT.Sens_Data_Conf Confidentiality of sensitive biometric reference data The TOE must ensure the confidentiality of the sensitive biometric reference data (EF.DG3 and EF.DG4) by granting read access only to authorized Extended Inspection Systems. The authorization of the inspection system is drawn from the Inspection System Certificate used for the successful authentication and shall be a non-strict subset of the authorization defined in the Document Verifier Certificate in the certificate chain to the Country Verifier Certification Authority of the issuing State or Organization. The TOE must ensure the confidentiality of the logical e-Document data during their transmission to the Extended Inspection System. The confidentiality of the sensitive biometric reference data shall be protected against attacks with high attack potential. • OT.Chip_Auth_Proof Proof of e-Document’s chip authenticity The TOE must support the Inspection Systems to verify the identity and authenticity of the e-Document’s chip as issued by the identified issuing State or Organization by means of the Chip Authentication Version 1 as defined in [R8]. The authenticity proof provided by e-Document’s chip shall be protected against attacks with high attack potential. Application Note 27: The OT.Chip_Auth_Proof implies the e-Document’s chip to have (i) a unique identity as given by the e-Document’s Document Number, (ii) a secret to prove its 19 Amongst other, IC identification data Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 43 of 127 identity by knowledge i.e. a private authentication key as TSF data. The TOE shall protect this TSF data to prevent their misuse. The terminal shall have the reference data to verify the authentication attempt of e-Document’s chip i.e. a certificate for the Chip Authentication Public Key that matches the Chip Authentication Private Key of the e-Document’s chip. This certificate is provided by (i) the Chip Authentication Public Key (EF.DG14) in the LDS defined in [R39] and (ii) the hash value of DG14 in the Document Security Object signed by the Document Signer. The following Security Objective for the TOE is an addition to the objectives given by the Protection Profiles to cover the Active Authentication mechanism. • OT.Active_Auth_Proof Proof of e-Document’s chip authenticity The TOE must support the Basic Inspection Systems to verify the identity and authenticity of the e-Document’s chip as issued by the identified issuing State or Organization by means of the Active Authentication as defined in [R40]. The authenticity proof provided by e-Document’s chip shall be protected against attacks with high attack potential. The TOE must support the Inspection Systems to verify the identity and authenticity of 4.2 Security Objectives for the Operational Environment IC Manufacturer Obligations e-Document Issuer as the general responsible The e-Document Issuer as the general responsible for the global security policy related will implement the following security objectives for the TOE environment: • OE.Legislative_Compliance Issuing of the e-Document The e-Document Issuer must issue the e-Document and approve it using the terminals complying with all applicable laws and regulations. e-Document Issuer and CSCA: e-Document’s PKI (issuing) branch The e-Document Issuer and the related CSCA will implement the following security objectives for the TOE environment (see also the Application Note 23 above). • OE.Passive_Auth_Sign Authentication of e-Document by Signature The e-Document Issuer has to establish the necessary public key infrastructure as follows: the CSCA acting on behalf and according to the policy of the e-Document Issuer must (i) generate a cryptographically secure CSCA Key Pair, (ii) ensure the secrecy of the CSCA Private Key and sign Document Signer Certificates in a secure operational environment, Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 44 of 127 and (iii) publish the Certificate of the CSCA Public Key (CCSCA). Hereby authenticity and integrity of these certificates are being maintained. A Document Signer acting in accordance with the CSCA policy must (i) generate a cryptographically secure Document Signing Key Pair, (ii) ensure the secrecy of the Document Signer Private Key, (iii) hand over the Document Signer Public Key to the CSCA for certification, (iv) sign Document Security Objects of genuine e-Documents in a secure operational environment only. The digital signature in the Document Security Object relates to all hash values for each data group in use according to [R39]. The Personalization Agent has to ensure that the Document Security Object contains only the hash values of genuine user data according to [R39]. The CSCA must issue its certificates exclusively to the rightful organizations (DS) and DSs must sign exclusively correct Document Security Objects to be stored on e-Document. • OE.Initialization Initialization of e-Document The issuing State or Organization must ensure that the Initialization Agent acting on behalf of the issuing State or Organization i. Create the OS configuration data and TSF data for the e-Document, ii. initialize the e-Document together with the defined physical and logical security measures to protect the confidentiality and integrity of these data. • OE.Personalization Personalization of e-Document The e-Document Issuer must ensure that the Personalization Agent acting on his behalf (i) establish the correct identity of the e-Document holder and create the biographical data for the e-Document, (ii) enrol the biometric reference data of the e-Document holder, (iii) write a subset of these data on the physical Document (optical personalization) and store them in the e-Document (electronic personalization) for the e-Document holder as defined in [R39]20, (iv) write the document details data, (v) write the initial TSF data, (vi) sign the Document Security Object defined in [R40] (in the role of a DS). Terminal operator: Terminal’s receiving branch • OE.Terminal Terminal operating The terminal operators must operate their terminals as follows: 1. The related terminals (basic inspection systems, cf. above) are used by terminal operators and by e-Document holders as defined in [R40]. 2. The related terminals implement the terminal parts of the PACE protocol [R40], of the Passive Authentication [R40] (by verification of the signature of the Document Security Object) and use them in this order21. The PACE terminal uses randomly and (almost) uniformly selected nonces, if required by the protocols (for generating ephemeral keys for Diffie-Hellmann). 20 See also [R40]. 21 This order is commensurate with [R40] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 45 of 127 3. The related terminals need not to use any own credentials. 4. The related terminals securely store the Country Signing Public Key and the Document Signer Public Key (in form of CCSCA and CDS) in order to enable and to perform Passive Authentication of the e-Document (determination of the authenticity of data groups stored in the e-Document, [R40]). 5. The related terminals and their environment must ensure confidentiality and integrity of respective data handled by them (e.g. confidentiality of the PACE passwords, integrity of PKI certificates, etc.), where it is necessary for a secure operation of the TOE according to the current ST. Application Note 28: OE.Terminal completely covers and extends “OE.Exam_MRTD”, “OE.Passive_Auth_Verif“ and “OE.Prot_Logical_MRTD” from BAC PP [R5]. e-Document holder Obligations • OE.e-Document_Holder e-Document holder Obligations The e-Document holder may reveal, if necessary, his or her verification values of the PACE password to an authorized person or device who definitely act according to respective regulations and are trustworthy. Issuing State or Organization The issuing State or Organization will implement the following security objectives of the TOE environment. • OE.Chip_Auth_Key_e-Document e-Document Authentication Key The issuing State or Organization has to establish the necessary public key infrastructure in order to (i) generate the e-Document’s Chip Authentication Key Pair, (ii) sign and store the Chip Authentication Public Key in the Chip Authentication Public Key data in EF.DG14 and (iii) support inspection systems of receiving States or Organizations to verify the authenticity of the e-Document’s chip used for genuine e-Document by certification of the Chip Authentication Public Key by means of the Document Security Object. Justification: This security objective for the operational environment is needed to counter the Threat T.Counterfeit as it specifies the pre-requisite for the Chip Authentication Protocol Version 1 which is one of the features of the TOE described only in this Security Target. • OE.Authoriz_Sens_Data Authorization for Use of Sensitive Biometric Reference Data The issuing State or Organization has to establish the necessary public key infrastructure in order to limit the access to sensitive biometric reference data of e-Document holders to authorized receiving States or Organizations. The Country Verifying Certification Authority of the issuing State or Organization generates card verifiable Document Verifier Certificates for the authorized Document Verifier only. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 46 of 127 Justification: This security objective for the operational environment is needed in order to handle the Threat T.Read_Sensitive_Data, the Organizational Security Policy P.Sensitive_Data and the Assumption A.Auth_PKI as it specifies the pre-requisite for the Terminal Authentication Protocol v.1 as it concerns the need of an PKI for this protocol and the responsibilities of its root instance. The Terminal Authentication Protocol v.1 is one of the features of the TOE described only in this Security Target. The following Security Objective for the Operational Environment is an addition to the objectives given by the Protection Profiles to cover the Active Authentication mechanism. • OE.Active_Auth_Key_e-Document e-Document Active Authentication key The issuing State or Organization has to establish the necessary public key infrastructure in order to (i) generate the e-Document’s Active Authentication Key Pair, (ii) sign and store the Active Authentication Public Key in the Active Authentication Public Key data in EF.DG15 and (iii) support inspection systems of receiving States or Organizations to verify the authenticity of the e-Document’s chip used for genuine e-Document by certification of the Active Authentication Public Key by means of the Document Security Object. Receiving State or Organization The Receiving State or Organization will implement the following security objectives of the TOE environment. • OE.Exam_e-Document Examination of the physical part of the e- Document The inspection system of the receiving State or Organization must examine the e-Document presented by the user to verify its authenticity by means of the physical security measures and to detect any manipulation of the physical part of the e-Document. The Basic Inspection System for global interoperability (i) includes the Country Signing CA Public Key and the Document Signer Public Key of each issuing State or Organization, and (ii) implements the terminal part of PACE [4] and/or the Basic Access Control [6]. Extended Inspection Systems perform additionally to these points the Chip Authentication as Chip Authentication Protocol Version 1 to verify the Authenticity of the presented e-Document’s chip. Justification: This security objective for the operational environment is needed in order to handle the Threat T.Counterfeit and the Assumption A.Insp_Sys by demanding the Inspection System to perform the Chip Authentication as Chip Authentication protocol v.1. OE.Exam_e-Document also repeats partly the requirements from above OE.Terminal and therefore also counters T.Forgery and A.Passive_Auth. This is done because this ST introduces the Extended Inspection System, which is needed to handle the features of a e- Document with Extended Access Control. • OE.Prot_Logical_e-Document Protection of data from the logical e- Document The inspection system of the receiving State or Organization ensures the confidentiality and integrity of the data read from the logical e-Document. The inspection system will prevent Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 47 of 127 eavesdropping to their communication with the TOE before secure messaging is successfully established based on the Chip Authentication Protocol Version 1. Justification: This security objective for the operational environment is needed in order to handle the Assumption A.Insp_Sys by requiring the Inspection System to perform secure messaging based on the Chip Authentication Protocol v.1. • OE.Ext_Insp_Systems Authorization of Extended Inspection Systems The Document Verifier of receiving States or Organizations authorizes Extended Inspection Systems by creation of Inspection System Certificates for access to sensitive biometric reference data of the logical e-Document. The Extended Inspection System authenticates themselves to the e-Document’s chip for access to the sensitive biometric reference data with its private Terminal Authentication Key and its Inspection System Certificate. Justification: This security objective for the operational environment is needed in order to handle the Threat T.Read_Sensitive_Data, the Organizational Security Policy P.Sensitive_Data and the Assumption A.Auth_PKI as it specifies the pre-requisite for the Terminal Authentication Protocol v.1 as it concerns the responsibilities of the Document Verifier instance and the Inspection Systems. 4.3 Security Objective Rationale Table 14 provides an overview for security objectives coverage. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 48 of 127 Table 14 Security Objective Rationale OT.Sens_Data_Conf OT.Chip_Aut_Proof OT.Active_Auth_Proof OT.AC_Pers OT.Data_Integrity OT.Data_Authenticity OT.Data_Confidentiality OT.Tracing OT.Prot_Abuse-Func OT.Prot_Inf_Leak OT.Identification OT.Prot_Phys-Tamper OT.Prot_Malfunction OE.Chip_Auth_Key_e-Document OE.Active_Auth_Key_e-Document OE.Authoriz_Sens_Data OE.Exam_e-Document OE.Prot_Logical_e-Document OE.Ext_Insp_Systems OE.Initialization OE.Personalization OE-Passive_Auth_Sign OE.Terminal OE.e-Document_Holder OE.Legislative_Compliance T.Read_Sensitive_Data X X X T.Counterfeit X X X X X T.Skimming X X X X T.Eavesdropping X T.Tracing X X T.Abuse-Func X T.Information_Leakage X T.Phys-Tamper X T.Malfunction X T.Forgery X X X X X X X X X X P.Sensitive_Data X X X P.Personalization X X X P.Manufact X X X P.Pre-Operational X X X X X P.Terminal X X P.Card_PKI X P.Trustworthy_PKI X A.Insp_Sys X X A.Auth_PKI X X A.Passive_Auth X X A detailed justification required for suitability of the security objectives to coup with the security problem definition is given below. The threat T.Skimming addresses accessing the User Data (stored on the TOE or transferred between the TOE and the terminal) using the TOE’s contact or contactless interfaces. This threat is countered by the security objectives OT.Data_Integrity, OT.Data_Authenticity and OT.Data_Confidentiality through the PACE authentication. The objective OE.e-Document_Holder ensures that a PACE session can only be established Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 49 of 127 either by the e-Document holder itself or by an authorised person or device, and, hence, cannot be captured by an attacker. The threat T.Eavesdropping addresses listening to the communication between the TOE and a rightful terminal in order to gain the User Data transferred there. This threat is countered by the security objective OT.Data_Confidentiality through a trusted channel based on the PACE authentication. The threat T.Tracing addresses gathering TOE tracing data identifying it directly by establishing a communication via the contact interface or remotely by establishing or listening to a communication via the contactless interface of the TOE, whereby the attacker does not a priori know the correct values of the PACE password. This threat is directly countered by security objectives OT.Tracing (no gathering TOE tracing data) and OE. e- Document-Holder (the attacker does not a priori know the correct values of the shared passwords). The threat T.Forgery addresses the fraudulent, complete or partial alteration of the User Data or/and TSF-data stored on the TOE or/and exchanged between the TOE and the terminal. The security objective OT.AC_Pers requires the TOE to limit the write access for the e-Document to the trustworthy Personalization Agent (cf. OE.Personalization). The TOE will protect the integrity and authenticity of the stored and exchanged User Data or/and TSF-data as aimed by the security objectives OT.Data_Integrity and OT.Data_Authenticity, respectively. The objectives OT.Prot_Phys-Tamper and OT.Prot_Abuse-Func contribute to protecting integrity of the User Data or/and TSF-data stored on the TOE. A terminal operator operating his terminals according to OE.Terminal and performing the Passive Authentication using the Document Security Object as aimed by OE.Passive_Auth_Sign will be able to effectively verify integrity and authenticity of the data received from the TOE. Additionally, the examination of the presented e-Document book or card according to OE.Exam_e-Document “Examination of the physical part of the e-Document” shall ensure its authenticity by means of the physical security measures and detect any manipulation of the physical part of the e-Document. The threat T.Abuse-Func addresses attacks of misusing TOE’s functionality to manipulate or to disclosure the stored User- or TSF-data as well as to disable or to bypass the soft- coded security functionality. The security objective OT.Prot_Abuse-Func ensures that the usage of functions having not to be used in the operational phase is effectively prevented. The threats T.Information_Leakage, T.Phys-Tamper and T.Malfunction are typical for integrated circuits like smart cards under direct attack with high attack potential. The protection of the TOE against these threats is obviously addressed by the directly related security objectives OT.Prot_Inf_Leak, OT.Prot_Phys-Tamper and OT.Prot_Malfunction, respectively. The OSP P.Manufact “Manufacturing of the e-Document’s chip” requires a unique identification of the IC by means of the TOE Identification Data and the writing of the Initialization Dataand the Personalization data as being fulfilled by OT.Identification. OT.AC_Pers, OE.Initialization together enforce the OSP’s properties ‘correctness of the User- and the TSF-data stored’ and ‘authorisation of e-Document Manufacturers. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 50 of 127 The OSP P.Pre-Operational is enforced by the following security objectives:OT.Identification is affine to the OSP’s property ‘traceability before the operational phase’; OT.AC_Pers, OE.Initialization and OE.Personalization together enforce the OSP’s properties ‘correctness of the User- and the TSF-data stored’ and ‘authorisation of Personalization Agent’; OE.Legislative_Compliance is affine to the OSP’s property ‘compliance with laws and regulations’. The OSP P.Terminal is obviously enforced by the objective OE.Terminal, whereby the one- to-one mapping between the related properties is applicable. Additionally, this OSP is countered by the security objective OE.Exam_e-Document, that enforces the terminals to perform the terminal part of the PACE protocol. The OSP P.Card_PKI is enforced by establishing the issuing PKI branch as aimed by the objectives OE.Passive_Auth_Sign (for the Document Security Object). The OSP P.Trustworthy_PKI is enforced by OE.Passive_Auth_Sign (for CSCA, issuing PKI branch). The Assumption A.Passive_Auth “PKI for Passive Authentication” is directly addressed by OE.Passive_Auth_Sign requiring the e-Document issuer to establish a PKI for Passive Authentication, generating Document Signing private keys only for rightful organizations and requiring the Document Signer to sign exclusively correct Document Security Objects to be stored on e-Document. The OSP P.Personalization “Personalization of the e-Document by issuing State or Organization only” addresses the (i) the enrolment of the logical e-Document by the Personalization Agent as described in the security objective for the TOE environment OE.Personalization “Personalization of logical e-Document”, and (ii) the access control for the user data and TSF data as described by the security objective OT.AC_Pers “Access Control for Personalization of logical e-Document”. Note • the IC Manufacturer equips the TOE with the Initialization Key according to OT.Identification “Identification and Authentication of the TOE”. • • The security objective OT.AC_Pers limits the management of TSF data and the management of TSF to the Personalization Agent. The OSP P.Sensitive_Data “Privacy of sensitive biometric reference data” is fulfilled and the threat T.Read_Sensitive_Data “Read the sensitive biometric reference data” is countered by the TOE-objective OT.Sens_Data_Conf “Confidentiality of sensitive biometric reference data” requiring that read access to EF.DG3 and EF.DG4 (containing the sensitive biometric reference data) is only granted to authorized inspection systems. Furthermore it is required that the transmission of these data ensures the data’s confidentiality. The authorization bases on Document Verifier certificates issued by the issuing State or Organization as required by OE.Authoriz_Sens_Data “Authorization for use of sensitive biometric reference data”. The Document Verifier of the receiving State has to authorize Extended Inspection Systems by creating appropriate Inspection System certificates for access to the sensitive biometric reference data as demanded by OE.Ext_Insp_Systems “Authorization of Extended Inspection Systems”. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 51 of 127 The OSP P.Terminal “Abilities and trustworthiness of terminals” is countered by the security objective OE.Exam_e-Document additionally to the security objectives from PACE PP [7]. OE.Exam_e-Document enforces the terminals to perform the terminal part of the PACE protocol. The threat T.Counterfeit “Counterfeit of e-Document chip data” addresses the attack of unauthorized copy or reproduction of the genuine e-Document's chip. This attack is thwarted by chip an identification and authenticity proof required by OT.Chip_Auth_Proof “Proof of e-Document’s chip authentication” using an authentication key pair to be generated by the issuing State or Organization. The Public Chip Authentication Key has to be written into EF.DG14 and signed by means of Documents Security Objects as demanded by OE.Chip_Auth_Key_e-Document “e-Document Authentication Key”. According to OE.Exam_e-Document “Examination of the physical part of the e-Document” the General Inspection system has to perform the Chip Authentication as Chip Authentication Protocol Version 1 to verify the authenticity of the e-Document’s chip. In addition, the threat T.Counterfeit “Counterfeit of e-Document chip data” is countered by chip an identification and authenticity proof required by OT.Active_Auth_Proof “Proof of e- Document’s chip authentication” using an authentication key pair to be generated by the issuing State or Organization. The Public Active Authentication Key has to be written into EF.DG15 and signed by means of Documents Security Objects as demanded by OE.Active_Auth_Key_e-Document “e-Document Authentication Key”. The examination of the e-Document addressed by the assumption A.Insp_Sys “Inspection Systems for global interoperability” is covered by the security objective for the TOE environment OE.Exam_e-Document “Examination of the physical part of the e-Document” which requires the inspection system to examine physically the e-Document, the Basic Inspection System to implement the Basic Access Control, and the Extended Inspection Systems to implement and to perform the Chip Authentication Protocol Version 1 to verify the Authenticity of the presented e-Document’s chip. The security objective for the TOE environment OE.Prot_Logical_e-Document “Protection of data from the logical e- Document” requires the Inspection System to protect the logical e-Document data during the transmission and the internal handling. The assumption A.Passive_Auth “PKI for Passive Authentication” is directly covered by the security objective for the TOE environment OE.Passive_Auth_Sign “Authentication of e- Document by Signature” from PACE PP [R7] covering the necessary procedures for the Country Signing CA Key Pair and the Document Signer Key Pairs. The implementation of the signature verification procedures is covered by OE.Exam_e-Document “Examination of the physical part of the e-Document”. The assumption A.Auth_PKI “PKI for Inspection Systems” is covered by the security objective for the TOE environment OE.Authoriz_Sens_Data “Authorization for use of sensitive biometric reference data”, which requires the CVCA to limit the read access to sensitive biometrics by issuing Document Verifier certificates for authorized receiving States or Organisations only. The Document Verifier of the receiving State is required by OE.Ext_Insp_Systems “Authorization of Extended Inspection Systems” to authorize Extended Inspection Systems by creating Inspection System Certificates. Therefore, the receiving issuing State or Organisation has to establish the necessary public key infrastructure. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 52 of 127 5. Extended Components Definition This ST uses components defined as extensions to CC part 2 [R11]. These components are drawn from PACE PP [R7] and from EAC PP [R6]. 5.1 Definition of the family FAU_SAS To describe the security functional requirements of the TOE, the family FAU_SAS of the class FAU (Security audit) is defined here. This family describes the functional requirements for the storage of audit data. It has a more general approach than FAU_GEN, because it does not necessarily require the data to be generated by the TOE itself and because it does not give specific details of the content of the audit records. The family ‘Audit data storage (FAU_SAS)’ is specified as follows: Table 15 Family FAU_SAS FAU_SAS Audit data storage Family behaviour: This family defines functional requirements for the storage of audit data. Component leveling: FAU_SAS.1 Requires the TOE to provide the possibility to store audit data. Management There are no management activities foreseen. Audit There are no actions defined to be auditable. FAU_SAS.1 Audit storage Hierarchical to: No other components Dependencies: No Dependencies. FAU_SAS.1.1 The TSF shall provide [assignment: authorized users] with the capability to store [assignment: list of audit information] in the audit records. 5.2 Definition of the family FCS_RND To describe the IT security functional requirements of the TOE, the family FCS_RND of the class FCS (Cryptographic support) is defined here. This family describes the functional requirements for random number generation used for cryptographic purposes. The component FCS_RND.1 is not limited to generation of cryptographic keys unlike the component FCS_CKM.1. The similar component FIA_SOS.2 is intended for non- cryptographic use. The family ‘Generation of random numbers (FCS_RND)’ is specified as follows: FAU_SAS Audit data storage 1 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 53 of 127 Table 16 Family FCS_RND FCS_RND Generation of random numbers Family behaviour: This family defines quality requirements for the generation of random numbers which are intended to be used for cryptographic purposes. Component leveling: FCS_RND.1 Generation of random numbers requires that random numbers meet a defined quality metric. Management: There are no management activities foreseen. Audit: There are no actions defined to be auditable. FCS_RND.1 Quality metric for random numbers Hierarchical to: No other components Dependencies: No Dependencies. FCS_RND.1.1 The TSF shall provide a mechanism to generate random numbers that meet [assignment: a defined quality metric]. 5.3 Definition of the family FIA_API To describe the security requirements of the TOE a sensitive family (FIA_API) of the Class FIA (Identification and authentication) is defined in the PP [R6]. This family describes the functional requirements for the proof of a the claimed identity for the authentication verification by an external entity where the other families of the class FIA address the verification of the identity of an external entity. Application Note 29: The other families of the Class FIA describe only the authentication verification of users’ identity performed by the TOE and do not describe the functionality of the user to prove their identity. The following paragraph defines the family FIA_API in the style of the CC part 2 (cf. [R12] “Explicitly stated IT security requirements (APE_SRE)”) from a TOE point of view. FCS_RND Generation of random numbers 1 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 54 of 127 Table 17 Family FIA_API FIA_API Authentication Proof of Identity Family behaviour: This family defines functions provided by the TOE to prove their identity and to be verified by an external entity in the TOE IT environment. Component leveling: FIA_API.1 Authentication Proof of Identity. Management: The following actions could be considered for the management functions in FMT: Management of authentication information used to prove the claimed identity. Audit: There are no actions defined to be auditable. FIA_API.1 Authentication Proof of Identity Hierarchical to: No other components Dependencies: No Dependencies. FIA_API.1.1 The TSF shall provide a [assignment: authentication mechanism] to prove the identity of the [assignment: authorized user or rule]. 5.4 Definition of the family FMT_LIM The family FMT_LIM describes the functional requirements for the test features of the TOE. The new functional requirements were defined in the class FMT because this class addresses the management of functions of the TSF. The examples of the technical mechanism used in the TOE show that no other class is appropriate to address the specific issues of preventing abuse of functions by limiting the capabilities of the functions and by limiting their availability. The family “Limited capabilities and availability (FMT_LIM)” is specified as follows. FIA_API Authentication Proof of Identitiy 1 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 55 of 127 Table 18 Family FMT_LIM FMT_LIM Limited capabilities and availability Family behaviour: This family defines requirements that limit the capabilities and availability of functions in a combined manner. Note that FDP_ACF restricts the access to functions whereas the Limited capability of this family requires the functions themselves to be designed in a specific manner. Component leveling: FMT_LIM.1 Limited capabilities requires that the TSF is built to provide only the capabilities (perform action, gather information) necessary for its genuine purpose. Management: There are no management activities foreseen. Audit: There are no actions defined to be auditable. FMT_LIM.2 Limited availability requires that the TSF restrict the use of functions (refer to Limited capabilities (FMT_LIM.1)). This can be achieved, for instance, by removing or by disabling functions in a specific phase of the TOE’s life-cycle. Management: There are no management activities foreseen. Audit: There are no actions defined to be auditable. FMT_LIM.1 Limited capabilities Hierarchical to: No other components Dependencies: FMT_LIM.2 Limited availability. FMT_LIM.1.1 The TSF shall be designed in a manner that limits their capabilities so that in conjunction with “Limited availability (FMT_LIM.2)” the following policy is enforced [assignment: Limited capability and availability policy]. FMT_LIM.2 Limited availability Hierarchical to: No other components Dependencies: FMT_LIM.1 Limited capabilities. FMT_LIM.2.1 The TSF shall be designed in a manner that limits their availability so that in conjunction with “Limited capabilities (FMT_LIM.1)” the following policy is enforced [assignment: Limited capability and availability policy]. Application Note 30: the functional requirements FMT_LIM.1 and FMT_LIM.2 assume that there are two types of mechanisms (limited capabilities and limited availability) which together shall provide protection in order to enforce the policy. This also allows that • the TSF is provided without restrictions in the product in its user environment but its capabilities are so limited that the policy is enforced FMT_LIM Limited capabilities and availability 1 2 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 56 of 127 or conversely • the TSF is designed with test and support functionality that is removed from, or disabled in, the product prior to the Operational Use Phase. The combination of both requirements shall enforce the related policy. 5.5 Definition of the family FPT_EMS The family FPT_EMS (TOE Emanation) of the class FPT (Protection of the TSF) is defined here to describe the IT security functional requirements of the TOE. The TOE shall prevent attacks against secret data stored in and used by the TOE where the attack is based on external observable physical phenomena of the TOE. Examples of such attacks are evaluation of TOE’s electromagnetic radiation, simple power analysis (SPA), differential power analysis (DPA), timing attacks, etc. This family describes the functional requirements for the limitation of intelligible emanations being not directly addressed by any other component of CC part 2 [R6]. The family ‘TOE Emanation (FPT_EMS)’ is specified as follows: Table 19 Family FPT_EMS FPT_EMS Family behaviour: This family defines requirements to mitigate intelligible emanations. Component leveling: FPT_EMS.1 TOE emanation has two constituents: • FPT_EMS.1.1 Limit of Emissions requires to not emit intelligible emissions enabling access to TSF data or user data. • FPT_EMS.1.2 Interface Emanation requires to not emit interface emanation enabling access to TSF data or user data. Management: There are no management activities foreseen. Audit: There are no actions defined to be auditable. FPT_EMS.1 TOE Emanation Hierarchical to: No other components Dependencies: No dependencies. FPT_EMS.1.1 The TOE shall not emit [assignment: types of emissions] in excess of [assignment: specified limits] enabling access to [assignment: list of types of TSF data] and [assignment: list of types of user data]. FPT_EMS.1.2 The TSF shall ensure [assignment: type of users] are unable to use the following interface [assignment: type of connection] to gain access to [assignment: list of types of TSF data] and [assignment: list of types of user data]. FPT_EMS TOE emanation 1 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 57 of 127 6. Security Requirements Table 20 Definition of security attributes Security attribute Values Meaning Terminal authentication status None (any Terminal) Default role (i.e. without authorisation after start-up) CVCA Roles defined in the certificate used for authentication (cf. [R8]); Terminal is authenticated as Country Verifying Certification Authority after successful CA v.1 and TA v.1 DV (domestic) Roles defined in the certificate used for authentication (cf. [R8]); Terminal is authenticated as domestic Document Verifier after successful CA v.1 and TA v.1 DV (foreign) Roles defined in the certificate used for authentication (cf. [R8]); Terminal is authenticated as foreign Document Verifier after successful CA v.1 and TA v.1 IS Roles defined in the certificate used for authentication (cf. [R8]); Terminal is authenticated as Extended Inspection System after successful CA v.1 and TA v.1 Terminal Authorization none DG4 (Iris) Read access to DG4: (cf. [R8]) DG3 (Fingerprint) Read access to DG3: (cf. [R8]) DG3(Fingerprint)/DG4 (Iris) Read access to DG3 and DG4: (cf. [R8]) The following table provides an overview of the keys and certificates used. Table 21 Keys and certificates Name Data Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 58 of 127 Country Signing Certification Authority Key Pair and Certificate Country Signing Certification Authority of the e-Document Issuer signs the Document Signer Public Key Certificate (CDS) with the Country Signing Certification Authority Private Key (SKCSCA) and the signature will be verified by receiving terminal with the Country Signing Certification Authority Public Key (PKCSCA) The CSCA also issues the self-signed CSCA Certificate (CCSCA) to be distributed by strictly secure diplomatic means, see. [R41]. Document Signer Key Pairs and Certificates The Document Signer Certificate CDS is issued by the Country Signing Certification Authority. It contains the Document Signer Public Key (PKDS) as authentication reference data. The Document Signer acting under the policy of the CSCA signs the Document Security Object (SOD) of the e-Document with the Document Signer Private Key (SKDS) and the signature will be verified by a terminal as the Passive Authentication with the Document Signer Public Key (PKDS). PACE Session Keys (PACE-KMAC, PACE-KENC) Secure messaging AES keys for message authentication (CMAC-mode) and for message encryption (CBC-mode) or 3DES Keys for message authentication and message encryption (both CBC) agreed between the TOE and a terminal as result of the PACE Protocol, see [R40]. PACE authentication ephemeral key pair (ephem-SKPICC-PACE, ephem-PKPICC-PACE) The ephemeral PACE Authentication Key Pair (ephem- SKPICC-PACE, ephem-PKPICC-PACE) is used fot Key Agreement Protocol: Diffie-Hellman (DH) according to PKCS#3 or Elliptic Curve Diffie-Hellman (ECDH; ECKA key agreement algorithm) according to TR-03110 [R8], cf [R40]. Ephem-PKPICC-PACE PKCS#3 or Elliptic Curve Diffie-Hellman (ECDH; ECKA key agreement algorithm) according to TR-03111 [R9], cf. [R40]. TOE intrinsic secret cryptographic keys Permanently or temporarily stored secret cryptographic material used by the TOE in order to enforce its security functionality. Country Verifying Certification Authority Private Key (SKCVCA) The Country Verifying Certification Authority (CVCA) holds a private key (SKCVCA) used for signing the Document Verifier Certificates. Country Verifying Certification Authority Public Key (PKCVCA) The TOE stores the Country Verifiying Certification Authority Public Key (PKCVCA) as part of the TSF data to verify the Document Verifier Certificates. The PKCVCA has the security attribute Current Date as the most recent valid effective date of the Country Verifiying Certification Authority Certificate or of a domestic Document Verifier Certificate. Country Verifying Certification Authority Certificate (CCVCA) The Country Verifying Certification Authority Certificate may be a self-signed certificate or a link certificate (cf. [R8] and Glossary). It contains (i) the Country Verifying Certification Authority Public Key (PKCVCA) as Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 59 of 127 authentication reference data, (ii) the coded access control rights of the Country Verifying Certification Authority, (iii) the Certificate Effective Date and the Certificate Expiration Date as security attributes. Document Verifier Certificate (CDV) The Document Verifier Certificate CDV is issued by the Country Verifying Certification Authority. It contains (i) the Document Verifier Public Key (PKDV) as authentication reference data (ii) identification as domestic or foreign Document Verifier, the coded access control rights of the Document Verifier, the Certificate Effective Date and the Certificate Expiration Date as security attributes. Inspection System Certificate (CIS) The Inspection System Certificate (CIS) ssued by the Document Verifier. It contains (i) as authentication reference data the Inspection System Public Key (PKIS) () the coded access control rights of the Extended Inspection System, the Certificate Effective Date and the Certificate Expiration Date as security attributes. Chip Authentication Public Key Pair The Chip Authentication Public Key Pair (SKICC, PKICC) are used for Key Agreement Protocol: Diffie-Hellman (DH) according to RFC 2631 or Elliptic Curve Diffie-Hellman according to ISO 11770-3 [11]. Chip Authentication Public Key (PKICC) The Chip Authentication Public Key (PKICC) is stored in the EF.DG14 Chip Authentication Public Key of the TOE’s logical e-Document and used by the inspection system for Chip Authentication Version 1 of the e-Document’s chip. It is part of the user data provided by the TOE for the IT environment. Chip Authentication Private Key (SKICC) The Chip Authentication Private Key (SKICC) is used by the TOE to authenticate itselfas authentic e-Document’s chip. It is part of the TSF data. Country Signing Certification Authority Key Pair Country Signing Certification Authority of the issuing State or Organization signs the Document Signer Public Key Certificate with the Country Signing Certification Authority Private Key and the signature will be verified by receiving State or Organization (e.g. an Extended Inspection System) with the Country Signing Certification Authority Public Key. Document Signer Key Pairs Document Signer of the issuing State or Organization signs the Document Security Object of the logical e-Document with the Document Signer Private Key and the signature will be verified by an Extended Inspection System of the receiving State or Organization with the Document Signer Public Key. Chip Authentication Session Keys Secure Messaging encryption key and MAC computation key agreed between the TOE and an Inspection System in result of the Chip Authentication Protocol Version 1. Active Authentication Key Pair The Active Authentication Key Pair (SKAA, PKAA) is used for the Active Authentication mechanism in accordance with [R40]. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 60 of 127 Active Authentication Public Key (PKAA) The Active Authentication Public Key (PKAA) is stored in the EF.DG15. These keys are used by Inspection Systems to confirm the genuinity of the e-Document’s chip. Active Authentication Private Key (SKAA) The Active Authentication Private Key (SKAA) is used by the TOE to authenticate itself as genuine e-Document’s chip. Application Note 31: The Country Verifying Certification Authority identifies a Document Verifier as “domestic” in the Document Verifier Certificate if it belongs to the same State as the Country Verifying Certification Authority. The Country Verifying Certification Authority identifies a Document Verifier as “foreign” in the Document Verifier Certificate if it does not belong to the same State as the Country Verifying Certification Authority. From e- Document’s point of view the domestic Document Verifier belongs to the issuing State or Organization. 6.1 Security Functional Requirements for the TOE This section on security functional requirements for the TOE is divided into sub-section following the main security functionality. 6.1.1 Class FAU Security Audit 6.1.1.1 FAU_SAS.1 Audit storage The TOE shall meet the requirement “Audit storage (FAU_SAS.1)” as specified below (CC part 2 extended). FAU_SAS.1 Audit storage Hierarchical to: No other components. Dependencies: No dependencies. FAU_SAS.1.1 The TSF shall provide the Manufacturer22 with the capability to store the Initialization Data23 in the audit records. Application Note 32: The Manufacturer role is the default user identity assumed by the TOE in the life cycle Phase 2 Manufacturing. The IC manufacturer, the Initialization Agent in the Manufacturer role write the Initialization Data as TSF-Data into the TOE. The audit records are write-only-once data of the e-Document’s chip (see FMT_MTD.1/INI_ENA, FMT_MTD.1/INI_DIS). 22 [assignment: authorised users] 23 [assignment: list of audit information] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 61 of 127 6.1.2 Class Cryptographic Support (FCS) 6.1.2.1 FCS_CKM.1 Cryptographic key generation The TOE shall meet the requirement “Cryptographic key generation (FCS_CKM.1)” as specified below (CC part 2). The iterations are caused by different cryptographic key generation algorithms to be implemented and key to be generated by the TOE. FCS_CKM.1/DH_PACE Cryptographic key generation - Diffie-Hellman for PACE session keys Hierarchical to: No other components. Dependencies: [FCS_CKM.2 Cryptographic key distribution or FCS_COP.1 Cryptographic operation]: not fulfilled but justified. Justification: A Diffie-Hellman key agreement is used in order to have no key distribution, therefore FCS_CKM.2 makes no sense in this case. FCS_CKM.4 Cryptographic key destruction: fulfilled by FCS_CKM.4 FCS_CKM.1.1/ DH_PACE The TSF shall generate cryptographic keys in accordance with a specified cryptographic key generation algorithm : 1. Diffie-Hellman Protocol compliant to PKCS#3 [R31]24 and specified cryptographic key sizes: 1024 or 204825, and 2. ECDH compliant to [R9]26 and specified cryptographic key sizes: 160 bit – 521 bit27, that meet the following: [R40]28. Application Note 33: The TOE generates a shared secret value K with the terminal during the PACE protocol, see [R40]. This protocol may be based on the Diffie-Hellman-Protocol compliant to PKCS#3 (i.e. modulo arithmetic based cryptographic algorithm, cf. [R31]) or on the ECDH compliant to TR-03111 [R9] (i.e. the elliptic curve cryptographic algorithm ECKA, cf. [R40] and [R9] for details). The shared secret value K is used for deriving the AES or DES session keys for message encryption and message authentication (PACE-KMAC, PACE-KENC) according to [R40] for the TSF required by FCS_COP.1/PACE_ENC and FCS_COP.1/PACE_MAC. 24 [selection: based on the key Diffie-Hellman key derivation Protocol compliant to PKCS#3, ECDH compliant to BSI TR-03111] 25 [assignment: cryptographic key sizes] 26 [selection: based on the key Diffie-Hellman key derivation Protocol compliant to PKCS#3, ECDH compliant to BSI TR-03111 ] 27 [assignment: cryptographic key sizes] 28 [assignment: list of standards] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 62 of 127 Application Note 34: FCS_CKM.1/DH_PACE implicitly contains the requirements for the hashing functions used for key derivation by demanding compliance to [R40]. FCS_CKM.1/CA Cryptographic key generation - Diffie-Hellman for Chip Authentication protocol v.1 session keys Hierarchical to: No other components. Dependencies: [FCS_CKM.2 Cryptographic key distribution or FCS_COP.1 Cryptographic operation]: fulfilled by FCS_COP.1/CA_ENC and FCS_COP.1/CA_MAC FCS_CKM.4 Cryptographic key destruction FCS_CKM.1.1/CA The TSF shall generate cryptographic keys in accordance with a specified cryptographic key generation algorithm : based on the 1. Diffie-Hellman Protocol compliant to PKCS#3 [R31]29 and specified cryptographic key sizes: 1024 to 204830, and 2. ECDH compliant to [R9]31 and specified cryptographic key sizes: 160 bit – 521 bit32, that meet the following: [R8] part 3, Annex A.133. Application Note 35: FCS_CKM.1/CA implicitly contains the requirements for the hashing functions used for key derivation by demanding compliance to [R8]. Application Note 36: The TOE generates a shared secret value with the terminal during the Chip Authentication protocol Version 1, see [R8]. This protocol may be based on the Diffie-Hellman-Protocol compliant to PKCS#3 (i.e. modulo arithmetic based cryptographic algorithm, cf. [R31]) or on the ECDH compliant to TR-03111 [R9] (i.e. the elliptic curve cryptographic algorithm - cf. [R9] for details). The shared secret value is used to derive the Chip Authentication session keys used for encryption and MAC computation for secure messaging (defined in Key Derivation Function [R8]). Application Note 37: The TOE shall implement the hash function SHA-1 for the cryptographic primitive to derive the keys for secure messaging from any shared secrets of the Authentication Mechanisms. The Chip Authentication Protocol v.1 may use SHA-1 (cf. [R8]). The TOE implements additional hash functions SHA-224 and SHA-256 for the Terminal Authentication Protocol v.1 (cf. [R8] for details). 29 [assignment: cryptographic key generation algorithm] 30 [assignment: cryptographic key sizes] 31 [assignment: cryptographic key generation algorithm] 32 [assignment: cryptographic key sizes] 33 [assignment: list of standards] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 63 of 127 6.1.2.2 FCS_CKM.4 Cryptographic key destruction – Session keys The TOE shall meet the requirement “Cryptographic key destruction (FCS_CKM.4)” as specified below (CC part 2). FCS_CKM.4 Cryptographic key destruction – Session keys Hierarchical to: No other components. Dependencies: [FDP_ITC.1 Import of user data without security attributes, or FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation]: fulfilled by FCS_CKM.1/DH_PACE and FCS_CKM.1/CA FCS_CKM.4.1 The TSF shall destroy cryptographic keys in accordance with a specified cryptographic key destruction method: physical deletion by overwriting the memory data with zeros34 that meets the following: none35. Application Note 38: The TOE shall destroy any session keys in accordance with FCS_CKM.4 after (i) detection of an error in a received command by verification of the MAC and (ii) after successful run of the Chip Authentication Protocol v.1. (iii) The TOE shall destroy the PACE Session Keys after generation of a Chip Authentication Session Keys and changing the secure messaging to the Chip Authentication Session Keys. (iv) The TOE shall clear the memory area of any session keys before starting the communication with the terminal in a new after- reset-session as required by FDP_RIP.1. Concerning the Chip Authentication keys FCS_CKM.4 is also fulfilled by FCS_CKM.1/CA. 6.1.2.3 FCS_COP.1 Cryptographic operation The TOE shall meet the requirement “Cryptographic operation (FCS_COP.1)” as specified below (CC part 2). The iterations are caused by different cryptographic algorithms to be implemented by the TOE. FCS_COP.1/AA_SIGN Cryptographic operation – Signature for Active Autentication Hierarchical to: No other components. Dependencies: [FDP_ITC.1 Import of user data without security attributes, or FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation] FCS_CKM.4 Cryptographic key destruction 34 [assignment: cryptographic key destruction method] 35 [assignment: list of standards] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 64 of 127 FCS_COP.1.1/ AA_SIGN The TSF shall perform digital signature for Active Authentication data in accordance with a specific cryptographic algorithm RSA with SHA-25636 and cryptographic key sizes 1280 and 2048 bits37that meet the following: the Digital Signature Standards (complying with ISO/IEC 9796-2:2002 Digital Signature scheme 1 [R17]) used for Active Authentication defined by ICAO Doc 9303-11 [R40] 38. Application Note 39: This SFR has been added by the ST author to specify the cryptographic algorithm and key sizes used by the TOE to perform an Active Authentication in accordance with ICAO Doc 9303-11 [R40]. Application Note 40: For RSA cryptography the TOE makes use of the cryptographic library embedded in the chip P6022J VB. FCS_COP.1/PACE_ENC Cryptographic operation – Encryption/Decryption AES/3DES for PACE protocol Hierarchical to: No other components. Dependencies: [FDP_ITC.1 Import of user data without security attributes, or FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation]: fulfilled by FCS_CKM.1/DH_PACE FCS_CKM .4 Cryptographic key destruction: fulfilled by FCS_CKM.4 FCS_COP.1.1/ PACE_ENC The TSF shall perform secure messaging – encryption and decryption39 in accordance with a specified cryptographic algorithm AES and 3DES in CBC mode40 and cryptographic key sizes 112 (for 3DES), and 128, 192 and 256 bit (for AES)41 that meet the following: TR-03110 [R8]42. Application Note 41: This SFR requires the TOE to implement the cryptographic primitive AES and 3DES for secure messaging with encryption of the transmitted data and encryption of the nonce in the first step of PACE. The related session keys are agreed between the TOE and the terminal as part of the PACE protocol according to FCS_CKM.1/DH_PACE (PACE-KENC) 36 [assignment: cryptographic key generation algorithm] 37 [assignment: cryptographic key sizes] 38 [assignment: list of standards] 39 [assignment: list of cryptographic operations] 40 [selection: AES, 3DES] 41 [selection: 112,128,192,256] 42 [assignment: list of standards] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 65 of 127 FCS_COP.1/PACE_MAC Cryptographic operation – MAC for PACE protocol Hierarchical to: No other components. Dependencies: [FDP_ITC.1 Import of user data without security attributes, or FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation] : fulfilled by FCS_CKM.1/DH_PACE FCS_CKM.4 Cryptographic key destruction : fulfilled by FCS_CKM.4 FCS_COP.1.1/ PACE_MAC The TSF shall perform secure messaging – message authentication code43 in accordance with a specified cryptographic algorithm CMAC and Retail MAC44 and cryptographic key sizes 112, 128, 192 and 256 bit45 that meet the following: TR-03110 [R8]46. Application Note 42: This SFR requires the TOE to implement the cryptographic primitive for secure messaging with message authentication code over transmitted data. The related session keys are agreed between the TOE and the terminal as part of either the PACE protocol according to the FCS_CKM.1/DH_PACE (PACE-KMAC). Note that in accordance with [4] the (two-key) Triple-DES could be used in Retail mode for secure messaging. FCS_COP.1/CA_ENC Cryptographic operation – Symmetric Encryption/Decryption for CA protocol Hierarchical to: No other components. Dependencies: [FDP_ITC.1 Import of user data without security attributes, or FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation] FCS_CKM.4 Cryptographic key destruction FCS_COP.1.1/ CA_ENC The TSF shall perform secure messaging – encryption and decryption47 in accordance with a specified cryptographic algorithm AES and 3DES48 and cryptographic key sizes 112 (for 3DES) and 128, 192 and 256 bit (for AES)49 that meet the following: TR-03110, Annex E [R8]50. 43 [assignment: list of cryptographic operations] 44 [selection: CMAC, Retail-MAC] 45 [selection: 112, 128, 192, 256] 46 [assignment: list of standards] 47 [assignment: list of cryptographic operations] 48 [assignment: cryptographic algorithm] 49 [assignment: cryptographic key sizes] 50 [assignment: list of standards] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 66 of 127 Application Note 43: This SFR requires the TOE to implement the cryptographic primitives (i.e. 3DES and AES) for secure messaging with encryption of the transmitted data. The keys are agreed between the TOE and the terminal as part of the Chip Authentication Protocol Version 1 according to the FCS_CKM.1/CA FCS_COP.1/CA_MAC Cryptographic operation – MAC for CA protocol Hierarchical to: No other components. Dependencies: [FDP_ITC.1 Import of user data without security attributes, or FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation] FCS_CKM.4 Cryptographic key destruction FCS_COP.1.1/ CA_MAC The TSF shall perform secure messaging – message authentication code51 in accordance with a specified cryptographic algorithm CMAC and Retail MAC52 and cryptographic key sizes 112, 128, 192 and 256 bit53 that meet the following: TR-03110 [R8]54. Application Note 44: This SFR requires the TOE to implement the cryptographic primitive for secure messaging with encryption and message authentication code over the transmitted data. The key is agreed between the TSF by Chip Authentication Protocol Version 1 according to the FCS_CKM.1/CA. Furthermore the SFR is used for authentication attempts of a terminal as Initialization Agent, or Personalization Agent by means of the authentication mechanism. FCS_COP.1/SIG_VER Cryptographic operation – Signature verification by e- Document Hierarchical to: No other components. Dependencies: [FDP_ITC.1 Import of user data without security attributes, or FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation] FCS_CKM.4 Cryptographic key destruction FCS_COP.1.1/SIG_VER The TSF shall perform digital signature verification55 in accordance with a specified cryptographic algorithm 51 [assignment: list of cryptographic operations] 52 [assignment: CMAC, Retail-MAC] 53 [assignment: 112, 128, 192, 256] 54 [assignment: list of standards] 55 [assignment: list of cryptographic operations] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 67 of 127 ECDSA with SHA-1, SHA-224 or SHA-256 as specified in Table 2256 and cryptographic key sizes: 192, 224 or 256 bit57 that meet the following: FIPS 186- 2 [R25] Table 22 ECDSA algorithms for signature verification in Terminal Authentication Object Identifier Signature Hash id-TA-ECDSA-SHA-1 ECDSA SHA-1 id-TA-ECDSA-SHA-224 ECDSA SHA-224 id-TA-ECDSA-SHA-256 ECDSA SHA-256 id-TA-ECDSA-SHA-384 ECDSA SHA-384 id-TA-ECDSA-SHA-512 ECDSA SHA-512 Application Note 45: The signature verification is used to verify the card verifiable certificates and the authentication attempt of the terminal creating a digital signature for the TOE challenge. Application Note 46: For RSA and ECDSA cryptography the TOE makes use of the NXP cryptographic library. 6.1.2.4 FCS_RND.1 Quality metrics for random numbers The TOE shall meet the requirement “Quality metric for random numbers (FCS_RND.1)” as specified below (CC part 2 extended). FCS_RND.1 Quality metric for random numbers Hierarchical to: No other components. Dependencies: No dependencies. FCS_RND.1.1 The TSF shall provide a mechanism to generate random numbers that meet BSI AIS-31 functionality class PTG.2 with strength of mechanism: high [R3] 58. Application Note 47: This SFR requires the TOE to generate random numbers (random nonce) used for the authentication protocols as required by FIA_UAU.4. 56 [assignment: cryptographic algorithm] 57 [assignment: cryptographic key sizes] 58 [assignment: a defined quality metric] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 68 of 127 Application Note 48: The composite TOE makes use of the true random number generator (TRNG) of the IC P6022J VB. The TRNG has already been evaluated as conformant to class PTG.2 of AIS-31 guidelines [R3] with strength of mechanism:high. 6.1.3 Class FIA Identification and Authentication For the sake of better readability, Table 23 provides an overview of the authentication mechanisms used. Table 23 Overview on authentication SFRs Mechanism SFR for the TOE Comments Authentication Mechanism for Initialization Agent FIA_AFL.1/PACE FIA_UAU.4 AES (256-bit keys) Authentication Mechanism for and Personalization Agent FIA_UAU.4 FIA_AFL.1/PACE 3DES (112 bit keys) Retail MAC (112 bit keys) Chip Authentication Protocol v.1 FIA_API.1/CA FIA_UAU.5, FIA_UAU.6 3DES (112 bit keys) AES (128, 192 and 256 bit keys) Retail MAC (112 bit keys) DH ECDH Terminal Authentication Protocol v.1 FIA_UAU.5 RSASSA-PKCS1-v1_5 ECDSA PACE protocol59 FIA_UAU.1/PACE FIA_UAU.5/PACE FIA_AFL.1/PACE DH and ECDH with Integrated Mapping, Generic Mapping and Chip Authentication Mapping. Passive Authentication FIA_UAU.5/PACE Verification of SHA-1, SHA-292 or SHA-256 hashes Active Authentication FIA_API.1/AA RSA with SHA-256 Note the Chip Authentication Protocol Version 1 as defined in this security target includes • the asymmetric key agreement to establish symmetric secure messaging between the TOE and the terminal based on the Chip Authentication Public Key and the Terminal Public Key used later in the Terminal Authentication Protocol Version 1, • the check whether the TOE is able to generate the correct message authentication code with the expected key for any message received by the terminal. The Chip Authentication may be performed as Chip Authentication protocol v.1. Both may be used independent of the Terminal Authentication Protocol v.1. If the Terminal Authentication Protocol v.1 is used, tha terminal shall use the same public keys presented during the Chip Authentication Protocol v.1. 59 Only listed for information purposes Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 69 of 127 6.1.3.1 FIA_AFL.1/PACE Authentication failure handling – PACE authentication using non-blocking authorization data Hierarchical to: No other components. Dependencies: FIA_UAU.1 Timing of authentication FIA_AFL.1.1/PACE The TSF shall detect when a defined number (see column 1 of Table 24) of consecutive60 unsuccessful authentication attempts occur related to the authentication events specified in column 2 of Table 2461. FIA_AFL.1.2/PACE When the defined number of consecutive unsuccessful authentication attempts has been met62, the TSF shall perform the action specified in column 3 of Table 24 in correspondence of the detected event63. Refinement: refer to Table 24. Table 24 FIA_AFL.1/PACE Refinement Column 1 Assignment: Integer Number Column 2 Assignment: Authentication Events Column 3 Assignment: Actions From 1 to 15 Unsuccessful authentication attempt with Initialization key Authentication mechanism blocked (thus blocking initialization). From 1 to 15 Unsuccessful authentication attempt with Personalization keys Personalization keys blocked From 1 to 255 Unsuccessful authentication attempt using the PACE password as shared password. NONE 1 Unsuccessful MAC verification Session closed Application Note 49: The count of consecutive unsuccessful authentications is stored in non-volatile memory and is preserved across power-up and power-down cycles. After a successful authentication the count is reset to zero. 6.1.3.2 FIA_UID.1 Timing of identification The TOE shall meet the requirement “Timing of identification (FIA_UID.1)” as specified below (CC part 2). 60 [assignement: positive integer number] 61 [assignment: list of authentication events] 62 [selection: met, surpassed] 63 [assignment: list of actions] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 70 of 127 FIA_UID.1/PACE Timing of identification Hierarchical to: No other components. Dependencies: No dependencies. FIA_UID.1.1/PACE The TSF shall allow 1. to establish the communication channel, 2. carrying out the PACE Protocol according to [R40], 3. to read the Initialization Data if it is not disabled by TSF according to FMT_MTD.1/INI_DIS 4. to carry out the Chip Authentication Protocol v.1 according to [R8] 5. to carry out the Terminal Authentication Protocol v.1 according to [R8]64 6. to carry out the Active Authentication Mechanism65 on behalf of the user to be performed before the user is identified. FIA_UID.1.2/PACE The TSF shall require each user to be successfully identified before allowing any other TSF-mediated actions on behalf of that user. Application Note 50: The SFR FIA_UID.1/PACE in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in the PACE PP [R7] by EAC aspect 4. This extension does not conflict with the strict conformance to PACE PP. Application Note 51: After personalization in the Phase 3 the PACE domain parameters, the Chip Authentication data and Terminal Authentication Reference Data are written into the TOE. The Inspection System is identified as default user after power up or reset of the TOE i.e. the TOE will run the PACE protocol, to gain access to the Chip Authentication Reference Data and to run the Chip Authentication Protocol Version 1. After successful authentication of the chip the terminal may identify itself as (i) Extended Inspection System by selection of the templates for the Terminal Authentication Protocol Version 1 or (ii) if necessary and available by authentication as Personalization Agent (using the Personalization key). Application Note 52: In the Step 3 the Initialization Agent is the only user role known to the TOE which writes the Initialization Data in the audit records of the IC. The user in role “Initialization Agent” identify himself by means of the authentication mechanism described in [R33]. The users in role “Personalization Agent” identify himselves by means of selecting the authentication key. After personalization in Phase 3 the PACE domain parameters, the Chip Authentication data and Terminal Authentication Reference Data are written into the TOE. The Inspection System is identified as default user after power up or reset of the TOE i.e. the TOE will run the PACE protocol, to gain access to the Chip Authentication Reference 64 Only listed for information purposes 65 [assignment: list of TSF-mediated actions] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 71 of 127 Data and to run the Chip Authentication Protocol Version 1. After successful authentication of the chip the terminal may identify itself as (i) Extended Inspection System by selection of the templates for the Terminal Authentication Protocol Version 1 or (ii) if necessary and available by authentication as Personalization Agent (using the Personalization key). Application Note 53: User identified after a successfully performed PACE protocol is a terminal. Please note that neither CAN nor MRZ effectively represent secrets, but are restricted revealable; i.e. it is either the e-Document holder itself or an authorised other person or device (Basic Inspection System with PACE). Application Note 54: In the life-cycle phase ‘Manufacturing’ the Manufacturer is the only user role known to the TOE. The Manufacturer writes the Initialisation Data in the audit records of the IC. Please note that the Initialization Agent, or the Personalization Agent act on behalf of the e- Document Issuer under his and CSCA and DS policies. Hence, they define authentication procedure(s) for Initialization Agent and for Personalization Agent. The TOE must functionally support these authentication procedures being subject to evaluation within the assurance components ALC_DEL.1 and AGD_PRE.1. The TOE assumes the user roles “Initialization Agent” or “Personalization Agent”, when a terminal proves the respective Terminal Authorisation Level as defined by the related policy (policies). 6.1.3.3 FIA_UAU.1 Timing of authentication The TOE shall meet the requirement “Timing of authentication (FIA_UAU.1)” as specified below (Common Criteria part 2). FIA_UAU.1/PACE Timing of authentication Hierarchical to: No other components. Dependencies: FIA_UID.1 Timing of identification. FIA_UAU.1.1/PACE The TSF shall allow 1. to establish the communication channel, 2. carrying out the PACE Protocol according to [R40], 3. to read the Initialization Data if it is not disabled by TSF according to FMT_MTD.1/INI_DIS, 4. to identify themselves by selection of the authentication key, 5. to carry out the Chip Authentication Protocol Version 1 according to [R8], 6. to carry out the Terminal Authentication Protocol Version 1 according to [R8]66, 7. to carry out the Active Authentication mechanism67 on behalf of the user to be performed before the user is authenticated. 66 [assignment: list of TSF-mediated actions] 67 [assignment: list of TSF-mediated actions] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 72 of 127 FIA_UAU.1.2/PACE The TSF shall require each user to be successfully authenticated before allowing any other TSF-mediated actions on behalf of that user. Application Note 55: The SFR FIA_UAU.1/PACE in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in the PACE PP [R7] by EAC aspect 5. This extension does not conflict with the strict conformance to PACE PP. Application Note 56: The user authenticated after a successfully performed PACE protocol is a terminal. Please note that neither CAN nor MRZ effectively represent secrets, but are restricted revealable; i.e. it is either the e-Document holder itself or an authorised other person or device (BIS-PACE). If PACE was successfully performed, secure messaging is started using the derived session keys (PACE-KMAC, PACE-KENC), cf. FTP_ITC.1/PACE. 6.1.3.4 FIA_UAU.4 Single-use authentication mechanisms The TOE shall meet the requirements of “Single-use authentication mechanisms (FIA_UAU.4)” as specified below (CC part 2). FIA_UAU.4/PACE Single-use authentication mechanisms - Single-use authentication of the Terminal by the TOE Hierarchical to: No other components. Dependencies: No dependencies. FIA_UAU.4.1 The TSF shall prevent reuse of authentication data related to 1. PACE Protocol according to [R40], 2. Authentication Mechanisms based on AES and 3DES68, 3. Terminal Authentication Protocol v.1 according to [R8]69. Application Note 57: The SFR FIA_UAU.4.1 in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in PACE PP [R7] by the EAC aspect 3. This extension does not conflict with the strict conformance to PACE PP. The generation of random numbers (random nonce) used for the authentication protocol (PACE) and Terminal Authentication as required by FIA_UAU.4/PACE is required by FCS_RND.1 from [R7]. 68 [selecion: Triple-DES, AES or other approved algorithms] 69 [assignment: identified authentication mechanism(s)] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 73 of 127 Application Note 58: The authentication mechanisms use a challenge freshly and randomly generated by the TOE to prevent reuse of a response generated by a terminal in a successful authentication attempt. In addition, the authentication of Personalization Agent makes use of a diversifier, thus ensuring protection against replay attacks, such as the use of an internal counter as a diversifier. Note that reply attacks have no effect in Initialization, as they can only repropose the same configuration data. 6.1.3.5 FIA_UAU.5 Multiple authentication mechanisms The TOE shall meet the requirement “Multiple authentication mechanisms (FIA_UAU.5)” as specified below (CC part 2). FIA_UAU.5/PACE Multiple authentication mechanisms Hierarchical to: No other components. Dependencies: No dependencies. FIA_UAU.5.1/PACE The TSF shall provide 1. PACE Protocol according to [R40], 2. Passive Authentication according to [R40], 3. Secure messaging in MAC-ENC mode according to [R40], 4. Symmetric Authentication Mechanisms based on 3DES and AES70 5. Terminal Authentication Protocol v.1 according to [R8]71 to support user authentication. FIA_UAU.5.2/PACE The TSF shall authenticate any user’s claimed identity according to the following rules: 1. Having successfully run the PACE protocol the TOE accepts only received commands with correct message authentication code sent by means of secure messaging with the key agreed with the terminal by means of the PACE protocol, 2. The TOE accepts the authentication attempt as Initialization Agent by the Symmetric Authentication Mechanism based on AES with Initialization keys72. 3. The TOE accepts the authentication attempt as Personalization Agent by the Symmetric Authentication Mechanism based on 3DES with Personalization keys73. 4. After run of the Chip Authentication Protocol Version 1 the TOE accepts only received commands with correct message authentication code sent by means of secure messaging with 70 [selection: Triple-DES, AES or other approved algorithms] 71 [assignment: list of multiple authentication mechanism(s)] 72 [selection: the Authentication Mechanism with Personalization keys] 73 [selection: the Authentication Mechanism with Personalization keys] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 74 of 127 key agreed with the terminal by means of the Chip Authentication Mechanism v.1 5. The TOE accepts the authentication attempt by means of the Terminal Authentication Protocol v.1 only if the terminal uses the public key presented during the Chip Authentication Protocol v.1 and the secure messaging established by the Chip Authentication Mechanism v.174 Application Note 59: Please note that Passive Authentication does not authenticate any TOE’s user, but provides evidence enabling an external entity (the terminal connected) to prove the origin of e-Document application. Application Note 60: The Symmetric Authentication Mechanism for the Initialization Agent is based on AES and usues a diversification algorithm as described in [R33]. Application Note 61: The PACE protocol may use both 3DES and AES to encipher the random generated in Step 1 of the protocol. Application Note 62: The Embedded Software uses the symmetric co-processor provided by the platform to perform 3DES and AES. Application Note 63: The SFR FIA_UAU.5.1/PACE in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in PACE PP [R7] by EAC aspects 4), 5), and 6). The SFR FIA_UAU.5.2/PACE in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in PACE PP [R7] by EAC aspects 2), 3), 4) and 5). These extensions do not conflict with the strict conformance to PACE PP. 6.1.3.6 FIA_UAU.6 Re-authenticating – Re-authenticating of Terminal by the TOE The TOE shall meet the requirement “Re-authenticating (FIA_UAU.6)” as specified below (CC part 2). FIA_UAU.6/PACE Re-authenticating of Terminal by the TOE Hierarchical to: No other components. Dependencies: No dependencies. 74 [assignment: rules describing how the multiple authentication mechanisms provide authentication] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 75 of 127 FIA_UAU.6.1/PACE The TSF shall re-authenticate the user under the conditions each command sent to the TOE after successful run of the PACE Protocol shall be verified as being sent by the PACE terminal75. Application Note 64: The PACE protocol specified in [R40] starts secure messaging used for all commands exchanged after successful PACE authentication. The TOE checks each command by secure messaging in encrypt-then-authenticate mode based on CMAC or Retail-MAC, whether it was sent by the successfully authenticated terminal (see FCS_COP.1/PACE_MAC for further details). The TOE does not execute any command with incorrect message authentication code. Therefore, the TOE re-authenticates the terminal connected, if a secure messaging error occurred, and accepts only those commands received from the initially authenticated terminal. FIA_UAU.6/EAC Re-authenticating – Re-authenticating of Terminal by the TOE Hierarchical to: No other components. Dependencies: No dependencies. FIA_UAU.6.1/EAC The TSF shall re-authenticate the user under the conditions each command sent to the TOE after successful run of the Chip Authentication Protocol Version 1 shall be verified as being sent by the Inspection System76. Application Note 65: The Password Authenticated Connection Establishment and the Chip Authentication Protocol specified in [R40] include secure messaging for all commands exchanged after successful authentication of the Inspection System. The TOE checks by secure messaging in MAC_ENC mode each command based on a corresponding MAC algorithm whether it was sent by the successfully authenticated terminal (see FCS_COP.1/CA_MAC for further details). The TOE does not execute any command with incorrect message authentication code. Therefore the TOE re-authenticates the user for each received command and accepts only those commands received from the previously authenticated user. 6.1.3.7 FIA_API.1 Authentication Proof of Identity The TOE shall meet the requirement “Authentication Proof of Identity (FIA_API.1)” as specified below (CC part 2 extended). FIA_API.1/CA Authentication Proof of Identity by Chip Authentication 75 [assignment: list of conditions under which re-authentication is required] 76 [assignment: list of conditions under which re-authentication is required] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 76 of 127 Hierarchical to: No other components. Dependencies: No dependencies. FIA_API.1.1/CA The TSF shall provide a Chip Authentication Protocol Version 1 according to [R40]77 to prove the identity of the TOE78. Refinement: The TOE shall provide a Chip Authentication as Chip Authentication Protocol Version 1 according to [R8]. Application Note 66: This SFR requires the TOE to implement the Chip Authentication as Chip Authentication Mechanism Version 1 specified in [R8]. In the case of Chip Authentication Version 1, the TOE and the terminal generate a shared secret using the Diffie-Hellman Protocol (DH or EC-DH) and two session keys for secure messaging in ENC_MAC mode according to [R40]. the terminal verifies by means of secure messaging whether the e-Document’s chip was able or not to run his protocol properly using its Chip Authentication Private Key corresponding to the Chip Authentication key (EF.DG14). FIA_API.1/AA Authentication Proof of Identity by Active Authentication Hierarchical to: No other components. Dependencies: No dependencies. FIA_API.1.1/AA • The TSF shall provide a Active Authentication Protocol according to [R40]79 to prove the identity of the TOE80. 6.1.4 Class FDP User Data Protection 6.1.4.1 FDP_ACC.1 Subset access control The TOE shall meet the requirement “Subset access control (FDP_ACC.1)” as specified below (Common Criteria part 2). FDP_ACC.1/TRM Subset access control Hierarchical to: No other components. Dependencies: FDP_ACF.1 Security attribute based access control 77 [assignment: authentication mechanism] 78 [assignment: authorized user or rule] 79 [assignment: authentication mechanism] 80 [assignment: authorized user or rule] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 77 of 127 FDP_ACC.1.1/TRM The TSF shall enforce the Access Control SFP81 on terminals gaining access to the User Data and data stored in EF.SOD of the logical e-Document82. Application Note 67: The SFR FIA_ACC.1.1 in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in PACE PP [R7] by data stored in EF.SOD of the logical e-Document. This extension does not conflict with the strict conformance to PACE PP. 6.1.4.2 FDP_ACF.1 Security attribute based access control The TOE shall meet the requirement “Security attribute based access control (FDP_ACF.1)” as specified below (CC part 2). FDP_ACF.1/TRM Security attribute based access control – Terminal Access Hierarchical to: No other components. Dependencies: FDP_ACC.1 Subset access control: fulfilled by FDP_ACC.1/TRM FMT_MSA.3 Static attribute initialization: not fulfilled, but justified Justification: The access control TSF according to FDP_ACF.1/TRM uses security attributes having been defined during the personalization and fixed over the whole life time of the TOE. No management of these security attributes (i.e. SFR FMT_MSA.1 and FMT_MSA.3) is necessary here. FDP_ACF.1.1 /TRM The TSF shall enforce the Access Control SFP83 to objects based on the following: 1. Subjects: a. Terminal, b. BIS-PACE, c. Extended Inspection System 2. Objects: a. data in EF.DG1, EF.DG2 and EF.DG5 to EF.DG16, EF.SOD and EF.COMof the logical e-Document, b. data in EF.DG3 of the logical e-Document c. data in EF.DG4 of the logical e-Document d. all TOE intrinsic secret cryptographic keys stored in the e-Document84, 81 [assignment: access control SFP] 82 [assignment: list of subjects, objects, and operations among subjects and objects covered by the SFP] 83 [assignment: access control SFP] 84 [e.g. Chip Authentication Version 1 and ephemeral keys] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 78 of 127 3. Security attributes: a. PACE Authentication b. Terminal Authentication v.1, c. Authorisation of the Terminal85. - FDP_ACF.1.2/TRM The TSF shall enforce the following rules to determine if an operation among controlled subjects and controlled objects is allowed: A BIS-PACE is allowed to read data objects from FDP_ACF.1.1/TRM according to [R40] after a successful PACE authentication as required by FIA_UAU.1/PACE86. FDP_ACF.1.3/TRM The TSF shall explicitly authorize access of subjects to objects based on the following additional rules: none87. FDP_ACF.1.4 /TRM The TSF shall explicitly deny access of subjects to objects based on the following rules: 1. Any terminal being not authenticated as PACE authenticated BIS-PACE is not allowed to read, to write, to modify, to use any User Data stored on the e- Document 2. Terminals not using secure messaging are not allowed to read, to write, to modify, to use any data stored on the e- Document 3. Any terminal being not successfully authenticated as Extended Inspection System with the Read access to DG3 (Fingerprint) granted by the relative certificate holder authorization encoding is not allowed to read the data objects 2b) of FDP_ACF.1.1/TRM. 4. Any terminal being not successfully authenticated as Extended Inspection System with the Read access to DG4 (Iris) granted by the relative certificate holder authorization encoding is not allowed to read the data objects 2c) of FDP_ACF.1.1/TRM 5. Nobody is allowed to read the data objects 2d) of FDP_ACF.1.1/TRM 6. Terminals authenticated as CVCA or as DV are not allowed to read data in the EF.DG3 and EF.DG488 Application Note 68: The read access to user data in the personalization phase is protected by a Restricted Application Secret Code. 85 [assignment: list of subjects and objects controlled under the indicated SFP, and, for each, the SFP-relevant security attributes, or named groups of SFP-relevant security attributes] 86 [assignment: rules governing access among controlled subjects and controlled objects using controlled operations or controlled objects] 87 [assignment: rules, based on security attributes, that explicitly authorise access of subjects to objects] 88 [assignment: rules, based on security attributes, that explicitly authorise access of subjects to objects] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 79 of 127 Application Note 69: The SFR FDP_ACF.1.1/TRM in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in PACE PP [R7] by additional subjects and objects. The SFRs FDP_ACF.1.2/TRM and FDP_ACF.1.3/TRM in this ST cover the definition in PACE PP [R7]. The SFR FDP_ACF.1.4/TRM in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in PACE PP [R7] by 3) to 6).These extensions do not conflict with the strict conformance to PACE PP. Application Note 70: The relative certificate holder authorization encoded in the CVC of the inspection system is defined in [R8]. The TOE verifies the certificate chain established by the Country Verifying Certification Authority, the Document Verifier Certificate and the Inspection System Certificate (cf. FMT_MTD.3). The Terminal Authorization is the intersection of the Certificate Holder Authorization in the certificates of the Country Verifying Certification Authority, the Document Verifier Certificate and the Inspection System Certificate in a valid certificate chain. Application Note 71: Please note that the Document Security Object (SOD) stored in EF.SOD (see [R39]) does not belong to the user data, but to the TSF data. The Document Security Object can be read out by Inspection Systems using PACE, see [R40]. Application Note 72: Please note that the control on the user data transmitted between the TOE and the PACE terminal is addressed by FTP_ITC.1/PACE. 6.1.4.3 FDP_RIP.1 Subset residual information protection The TOE shall meet the requirement “Subset residual information protection” (FDP_RIP.1) as specified below (CC part 2). FDP_RIP.1 Subset residual information protection Hierarchical to: No other components. Dependencies: No dependencies FDP_RIP.1.1 The TSF shall ensure that any previous information content of a resource is made unavailable upon the deallocation of the resource from89 the following objects. 1. Session Keys (immediately after closing related communication session), 2. the ephemeral private key ephem-SKPICC-PACE (by having generated a DH shared secret K90)91 3. NONE 89 [selection: allocation of the resource to, deallocation of the resource from] 90 According to [R40] 91 [assignment: list of objects] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 80 of 127 6.1.4.4 FDP_UCT.1 Basic data exchange confidentiality The TOE shall meet the requirement “Basic data exchange confidentiality (FDP_UCT.1)” as specified below (CC part 2). FDP_UCT.1/TRM Basic data exchange confidentiality - MRTD Hierarchical to: No other components. Dependencies: [FTP_ITC.1 Inter-TSF trusted channel, or FTP_TRP.1 Trusted path]: fulfilled by FPT_ITC.1/PACE [FDP_ACC.1 Subset access control, or FDP_IFC.1 Subset information flow control]: fulfilled by FDP_ACC.1/TRM FDP_UCT.1.1/TRM The TSF shall enforce the Access Control SFP92 to be able to transmit and receive93 user data in a manner protected from unauthorized disclosure. 6.1.4.5 FDP_UIT.1 Basic data exchange integrity The TOE shall meet the requirement “Basic data exchange integrity (FDP_UIT.1)” as specified below (CC part 2). FDP_UIT.1/TRM Data exchange integrity Hierarchical to: No other components. Dependencies: [FDP_ACC.1 Subset access control, or FDP_IFC.1 Subset information flow control]: fulfilled by FDP_ACC.1/TRM [FTP_ITC.1 Inter-TSF trusted channel, or FTP_TRP.1 Trusted path]: fulfilled by FTP_ITC.1/PACE FDP_UIT.1.1/TRM The TSF shall enforce the Access Control SFP94 to be able to transmit and receive95 user data in a manner protected from modification, deletion, insertion and replay96 errors FDP_UIT.1.2/TRM The TSF shall be able to determine on receipt of user data, whether modification, deletion, insertion and replay97 has occurred. 92 [assignment: access control SFP(s) and/or information flow control SFP(s)] 93 [selection: transmit, receive] 94 [assignment: access control SFP(s) and/or information flow control SFP(s)] 95 [selection: transmit, receive] 96 [selection: modification, deletion, insertion, replay] 97 [selection: modification, deletion, insertion, replay] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 81 of 127 Application Note 73: FDP_UCT.1/TRM and FDP_UIT.1/TRM require the protection of the User Data transmitted from the TOE to the terminal by secure messaging with encryption and message authentication codes after successful Chip Authentication Version 1 to the Inspection System. The Password Authenticated Connection Establishment, and the Chip Authentication Protocol v.1 establish different key sets to be used for secure messaging (each set of keys for the encryption and the message authentication key). 6.1.5 Class FTP Trusted Path/Channels 6.1.5.1 FTP_ITC.1/PACE Inter-TSF trusted channel after PACE FTP_ITC.1/PACE Inter-TSF trusted channel after PACE or Chip Authentication Hierarchical to: No other components. Dependencies: No dependencies FTP_ITC.1.1/PACE The TSF shall provide a communication channel between itself and another trusted IT product that is logically distinct from other communication channels and provides assured identification of its end points and protection of the channel data from modification or disclosure. FTP_ITC.1.2/PACE The TSF shall permit another trusted IT product to initiate communication via the trusted channel. FTP_ITC.1.3/PACE The TSF shall enforce communication via the trusted channel for any data exchange between the TOE and the Terminal98. Application Note 74: The trusted IT product is the terminal. In FTP_ITC.1.3/PACE, the word “initiate” is changed to ‘enforce”, as the TOE is a passive device that can not initiate the communication. All the communication are initiated by the Terminal, and the TOE enforce the trusted channel. Application Note 75: The trusted channel is established after successful performing the Chip Authentication protocol or the PACE protocol (FIA_UAU.1/PACE). If the PACE was successfully performed, secure messaging is immediately started using the derived session keys (PACE-KMAC, PACE-KENC); If the Chip Authentication protocol was successfully performed, secure messaging is immediately restarted using the derived session keys. This secure messaging enforces preventing tracing while Passive Authentication and the required properties of operational trusted channel; the cryptographic primitives being used for the secure messaging are as required by FCS_COP.1/PACE_ENC and FCS_COP.1/PACE_MAC. The establishing phase of the trusted channel does not enable tracing due to the requirements FIA_AFL.1/PACE. Note that Terminal Authentication also requires secure messaging with the session keys established after Chip Authentication (as Chip Authentication Protocol Version 1). 98 [assignment: list of functions for which a trusted channel is required] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 82 of 127 Application Note 76: Please note that the control on the user data stored in the TOE is addressed by FDP_ACF.1/TRM. 6.1.6 Class FMT Security Management The SFR FMT_SMF.1 and FMT_SMR.1 provide basic requirements to the management of the TSF data. 6.1.6.1 FMT_SMF.1 Specification of Management Functions The TOE shall meet the requirement “Specification of Management Functions (FMT_SMF.1)” as specified below (Common Criteria part 2). FMT_SMF.1 Specification of Management Functions Hierarchical to: No other components. Dependencies: No Dependencies FMT_SMF.1.1 The TSF shall be capable of performing the following security management functions: 1. Initialization, 2. Personalization, 3. Configuration99. Application Note 77: The ability to initialize, personalize and configure the TOE is restricted to a successfully authenticated Initialization Agent or Personalization Agent by means of symmetric keys. Initialization key may be used with uninitialized products only. The e-Document locks out after a programmable number of consecutive unsuccessful authentication attempts. The Personalization keys are disabled once personalization is complete. 6.1.6.2 FMT_SMR.1 Security roles The TOE shall meet the requirement “Security roles (FMT_SMR.1)” as specified below (CC part 2). FMT_SMR.1/PACE Security roles Hierarchical to: No other components. 99 [assignment: list of security management functions to be provided by the TSF] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 83 of 127 Dependencies: FIA_UID.1 Timing of identification. FMT_SMR.1.1 The TSF shall maintain the roles: 1. Manufacturer, 2. Personalization Agent, 3. Terminal, 4. PACE authenticated BIS-PACE, 5. Country Verifying Certification Authority, 6. Document Verifier, 7. Basic Inspection System 8. Domestic Extended Inspection System, 9. Foreign Extended Inspection System100. FMT_SMR.1.2 The TSF shall be able to associate users with roles. Application Note 78: The SFR FMT_SMR.1.1/PACE in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in PACE PP [R7] by 5) to 8). This extension does not conflict with the strict conformance to PACE PP. Application Note 79: For explanation on the role Manufacturer and Personalization Agent please refer to the glossary. The role Terminal is the default role for any terminal being recognised by the TOE as not PACE authenticated BIS-PACE (‘Terminal’ is used by the e- Document presenter). The TOE recognises the e-Document holder or an authorised other person or device (BIS- PACE) by using PACE authenticated BIS-PACE (FIA_UAU.1/PACE). Application Note 80: SFR FMT_LIM.1 and FMT_LIM.2 address the management of the TSF and TSF data to prevent misuse of test features of the TOE over the life cycle phases. 6.1.6.3 FMT_LIM.1 Limited capabilities The TOE shall meet the requirement “Limited capabilities (FMT_LIM.1)” as specified below (CC part 2 extended). FMT_LIM.1 Limited capabilities Hierarchical to: No other components. Dependencies: FMT_LIM.2 Limited availability. 100 [assignment: the authorised identified roles] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 84 of 127 FMT_LIM.1.1 The TSF shall be designed in a manner that limits their capabilities so that in conjunction with “Limited availability (FMT_LIM.2)” the following policy is enforced: Deploying Test Features after TOE Delivery does not allow: 1. User Data to be manipulated and disclosed , 2. TSF data to be disclosed or manipulated, 3. software to be reconstructed, 4. substantial information about construction of TSF to be gathered which may enable other attacks and 5. sensitive User Data (EF.DG3 and EF.DG4) to be disclosed101. 6.1.6.4 FMT_LIM.2 Limited availability The TOE shall meet the requirement “Limited availability (FMT_LIM.2)” as specified below (CC part 2 extended). FMT_LIM.2 Limited availability Hierarchical to: No other components. Dependencies: FMT_LIM.1 Limited capabilities. FMT_LIM.2.1 The TSF shall be designed in a manner that limits their availability so that in conjunction with “Limited capabilities (FMT_LIM.1)” the following policy is enforced: Deploying Test Features after TOE Delivery does not allow: 1. User Data to be manipulated and disclosed, 2. TSF data to be disclosed or manipulated, 3. software to be reconstructed, 4. substantial information about construction of TSF to be gathered which may enable other attacks and 5. sensitive User Data (EF.DG3 and EF.DG4) to e disclosed,102. Application Note 81: The formulation of “Deploying Test Features …” in FMT_LIM.2.1 might be a little bit misleading since the addressed features are no longer available (e.g. by disabling or removing the respective functionality). Nevertheless the combination of FMT_LIM.1 and FMT_LIM.2 is introduced to provide an optional approach to enforce the same policy. Note that the term “software” in item 4 of FMT_LIM.1.1 and FMT_LIM.2.1 refers to both IC Dedicated and IC Embedded Software. 6.1.6.5 FMT_MTD.1 Management of TSF data 101 [assignment: limited capability and availability policy] 102 [assignment: limited capability and availability policy] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 85 of 127 Application Note 82: the following SFR are iterations of the component Management of TSF data (FMT_MTD.1). The TSF data include but are not limited to those identified below. The TOE shall meet the requirement “Management of TSF data (FMT_MTD.1)” as specified below (CC part 2). The iterations address different management functions and different TSF data. FMT_MTD.1/INI_ENA Management of TSF data – Writing of Initialization Data Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions; fulfilled by FMT_SMF.1 FMT_SMR.1 Security roles: fulfilled by FMT_SMR.1/PACE FMT_MTD.1.1/ INI_ENA The TSF shall restrict the ability to write103 the Initialization Data104 to the Manufacturer105. Application Note 83: IC Initialization Data are written by the IC Manufacturer, TOE Initialization data are written by the Initialization Agent, according to the description given in section 1.5.2. The IC Initializatino data include the Initialization key. FMT_MTD.1/INI_DIS Management of TSF data – Reading and Using Initialisation Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions: fulfilled by FMT_SMF.1 FMT_SMR.1 Security roles: fulfilled by FMT_SMR.1/PACE FMT_MTD.1.1/ INI_DIS The TSF shall restrict the ability to read out106 the Initialization Data107 to the Personalization Agent108. Application Note 84: The TOE may restrict the ability to write the Initialisation Data by (i) allowing writing these data only once and (ii) blocking the role Manufacturer at the end of the manufacturing phase. The Manufacturer may write the Initialisation Data (as required by FAU_SAS.1) including, but being not limited to a unique identification of the IC being used to trace the IC in the life cycle phases ‘manufacturing’ and ‘issuing’, but being not needed and may be misused in the ‘operational use’. Therefore, read and use access to the Initialisation Data shall be blocked in the ‘operational use’ by the Personalization Agent, when he switches the TOE from the life cycle phase ‘issuing’ to the life cycle phase ‘operational use’. 103 [selection: change_default, query, modify, delete, clear, [assignment: other operations]] 104 [assignment: list of TSF data] 105 [assignment: the authorised identified roles] 106 [selection: change_default, query, modify, delete, clear, [assignment: other operations]] 107 [assignment: list of TSF data] 108 [assignment: the authorised identified roles] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 86 of 127 FMT_MTD.1/CVCA_INI Management of TSF data – Initialization of CVCA Certificate and Current Date Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions FMT_SMR.1 Security roles FMT_MTD.1.1/CVCA_INI The TSF shall restrict the ability to write109 the none110to the Personalization Agent111. Application Note 85: The initial Country Verifying Certification Authority Public Key may be written by the Manufacturer in the production or by the Personalization Agent (cf. [R8]). The initial Country Verifying Certification Authority Public Keys (and their updates later on) are used to verify the Country Verifying Certification Authority Link-Certificates. The initial Country Verifying Certification Authority Certificate and the initial Current Date is needed for verification of the certificates and the calculation of the Terminal Authorization. FMT_MTD.1/CVCA_UPD Management of TSF data – Country Verifying Certification Authority Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions FMT_SMR.1 Security roles FMT_MTD.1.1/CVCA_UPD The TSF shall restrict the ability to update112 the: 1. Country Verifying Certification Authority Public Key, 2. Country Verifying Certification Authority Certificate113, to Country Verifying Certification Authority114. Application Note 86: The Country Verifying Certification Authority updates its asymmetric key pair and distributes the public key by means of the Country Verifying CA Link-Certificates (cf. [R8]). The TOE updates its internal trust-point if a valid Country Verifying CA Link- Certificates (cf. FMT_MTD.3) is provided by the terminal (cf. [R8]). FMT_MTD.1/DATE Management of TSF data – Current date 109 [selection: change_default, query, modify, delete, clear, [assignment: other operations]] 110 [assignment: list of TSFdata] 111 [assignment: the authorised identified roles] 112 [selection: change_default, query, modify, delete, clear, [assignment: other operations]] 113 [assignment: list of TSF data] 114 [assignment: the authorised identified roles] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 87 of 127 Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions FMT_SMR.1 Security roles FMT_MTD.1.1/DATE The TSF shall restrict the ability to modify115 the Current Date116 to: 1. Country Verifying Certification Authority, 2. Document Verifier, 3. Domestic Extended Inspection System117 Application Note 87: The authorized roles are identified in their certificate (cf. [R8]) and authorized by validation of the certificate chain (cf. FMT_MTD.3). The authorized role of the terminal is part of the Certificate Holder Authorization in the card verifiable certificate provided by the terminal for the identification and the Terminal Authentication (cf. to [R8]). FMT_MTD.1/ADDTSF_WRITE Management of TSF data – Additional TSF data Write Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions FMT_SMR.1 Security roles FMT_MTD.1.1/ ADDTSF_WRITE The TSF shall restrict the ability to write118 the Security Environment object119 to the Personalization Agent120. Application Note 88: This SFR has been added by the ST author to impose a restriction in writing the internal data object called “Security Environment Object”. This object stores links to the PACE keys, the Active Authentication private key, the Chip Authentication private key and the trustpoint. FMT_MTD.1/LCS_UPDATE Management of TSF data – Updating of Life Cycle Status Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions FMT_SMR.1 Security roles 115 [selection: change_default, query, modify, delete, clear, [assignment: other operations]] 116 [assignment: list of TSF data] 117 [assignment: the authorised identified roles] 118 [selection: change_default, query, modify, dolete, clear, [assignment: other operations]] 119 [assignment: list of TSF data] 120 [assignment: the authorised identified roles] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 88 of 127 FMT_MTD.1.1/ LCS_UPDATE The TSF shall restrict the ability to modify121 the Life Cycle Status122 to the Personalization Agent123. FMT_MTD.1/CAPK Management of TSF data – Chip Authentication Private Key Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions FMT_SMR.1 Security roles FMT_MTD.1.1/ CAPK The TSF shall restrict the ability to load124 the Chip Authentication Private Key125 to the personalization Agent126 Application Note 89: The verb “load” means here that the Chip Authentication Private Key is generated securely outside the TOE and written into the TOE memory. FMT_MTD.1/KEY_READ Management of TSF data – Key Read Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions FMT_SMR.1 Security roles FMT_MTD.1.1/ KEY_READ The TSF shall restrict the ability to read127: 1. Initialization key, 2. PACE passwords, 3. Chip Authentication Private key, 4. Personalization keys. 5. Active Authentication Private Key128 to none129. 121 [selection: change_default, query, modify, dolete, clear, [assignment: other operations]] 122 [assignment: list of TSF data] 123 [assignment: the authorised identified roles] 124 [selection: create, load] 125 [assignment: list of TSF data] 126 [assigned: the authorised identified roles] 127 [selection: change_default, query, modify, delete, clear, [assignment: other operations]] 128 [assignment: list of TSF data] 129 [assignment: the authorised identified roles] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 89 of 127 Application Note 90: The SFR FMT_MTD.1/KEY_READ in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in PACE PP [R7] by additional TSF data. This extension does not conflict with the strict conformance to PACE PP. Application Note 91: A refinement has been added to address the Active Authentication mechanism. FMT_MTD.1/PA Management of TSF data – Personalization Agent Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions: fulfilled by FMT_SMF.1 FMT_SMR.1 Security roles: fulfilled by FMT_SMR.1/PACE FMT_MTD.1.1/ PA The TSF shall restrict the ability to write130 the Document Security Object (SOD)131 to the Personalization Agent132. Application Note 92: By writing SOD into the TOE, the Personalization Agent confirms (on behalf of DS) the correctness of all the personalization data related. This consists of user- and TSF-data . FMT_MTD.1/AAPK Management of TSF data – Active Authentication Private Key Hierarchical to: No other components. Dependencies: FMT_SMF.1 Specification of management functions: fulfilled by FMT_SMF.1 FMT_SMR.1 Security roles: fulfilled by FMT_SMR.1/PACE FMT_MTD.1.1/ AAPK The TSF shall restrict the ability to write133 the Active Authentication Private Key134 to the Manufacturer135. Application Note 93: The addition of this SFR does not impair the conformance to the Protection Profiles 130 [selection: change_default, query, modify, delete, clear, [assignment: other operations]] 131 [assignment: list of TSF data] 132 [assignment: the authorised identified roles] 133 [selection: change_default, query, modify, delete, clear, [assignment: other operations]] 134 [assignment: list of TSF data] 135 [assignment: the authorised identified roles] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 90 of 127 6.1.6.6 FMT_MTD.3 Secure TSF data The TOE shall meet the requirement “Secure TSF data (FMT_MTD.3)” as specified below (CC part 2). FMT_MTD.3 Secure TSF data Hierarchical to: No other components. Dependencies: FMT_MTD.1 Management of TSF data FMT_MTD.3.1 The TSF shall ensure that only secure values of the certificate chain are accepted for TSF data of the Terminal Authentication Protocol v.1 and the Access Control136. Refinement: The certificate chain is valid if and only if : 1. the digital signature of the Inspection System Certificate can be verified as correct with the public key of the Document Verifier Certificate and the expiration date of the Inspection System Certificate is not before the Current Date of the TOE, 2. the digital signature of the Document Verifier Certificate can be verified as correct with the public key in the Certificate of the Country Verifying Certification Authority and the expiration date of the Document Verifier Certificate is not before the Current Date of the TOE and the expiration date of Document Verifier Certificate is not before the Current date of the TOE, 3. the digital signature of the Certificate of the Country Verifying Certification Authority can be verified as correct with the public key of the Country Verifying Certification Authority known to the TOE. The Inspection System Public Key contained in the Inspection System Certificate in a valid certificate chain is a secure value for the authentication reference data of the Extended Inspection System. The intersection of the Certificate Holder Authorizations contained in the certificates of a valid certificate chain is a secure value for Terminal Authorization of a successful authenticated Extended Inspection System. Application Note 94: The Terminal Authentication is used for Extended Inspection System as required by FIA_UAU.4/PACE and FIA_UAU.5/PACE. The Terminal Authorization is used as TSF data for access control required by FDP_ACF.1/TRM. 6.1.7 Class FPT Protection of the Security Functions The TOE shall prevent inherent and forced illicit information leakage for User Data and TSF- data. The security functional requirement FPT_EMS.1 addresses the inherent leakage. With respect to the forced leakage they have to be considered in combination with the security functional requirements “Failure with preservation of secure state (FPT_FLS.1)” and “TSF 136 [assignment: list of TSF data] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 91 of 127 testing (FPT_TST.1)” on the one hand and “Resistance to physical attack (FPT_PHP.3)” on the other. The SFRs “Limited capabilities (FMT_LIM.1)”, “Limited availability (FMT_LIM.2)” and “Resistance to physical attack (FPT_PHP.3)” together with the SAR “Security architecture description” (ADV_ARC.1) prevent bypassing, deactivation and manipulation of the security features or misuse of TOE security functionality. 6.1.7.1 FPT_EMS.1 TOE emanation The TOE shall meet the requirement “TOE emanation (FPT_EMS.1)” as specified below (CC part 2 extended): FPT_EMS.1 TOE Emanation Hierarchical to: No other components. Dependencies: No dependencies. FPT_EMS.1.1 The TOE shall not emit electromagnetic and current emissions137 in excess of intelligible threshold138 enabling access to 1. Initialization key, 2. Chip Authentication session Keys, 3. PACE session Keys (PACE-KMAC, PACE-KENC), 4. the ephemeral private key ephem-SKPICC-PACE, 5. Personalization Agent key(s), 6. Chip Authentication Private Key, 7. Active Authentication Private Key139 and 8. EF.DG1 to EF.DG16, EF.SOD, EF.COM140 FPT_EMS.1.2 The TSF shall ensure any users141 are unable to use the following interface smart card circuits contacts142 to gain access to 1. Initialization key, 2. Chip Authentication session Keys, 3. PACE session Keys (PACE-KMAC, PACE-KENC), 4. the ephemeral private key ephem-SKPICC-PACE, 5. Personalization Agent key(s), 6. Chip Authentication Private Key, 7. Active Authentication Private Key143 and 8. EF.DG1 to EF.DG16, EF.SOD, EF.COM144 Refinement: 137 [assignment: type of emissions] 138 [assignment: specified limits] 139 [assignment: list of types of TSF data] 140 [assignment: list of types of user data] 141 [assignment: type of users] 142 [assignment: type of connection] 143 [assignment: list of types of TSF data] 144 [assignment: list of types of user data] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 92 of 127 The TSF shall ensure any user are unable to use the smart card circuits contacts to gain access to TSF data and User Data in any unintended mode violating the security policy defined by FDP_ACC.1/TRM, FDP_ACF.1/TRM, FMT_MTD.1/INI_DIS and FMT_MTD.1/KEY_READ. Application Note 95: The SFR FPT_EMS.1.1 in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in PACE PP [R7] by EAC aspects 1., 5. and 6. The SFR FPT_EMS.1.2 in this ST covers the definition in the EAC PP [R6] that, in turn, extends the definition in PACE PP [7] by EAC aspects 4) and 5). These extensions do not conflict with the strict conformance to PACE PP. Application Note 96: The TOE shall prevent attacks against the listed secret data where the attack is based on external observable physical phenomena of the TOE. Such attacks may be observable at the interfaces of the TOE or may be originated from internal operation of the TOE or may be caused by an attacker that varies the physical environment under which the TOE operates. The set of measurable physical phenomena is influenced by the technology employed to implement the smart card. The e-Document’s chip can provide a smart card contactless interface according to ISO/IEC 14443 [R19][R20][R21][R22] and contact based interface according to ISO/IEC 7816-2 [R37] as well (in case the package only provides a contactless interface the attacker might gain access to the contacts anyway). Examples of measurable phenomena include, but are not limited to variations in the power consumption, the timing of signals and the electromagnetic radiation due to internal operations or data transmissions. The following security functional requirements address the protection against forced illicit information leakage including physical manipulation. 6.1.7.2 FPT_FLS Failure with preservation of secure state The TOE shall meet the requirement “Failure with preservation of secure state (FPT_FLS.1)” as specified below (Common Criteria part 2). FPT_FLS.1 Failure with preservation of secure state Hierarchical to: No other components. Dependencies: No dependencies FPT_FLS.1.1 The TSF shall preserve a secure state when the following types of failures occur: 1. Exposure to operating conditions causing a TOE malfunction, 2. Failure detected by TSF according to FPT_TST.1145 145 [assignment: list of types of failures in the TSF] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 93 of 127 6.1.7.3 FPT_TST.1 TSF testing The TOE shall meet the requirement “TSF testing (FPT_TST.1)” as specified below (Common Criteria part 2). FPT_TST.1 TSF testing Hierarchical to: No other components. Dependencies: No dependencies. FPT_TST.1.1 The TSF shall run a suite of self tests during initial start-up, and before any use of TSF data146 to demonstrate the correct operation of the TSF147. FPT_TST.1.2 The TSF shall provide authorized users with the capability to verify the integrity of the TSF data148. FPT_TST.1.3 The TSF shall provide authorized users with the capability to verify the integrity of stored TSF executable code149. Application Note 97: A dedicated software in the protected ROM of the IC P6022J VBprovides full test capabilities (operating system for test, “OST”), not accessible by the Security IC Embedded Software after delivery. Application Note 98: At start-up the OS checks whether a reset has been triggered by a sensor. If this is the case, a reset counter is incremented. If the count exceeds 32, then the chip is irreversibly blocked. Before any read of the TSF data, the EEPROM memory is checked for possible fault injection events. If this is the case, the reset counter is incremented and the chip goes into an endless loop. During normal operation, tests of the random number generation and integrity checks are also executed. Application Note 99: FPT_TST.1.3 protects the integrity of the code by physical means, using the mechanisms of the underlying IC. After delivery, the TOE does not use logical means to check the integrity of the code, as it relies on the IC security features to provide verification of the code integrity. 6.1.7.4 FPT_PHP.3 Resistance to physical attack The TOE shall meet the requirement “Resistance to physical attack (FPT_PHP.3)” as specified below (CC part 2). FPT_PHP.3 Resistance to physical attack Hierarchical to: No other components. 146 [selection: during initial start-up, periodically during normal operation, at the request of the authorised user, at the conditions [assignment: conditions under which sel test should occur]] 147 [selection: [assignment: parts of TSF], the TSF] 148 [selection: [assignment: parts of TSF], TSF data] 149 [selection: [assignment: parts of TSF], TSF] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 94 of 127 Dependencies: No dependencies. FPT_PHP.3.1 The TSF shall resist physical manipulation and physical probing150 to the TSF151 by responding automatically such that the SFRs are always enforced. Application Note 100: The TOE will implement appropriate measures to continuously counter physical manipulation and physical probing. Due to the nature of these attacks (especially manipulation) the TOE can by no means detect attacks on all of its elements. Therefore, permanent protection against these attacks is required ensuring that the TSP could not be violated at any time. Hence, ‘automatic response’ means here (i) assuming that there might be an attack at any time and (ii) countermeasures are provided at any time. 6.2 Security Assurance Requirements for the TOE The assurance requirements for the evaluation of the TOEand its development and operating environment are those taken from the Evaluation Assurance Level 4 (EAL4) and augmented by taking the following components: ALC_DVS.2 and AVA_VAN.5. Table 25 summarizes the assurance components that define the security assurance requirements for the TOE. Table 25 Assurance requirements at EAL4+ Assurance Class Assurance Components ADV ADV_ARC.1, ADV_FSP.5, ADV_IMP.1, ADV_INT.2, ADV_TDS.4, ADV_COMP.1 AGD AGD_OPE.1, AGD_PRE.1 ALC ALC_CMC.4, ALC_CMS.5, ALC_DEL.1, ALC_DVS.2, ALC_LCD.1, ALC_TAT.2 ASE ASE_CCL.1, ASE_ECD.1, ASE_INT.1, ASE_OBJ.2, ASE_REQ.2, ASE_SPD.1, ASE_TSS.1 ATE ATE_COV.2, ATE_DPT.3, ATE_FUN.1, ATE_IND.2 AVA AVA_VAN.5 Application Note 101: The TOE shall protect the assets against high attack potential. This includes intermediate storage in the chip as well as secure channel communications established using the Chip Authentication Protocol v.1 (OE.Prot_Logical_e-Document). If the TOE is operated in non-certified mode using the BAC-established communication channel, the confidentiality of the standard data shall be protected against attackers with at least Enhanced-Basic attack potential (AVA_VAN.3). 150 [assignment: physical tampering scenarios] 151 [assignment: list of TSF devices/elements] Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 95 of 127 6.3 Security Requirements Rationale 6.3.1 Security functional requirements rationale Table 26 provides an overview for security functional requirements coverage of security objectives. Table 26 Coverage of Security Objective for the TOE by SFR OT.Sens_Data_Conf OT.Chip_Auth_Proof OT.Active_Auth_Proof OT.AC_Pers OT.Data_Integrity OT.Data_Authenticity OT.Data_Confidentiality OT.Identification OT.Prot_Abuse-Func OT.Prot_Inf_Leak OT.Tracing OT.Prot_Phys-Tamper OT.Prot_Malfunction FAU_SAS.1 X X FCS_CKM.1/DH_PACE X X X FCS_CKM.1/CA X X X X X FCS_CKM.4 X X X X X FCS_COP.1/AA_SIGN X X FCS_COP.1/PACE_ENC X FCS_COP.1/CA_ENC X X X X X FCS_COP.1/PACE_MAC X X FCS_COP.1/CA_MAC X X X X FCS_COP.1/SIG_VER X FCS_RND.1 X X X X X FIA_AFL.1/PACE X X FIA_UID.1/PACE X X X X X FIA_UAU.1/PACE X X X X X FIA_UAU.4/PACE X X X X X FIA_UAU.5/PACE X X X X X FIA_UAU.6/PACE X X X FIA_UAU.6/EAC X X X X FIA_API.1/CA X FIA_API.1/AA X FDP_ACC.1/TRM X X X X FDP_ACF.1/TRM X X X X FDP_RIP.1 X X X FDP_UCT.1/TRM X X FDP_UIT.1/TRM X X FMT_SMF.1 X X X X X X FMT_SMR.1/PACE X X X X X X FMT_LIM.1 X FMT_LIM.2 X FMT_MTD.1/INI_ENA X X FMT_MTD.1/INI_DIS X X Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 96 of 127 FMT_MTD.1/CVCA_INI X FMT_MTD.1/CVCA_UPD X FMT_MTD.1/DATE X FMT_MTD.1/ADDTSF_WRITE X X FMT_MTD.1/LCS_UPDATE X X X FMT_MTD.1/CAPK X X X FMT_MTD.1/PA X X X X FMT_MTD.1/KEY_READ X X X X X X FMT_MTD.1/AAPK X X X FMT_MTD.3 X FPT_EMS.1 X X FPT_TST.1 X X FPT_FLS.1 X X FPT_PHP.3 X X X FTP_ITC.1/PACE X X X X The security objective OT.Identification “Identification of the TOE” addresses the storage of Initialisation and in its non-volatile memory, whereby they also include the IC Identification Data uniquely identifying the TOE’s chip. This will be ensured by TSF according to SFR FAU_SAS.1. The SFR FMT_MTD.1/INI_ENA allows only the Manufacturer to write Initialisation (including the Personalization key). The SFR FMT_MTD.1/INI_DIS requires the Personalization Agent to disable access to Initialisation in the life cycle phase ‘operational use’. The SFRs FMT_SMF.1 and FMT_SMR.1/PACE support the functions and roles related. The security objective OT.AC_Pers “Access Control for Personalization of logical e- Document” addresses the access control of the writing the logical e-Document. The Personalization Agent is authenticated by using the authentication mechanism based on 3DES (FCS_COP.1/AUTH and FCS_RND.1 [for key generation]), with the Personalization keys by using the authentication mechanism. The authentication failures are managed according to FIA_AFL.1/PACE. The justification for the SFRs FAU_SAS.1, FMT_MTD/INI_ENA and FMT_MTD.1/INI_DIS arises from the justification for OT.Identification above with respect to the Personalization Data. The write access to the logical e-Document data are defined by the SFR FIA_UID.1/PACE, FIA_UAU.1/PACE, FDP_ACC.1/TRM and FDP_ACF.1/TRM in the same way: only the successfully authenticated Personalization Agent is allowed to write the data of the groups EF.DG1 to EF.DG13, EF.DG16 of the logical e-Document only once. FMT_MTD.1/PA covers the related property of OT.AC_Pers (writing SOD and, in generally, personalization data). The SFR FMT_SMR.1/PACE lists the roles (including Personalization Agent) and the SFR FMT_SMF.1 lists the TSF management functions (including Personalization). The SFRs FMT_MTD.1./KEY_READ and FPT_EMS.1 restrict the access to the Personalization keys, the Chip Authentication Private Key, PACE passwords and Active Authentication key. The authentication of the terminal as Personalization Agent shall be performed by TSF according to SFR FIA_UAU.4/PACE and FIA_UAU.5/PACE. If the Personalization Terminal wants to authenticate itself to the TOE by means of the Authentication Mechanism with the Personalization key the TOE will use TSF according to the FCS_RND.1 (for the generation of the challenge) and FCS_COP.1/CA_ENC (to verify the authentication attempt and for Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 97 of 127 secure messaging) and FCS_COP.1/CA_MAC (for the ENC_MAC_Mode secure messaging). The session keys are destroyed according to FCS_CKM.4 after use. The Personalization Agent also handles the security environment object according to the SFR FMT_MTD.1/ADDTSF_WRITE, as well as the Life Cycle Status information according to the SFR FMT_MTD.1/LCS_UPDATE. The security objective OT.Data_Integrity “Integrity of personal data” requires the TOE to protect the integrity of the logical e-Document stored on the e-Document’s chip against physical manipulation and unauthorized writing. Physical manipulation is addressed by FPT_PHP.3. Logical manipulation of stored user data is addressed by (FDP_ACC.1/TRM, FDP_ACF.1/TRM): only the Personalization Agent are allowed to write the data in EF.DG1 to EF.DG16 of the logical e-Document of the logical e-Document (FDP_ACF.1.2/TRM, rule 1) and terminals are not allowed to modify any of the data in EF.DG1 to EF.DG16 of the logical e-Document (cf. FDP_ACF.1.4/TRM). FMT_MTD.1/PA requires that SOD containing signature over the User Data stored on the TOE and used for the Passive Authentication is allowed to be written by the Personalization Agent only and, hence, is to be considered as trustworthy. The Personalization Agent must identify and authenticate themselves according to FIA_UID.1/PACE and FIA_UAU.1/PACE before accessing these data. Unauthorised modifying of the exchanged data is addressed, in the first line, by FTP_ITC.1/PACE using FCS_COP.1/PACE_MAC. For PACE secured data exchange, a prerequisite for establishing this trusted channel is a successful PACE Authentication (FIA_UID.1/PACE, FIA_UAU.1/PACE) using FCS_CKM.1/DH_PACE and possessing the special properties FIA_UAU.5/PACE, FIA_UAU.6/PACE resp. FIA_UAU.6/EAC. The trusted channel is established using PACE, Chip Authentication v.1, and Terminal Authentication v.1. FDP_RIP.1 requires erasing the values of session keys (here: for KMAC). The TOE supports the inspection system detect any modification of the transmitted logical e-Document data after Chip Authentication v.1. The SFR FIA_UAU.6/EAC and FDP_UIT.1/TRM requires the integrity protection of the transmitted data after Chip Authentication v.1 by means of secure messaging implemented by the cryptographic functions according to FCS_CKM.1/CA (for the generation of shared secret andfor the derivation of the new session keys), and FCS_COP.1/CA_ENC and FCS_COP.1/CA_MAC for the ENC_MAC_Mode secure messaging. The session keys are destroyed according to FCS_CKM.4 after use. The SFRs FMT_MTD.1/CAPK, FMT_MTD.1/AAPK and FMT_MTD.1/KEY_READ require that the Chip Authentication Key and Active Authentication key cannot be written unauthorized or read afterwards. The SFR FCS_RND.1 represents a general support for cryptographic operations needed. The security objective OT.Data_Authenticity aims ensuring authenticity of the User- and TSF data (after the PACE Authentication) by enabling its verification at the terminal-side and by an active verification by the TOE itself. This objective is mainly achieved by FTP_ITC.1/PACE using FCS_COP.1/PACE_MAC. A prerequisite for establishing this trusted channel is a successful PACE or Chip and Terminal Authentication v.1 (FIA_UID.1/PACE, FIA_UAU.1/PACE) using FCS_CKM.1/DH_PACE resp. FCS_CKM.1/CA and possessing the special properties FIA_UAU.5/PACE, Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 98 of 127 FIA_UAU.6/PACE resp. FIA_UAU.6/EAC. FDP_RIP.1 requires erasing the values of session keys (here: for KMAC). FIA_UAU.4/PACE, FIA_UAU.5/PACE and FCS_CKM.4 represent some required specific properties of the protocols used. The SFR FMT_MTD.1./KEY_READ restricts the access to the PACE passwords and the Chip Authentication Private Key. FMT_MTD.1/PA requires that SOD containing signature over the User Data stored on the TOE and used for the Passive Authentication is allowed to be written by the Personalization Agent only and, hence, is to be considered as trustworthy. The SFR FCS_RND.1 represents a general support for cryptographic operations needed. The SFRs FMT_SMF.1 and FMT_SMR.1/PACE support the functions and roles related. The security objective OT.Data_Authenticity is also achieved by FCS_COP.1/AA_SIGN. The security objective OT.Data_Confidentiality aims that the TOE always ensures confidentiality of the User- and TSF-data stored and, after the PACE Authentication resp. Chip Authentication, of these data exchanged. This objective for the data stored is mainly achieved by (FDP_ACC.1/TRM, FDP_ACF.1/TRM). FIA_UAU.4/PACE, FIA_UAU.5/PACE and FCS_CKM.4 represent some required specific properties of the protocols used. This objective for the data exchanged is mainly achieved by FDP_UCT.1/TRM, FDP_UIT.1/TRM and FTP_ITC.1/PACE using FCS_COP.1/PACE_ENC resp. FCS_COP.1/CA_ENC. A prerequisite for establishing this trusted channel is a successful PACE or Chip and Terminal Authentication v.1 (FIA_UID.1/PACE, FIA_UAU.1/PACE) using FCS_CKM.1/DH_PACE resp. FCS_CKM.1/CA and possessing the special properties FIA_UAU.5/PACE, FIA_UAU.6/PACE resp. FIA_UAU.6/EAC. FDP_RIP.1 requires erasing the values of session keys (here: for KENC). The SFR FMT_MTD.1./KEY_READ restricts the access to the PACE passwords and the Chip Authentication Private Key. FMT_MTD.1/PA requires that SO D containing signature over the User Data stored on the TOE and used for the Passive Authentication is allowed to be written by the Personalization Agent only and, hence, is to be considered trustworthy. The SFR FCS_RND.1 represents the general support for cryptographic operations needed. The SFRs FMT_SMF.1 and FMT_SMR.1/PACE support the functions and roles related. The Life Cycle Management according to FMT_MTD.1/LCS_UPDATE has a support role in keeping confidentiality in all life cycle phases. The security objective OT.Sense_Data_Conf “Confidentiality of sensitive biometric reference data” is enforced by the Access Control SFP defined in FDP_ACC.1/TRM and FDP_ACF.1/TRM allowing the data of EF.DG3 and EF.DG4 only to be read by successfully authenticated Extended Inspection System being authorized by a valid certificate according FCS_COP.1/SIG_VER. The SFRs FIA_UID.1/PACE and FIA_UAU.1/PACE require the identification and authentication of the inspection systems. The SFR FIA_UAU.5/PACE requires the successful Chip Authentication (CA) v.1 before any authentication attempt as Extended Inspection System. During the protected communication following the CA v.1 the reuse of authentication data is prevented by FIA_UAU.4/PACE. The SFR FIA_UAU.6/EAC and FDP_UCT.1/TRM requires the confidentiality protection of the transmitted data after Chip Authentication v.1 by means of secure messaging implemented by the cryptographic functions according to FCS_RND.1 (for the generation of the terminal authentication challenge), FCS_CKM.1/CA (for the generation of shared secret and for the derivation of the new session keys), and FCS_COP.1/CA_ENC and FCS_COP.1/CA_MAC for the Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 99 of 127 ENC_MAC_Mode secure messaging. The session keys are destroyed according to FCS_CKM.4 after use. The SFR FMT_MTD.1/CAPK, FMT_MTD.1/AAPK and FMT_MTD.1/KEY_READ requires that the Chip Authentication Key cannot be written unauthorized or read afterwards. The Personalization Agent manages the security environment object data required for Chip Authentication and for Terminal Authentication according to SFR FMT_MTD.1/ADDTSF_WRITE. To allow a verification of the certificate chain as in FMT_MTD.3 the CVCA’s public key and certificate as well as the current date are written or update by authorized identified role as of FMT_MTD.1/CVCA_INI, FMT_MTD.1/CVCA_UPD and FMT_MTD.1/DATE. The Life Cycle Management according to FMT_MTD.1/LCS_UPDATE has a support role in keeping confidentiality of sensistive data in all life cycle phases. The security objective OT.Chip_Auth_Proof “Proof of e-Document’s chip authenticity” is ensured by the Chip Authentication Protocol v.1 provided by FIA_API.1/CA proving the identity of the TOE. The Chip Authentication Protocol v.1 defined by FCS_CKM.1/CA is performed using a TOE internally stored confidential private key as required by FMT_MTD.1/CAPK and FMT_MTD.1/KEY_READ. The Chip Authentication Protocol v.1 [R8] requires additional TSF according to FCS_CKM.1/CA (for the derivation of the session keys), FCS_COP.1/CA_ENC and FCS_COP.1/CA_MAC (for the ENC_MAC_Mode secure messaging). The SFRs FMT_SMF.1 and FMT_SMR.1/PACE support the functions and roles related. The security objective OT.Active_Auth_Proof “Proof of e-Document’s chip authenticity” is ensured by the Active Authentication Mechanism [R40] provided by FIA_API.1/AA proving the identity of the TOE. The Active Authentication Protocol defined by FIA_API.1/AA is performed using a TOE internally stored confidential private key as required by FMT_MTD.1/AAPK. This key is written to the TOE as defined by FMT_MTD.1/AAPK. The Active Authentication Protocol requires additional TSF according to FCS_COP.1/AA_SIG (for the digital signature of Active Authentication data). The security objective OT.Prot_Abuse-Func “Protection against Abuse of Functionality” is ensured by the SFR FMT_LIM.1 and FMT_LIM.2 which prevent misuse of test functionality of the TOE or other features which may not be used after TOE Delivery. The security objective OT.Prot_Inf_Leak “Protection against Information Leakage” requires the TOE to protect confidential TSF data stored and/or processed in the e-Document’s chip against disclosure • by measurement and analysis of the shape and amplitude of signals or the time between events found by measuring signals on the electromagnetic field, power consumption, clock, or I/O lines which is addressed by the SFR FPT_EMS.1, • by forcing a malfunction of the TOE which is addressed by the SFR FPT_FLS.1 and FPT_TST.1, and/or • by a physical manipulation of the TOE which is addressed by the SFR FPT_PHP.3. The security objective OT.Tracing aims that the TOE prevents gathering TOE tracing data by means of unambiguous identifying the e-Document directly through establishing a communication via the contact interface or remotely through establishing or listening to a communication via the contactless interface of the TOE without a priori knowledge of the Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 100 of 127 correct values of shared passwords (Initialization key, Personalization keys, CAN, MRZ, PACE password).This objective is achieved as follows: i. while establishing PACE communication with PACE password (non-blocking authorisation data) – by FIA_AFL.1/PACE; ii. for listening to PACE communication (is of importance for the current PP, since SOD is card-individual) – FTP_ITC.1/PACE. The security objective OT.Prot_Phys-Tamper “Protection against Physical Tampering” is covered by the SFR FPT_PHP.3. The security objective OT.Prot_Malfunction “Protection against Malfunctions” is covered by (i) the SFR FPT_TST.1 which requires self tests to demonstrate the correct operation and tests of authorized users to verify the integrity of TSF data and TSF code, and (ii) the SFR FPT_FLS.1 which requires a secure state in case of detected failure or operating conditions possibly causing a malfunction. 6.3.2 Dependency Rationale The dependency analysis for the security functional requirements shows that the basis for mutual support and internal consistency between all defined functional requirements is satisfied. All dependencies between the chosen functional components are analyzed, and non-dissolved dependencies are appropriately explained. Table 27 shows the dependencies between the SFR of the TOE. Table 27 Dependencies between the SFR for the TOE SFR Dependencies Support of the Dependencies FCS_CKM.1/CA [FCS_CKM.2 Cryptographic key distribution or FCS_COP.1 Cryptographic operation], FCS_CKM.4 Cryptographic key destruction Fulfilled by FCS_COP.1/CA_ENC, and FCS_COP.1/CA_MAC, Fulfilled by FCS_CKM.4 FCS_CKM.4 [FDP_ITC.1 Import of user data without security attributes, or FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation] Fulfilled by FCS_CKM.1/DH_PACE and FCS_CKM.1/CA FCS_COP.1/AA_SIG N [FDP_ITC.1 Import of user data without security attributes, FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation], FCS_CKM.4 Cryptographic key destruction Fulfilled by FCS_ITC.1/PACE Since AA doesn’t provide for generation or destruction of cryptographic keys, the SFRs FCS_CKM.1 and FCS_CKM.4 don’t apply. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 101 of 127 FCS_COP.1/CA_ENC [FDP_ITC.1 Import of user data without security attributes, FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation], FCS_CKM.4 Cryptographic key destruction Fulfilled by FCS_CKM.1/CA, Fulfilled by FCS_CKM.4 FCS_COP.1/CA_MAC [FDP_ITC.1 Import of user data without security attributes, FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation], FCS_CKM.4 Cryptographic key destruction Fulfilled by FCS_CKM.1/CA Fulfilled by FCS_CKM.4 from [7] FCS_COP.1/SIG_VE R [FDP_ITC.1 Import of user data without security attributes, FDP_ITC.2 Import of user data with security attributes, or FCS_CKM.1 Cryptographic key generation], FCS_CKM.4 Cryptographic key destruction Fulfilled by FCS_CKM.1/CA, Fulfilled by FCS_CKM.4 from [7] FIA_UID.1/PACE No dependencies n.a. FIA_UAU.1/PACE FIA_UID.1 Timing of identfication Fulfilled by FIA_UID.1/PACE FIA_UAU.4/PACE No dependencies n.a. FIA_UAU.5/PACE No dependencies n.a. FIA_UAU.6/EAC No dependencies n.a. FIA_API.1 No dependencies n.a. FDP_ACC.1/TRM FDP_ACF.1 Security attribute based access control Fulfilled by FDP_ACF.1/TRM FDP_ACF.1/TRM FDP_ACC.1 Subset access control, FMT_MSA.3 Static attribute initialization Fulfilled by FDP_ACC.1/TRM, justification 1 for non- satisfied dependencies Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 102 of 127 FDP_UCT.1/TRM [FTP_ITC.1 Inter-TSF trusted channel, or FTP_TRP.1 Trusted path]: fulfilled by FPT_ITC.1/PACE [FDP_ACC.1 Subset access control, or FDP_IFC.1 Subset information flow control]: fulfilled by FDP_ACC.1/TRM Fulfilled by FTP_ITC.1/PACE Fulfilled by FDP_ACC.1/TRM FDP_UIT.1/TRM [FDP_ACC.1 Subset access control, or FDP_IFC.1 Subset information flow control]: fulfilled by FDP_ACC.1/TRM [FTP_ITC.1 Inter-TSF trusted channel, or FTP_TRP.1 Trusted path]: fulfilled by FTP_ITC.1/PACE Fulfilled by FTP_ITC.1/PACE Fulfilled by FDP_ACC.1/TRM FMT_SMR.1/PACE FIA_UID.1 Timing of identification Fulfilled by FIA_UID.1/PACE FMT_LIM.1 FMT_LIM.2 Fulfilled by FMT_LIM.2 FMT_LIM.2 FMT_LIM.1 Fulfilled by FMT_LIM.1 FMT_MTD.1/INI_ENA FMT_SMF.1 Specification of management functions; fulfilled by FMT_SMF.1 FMT_SMR.1 Security roles: fulfilled by FMT_SMR.1/PACE Fulfilled by FMT_SMF.1 Fulfilled by FMT_SMR.1/PACE FMT_MTD.1/INI_DIS FMT_SMF.1 Specification of management functions: fulfilled by FMT_SMF.1 FMT_SMR.1 Security roles: fulfilled by FMT_SMR.1/PACE Fulfilled by FMT_SMF.1 Fulfilled by FMT_SMR.1/PACE FMT_MTD.1/KEY_RE AD FMT_SMF.1 Specification of management functions FMT_SMR.1 Security roles Fulfilled by FMT_SMF.1 Fulfilled by FMT_SMR.1 FMT_MTD.1/CVCA_I NI FMT_SMF.1 Specification of management functions, FMT_SMR.1 Security roles Fulfilled by FMT_SMF.1 from [7] Fulfilled by FMT_SMR.1/PACE FMT_MTD.1/CVCA_U PD FMT_SMF.1 Specification of management functions, FMT_SMR.1 Security roles Fulfilled by FMT_SMF.1 from [7] Fulfilled by FMT_SMR.1/PACE Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 103 of 127 FMT_MTD.1/DATE FMT_SMF.1 Specification of management functions, FMT_SMR.1 Security roles Fulfilled by FMT_SMF.1 from [7] Fulfilled by FMT_SMR.1/PACE FMT_MTD.1/CAPK FMT_SMF.1 Specification of management functions, FMT_SMR.1 Security roles Fulfilled by FMT_SMF.1 from [7] Fulfilled by FMT_SMR.1/PACE FMT_MTD.1/AAPK FMT_SMF.1 Specification of management functions, FMT_SMR.1 Security roles Fulfilled by FMT_SMF.1 from [7] Fulfilled by FMT_SMR.1/PACE FMT_MTD.1/ADDTSF _WRITE FMT_SMF.1 Specification of management functions, FMT_SMR.1 Security roles Fulfilled by FMT_SMF.1 Fulfilled by FMT_SMR.1 FMT_MTD.1/LCS_UP DATE FMT_SMF.1 Specification of management functions, FMT_SMR.1 Security roles Fulfilled by FMT_SMF.1 Fulfilled by FMT_SMR.1/PACE FMT_MTD.1/ PA FMT_SMF.1 Specification of management functions FMT_SMR.1 Security roles Fulfilled by FMT_SMF.1 from [7] Fulfilled by FMT_SMR.1/PACE FMT_MTD.3 FMT_MTD.1 Fulfilled by FMT_MTD.1/CVCA_INI and FMT_MTD.1/CVCA_UPD FPT_EMS.1 No dependencies n.a. Justifications for non-satisfied dependencies between the SFR for TOE: Justification 1: The access control TSF according to FDP_ACF.1/TRM uses security attributes which are defined during the personalization and are fixed over the whole life time of the TOE. No management of these security attribute (i.e. SFR FMT_MSA.1 and FMT_MSA.3) is necessary here. 6.3.3 Security Assurance Requirements Rationale The EAL4 was chosen to permit a developer to gain maximum assurance from positive security engineering based on good commercial development practices which, though rigorous, do not require substantial specialist knowledge, skills, and other resources. EAL4 is applicable in those circumstances where developers or users require a moderate to high level of independently assured security in conventional commodity TOEs and are prepared to incur sensitive security specific engineering costs. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 104 of 127 The selection of the component ALC_DVS.2 provides a higher assurance of the security of the e-Document’s development and manufacturing, especially for the secure handling of the e-Document’s material. The selection of the component AVA_VAN.5 provides a higher assurance of the security by vulnerability analysis to assess the resistance to penetration attacks performed by an attacker possessing a high attack potential. This vulnerability analysis is necessary to fulfil the security objectives OT.Sens_Data_Conf and OT.Chip_Auth_Proof. The component ALC_DVS.2 has no dependencies. The component AVA_VAN.5 depends on: • ADV_ARC.1, Security architectural description • ADV_FSP.4, Complete functional specification • ADV_TDS.3, Basic modular design • ADV_IMP.1, Implementation representation of the TSF • AGD_OPE.1, Operational user guidance • AGD_PRE.1, Preparative procedures • ATE_DPT.1, Testing: basic design All of these are met or exceeded in the EAL4 assurance package. 6.3.4 Security Requirements – Mutual Support and Internal Consistency The following part of the security requirements rationale shows that the set of security requirements for the TOE consisting of the security functional requirements (SFRs) and the security assurance requirements (SARs) together form a mutually supportive and internally consistent whole. The analysis of the TOE´s security requirements with regard to their mutual support and internal consistency demonstrates: The dependency analysis in section 6.3.2 Dependency Rationale shows that the basis for mutual support and internal consistency between all defined functional requirements is satisfied. All dependencies between the chosen functional components are analyzed, and non-satisfied dependencies are appropriately explained. All subjects and objects addressed by more than one SFR in section 6.1 are also treated in a consistent way: the SFRs impacting them do not require any contradictory property and behaviour of these “shared” items. The assurance class EAL4 is an established set of mutually supportive and internally consistent assurance requirements. The dependency analysis for the sensitive assurance components in section 6.3.3 Security Assurance Requirements Rationale shows that the assurance requirements are mutually supportive and internally consistent as all (sensitive) dependencies are satisfied and no inconsistency appears. Inconsistency between functional and assurance requirements could only arise if there are functional assurance dependencies which are not met, a possibility which has been shown not to arise in section 6.3.2 “Dependency Rationale” and 6.3.3 Security Assurance Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 105 of 127 Requirements Rationale. Furthermore, as also discussed in section 6.3.3 Security Assurance Requirements Rationale, the chosen assurance components are adequate for the functionality of the TOE. So the assurance requirements and security functional requirements support each other and there are no inconsistencies between the goals of these two groups of security requirements. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 106 of 127 7. TOE Summary Specification The following sections provide a general understanding of how the TOE is implemented. To facilitate reading, the description of the security features of the TOE is organized in security services. A requirements traceability matrix against each security service is given in Table 29. 7.1 Coverage of SFRs 7.1.1 SS.AUTH_IDENT Identification & Authentication This security service meets the following SFRs: FIA_UID.1/PACE, FIA_UAU.1/PACE, FIA_UAU.4/PACE, FIA_UAU.5/PACE, FIA_UAU.6/PACE, FIA_UAU.6/EAC, FIA_AFL.1/PACE, FCS_CKM.4, FIA_API.1/CA, FIA_API.1/AA, FCS_COP.1/AA_SIG FDP_RIP.1 Access to functions and data of the TOE is only allowed to authenticated users. The authentication mechanism applied depends on the inspection system. Table 28 summarizes the authentication mechanisms for the various systems. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 107 of 127 Table 28 Summary of authentication mechanisms System type e-Document Life- Cycle status Authentication Mechanism Initialization system Non-initialized Decryption of initialization cryptograms as described in [R33] Personalization System Initialized Symmetric authentication based on 3DES with the 112-bit Personalization keys Basic Inspection System – without PACE (BIS) Operational BAC based on 3DES with 112-bit Document Basic Access Keys. Basic Inspection System supporting PACE (BIS-PACE) Operational PACE with either DH or ECDH key agreement. Generic Mapping, Integrated Mapping and Chip Authentication Mapping are supported. Extended Inspection System not supporting PACE Operational BAC with 3DES algorithm with Document Basic Access Keys. Chip Authentication with either DH or ECDH key agreement Terminal Authentication with either RSA or ECDSA signature verification algorithms. Extended Inspection System supporting PACE Operational PACE protocol with either DH or ECDH key agreement. Generic Mapping, Integrated Mapping and Chip Authentication Mapping are supported. Chip Authentication with either DH or ECDH key agreement Terminal Authentication with either RSA or ECDSA signature verification algorithms. The Initialization Agent authenticates to the e-Document by decrypting the initialization cryptograms by using the Initialization Keyusing the algorithm described in [R33] based on AES with 256-bit keys. The Initialization Agent has only a limited number of authentication attempts after which the initialization commands are disabled (FIA_AFL.1/PACE). The algorithm used for encryption/decryption is a Triple-DES in CBC mode with key sizes 112 bits (FIPS 46-3 and ICAO Doc 9303-11) and the message authentication code computation accords to Retail MAC algorithm and cryptographic key sizes 112 bit (ISO 9797 - MAC algorithm 3, block cipher DES, Sequence Message Counter, padding mode 2) (FCS_COP.1/PACE_MAC). Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 108 of 127 This function detects each unsuccessful authentication attempt. The Personalization Agent have only a limited number of authentication attempts after which the related keys are blocked (FIA_AFL.1/PACE). In case of regular termination of the protocol, both parties possess authentic keying materials only known to them. The user may establish a secure messaging session and at the end of the session, the session keys are securely erased (FCS_CKM.4). The Basic Access System and the e-Document mutually authenticate by means of a Basic Access Control mechanism based on a three pass challenge-response protocol (FIA_UID.1/PACE, FIA_UAU.1/PACE, FIA_UAU.5/PACE). The challenge is the random number sent from one party to the other. This random number will be enciphered with the secret symmetric key by the receiver and then will be verified by the sender. This security service manages the session keys exchanged between the terminal and the TOE and provides the means to identify and authenticate the users in a secure way. The algorithm used for encryption/decryption is a Triple-DES in CBC mode with key sizes 112 bits (FIPS 46-3 and section 4.3 of the ICAO Doc 9303-11 [R40]) (FCS_COP.1/PACE_ENC), while the message authentication code is computed according to Retail MAC algorithm and cryptographic key sizes 112 bit (ISO 9797 - MAC algorithm 3, block cipher DES, Sequence Message Counter, padding mode 2) (FCS_COP.1/PACE_MAC). These authentication keys are derived by the SHA-1 algorithm (FIPS 180-2) as described in the ICAO Doc 9303-11, section 4.3 [R40]. After a successful BAC authentication, the Basic Access System is able to read less sensitive data, such as the MRZ, the facial image and other data easily available from other sources. The PACE-enabled Basic Access System and the e-Document mutually authenticate by means of a PACE V2 protocol (FIA_UID.1/PACE, FIA_UAU.1/PACE, FIA_UAU.5/PACE). The e-Document and the Inspection System perform a Diffie-Hellman (DH or ECDH) key agreement by means of keys derived from a PACE password (MRZ, CAN or secret password). After a successful authentication, the generated session keys are independent of PACE password entropy. This security service manages the session keys exchanged between the terminal and the TOE and provides the means to identify and authenticate the users in a secure way. The algorithm used for secure messaging encryption/decryption may be either a 3DES or AES (FCS_COP.1/PACE_ENC), the MAC algorithm may be a Retail MAC, coupled with 3DES encryption, or CMAC, coupled with AES encryption (FCS_COP.1/PACE_MAC). After a successful PACE V2 authentication, the Inspection System is able to read less sensitive data, such as the MRZ, the facial image and other data easily available from other sources. If document inspection is performed on a Basic Inspection System, the e-Document’s authenticity may also be proved executing the Active Authentication protocol. To this end, the TOE signs authenticationi data with the RSA algorithm with SHA-256 hashing (FCS_COP.1/AA_SIG, FIA_API.1/AA). If document inspection is performed on a General Inspection System or an Extended Inspection System, then the e-Document’s authenticity is proved executing the Chip Authentication Protocol (as an alternative to Active Authentication). To this end two algorithms may be used: (i) a Diffie-Hellman key agreement compliant to PKCS #3 with key size up to 2048 bit or (ii) ECDH key agreement compliant to ISO15946 with key size up to Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 109 of 127 521 bit. Chip Authentication proves that the chip is genuine and also provides strong keys for Secure Messaging (FIA_UID.1/PACE, FIA_UAU.1/PACE, FIA_UAU.5, FIA_API.1/CA, FCS_CKM.1/CA). If document inspection is performed on an Extended Inspection System, then after a successful Chip Authentication the e-Document’s chip recognizes that the Inspection System is entitled to access sensitive data, such as fingerprints, iris image and other data not easily available from other sources by means of the Terminal Authentication protocol (FIA_UID.1/PACE, FIA_UAU.1/PACE, FIA_UAU.5/PACE, FCS_COP.1/SIG_VER). Terminal Authentication attempts are only accepted after a successful Chip Authentication (as Chip Authentication Protocol Version 1) and a consequent restart of the Secure Messaging session with the strong keys computed in the Chip Authentication. The combination of Chip Authentication and Terminal Authentication provides an implementation of the Extended Access Control mechanism. 7.1.2 SS.SEC_MSG Secure data exchange This security service meets the following SFRs: FCS_CKM.1/DH_PACE, FCS_CKM.1/CA, FCS_COP.1/PACE_ENC, FCS_COP.1/PACE_MAC, FCS_COP.1/CA_ENC, FCS_COP.1/CA_MAC, FCS_CKM.4, FIA_UAU.6/PACE. FIA_UAU.6/EAC, FDP_RIP.1, FTP_ITC.1/PACE This security service concerns the creation and the management of a secure communication channel for the sensitive data exchange between the TOE and the Inspection System. On this channel the data will be encrypted and authenticated with session keys (3DES and AES encryption and MAC computation) such that the TOE is able to verify the integrity and authenticity of received data. The algorithm used for encryption/decryption may either be: • 3DES [R28] in CBC mode with key size 112 bits (FIPS 46-3 and ICAO Doc 9303-11), with message authentication code computed according to Retail MAC algorithm and cryptographic key size 112 bit (ISO 9797 - MAC algorithm 3, block cipher DES, Sequence Message Counter, padding mode 2). • AES [R29] in CBC mode with key sizes 128, 192 and 256 bits, with message authentication code computed according to [R27] with MAC length of 8 bytes. The session keys are calculated during the authentication phase (FCS_CKM.1/DH_PACE, FCS_CKM.1/CA). If a PACE or Chip Authentication protocol is executed, then the Secure Messaging is restarted using the session keys computed during that authentication. The channel will be closed in case of a received message with: • inconsistent or missing MAC, • wrong sequence counter, • plain access. After a PACE or Chip Authentication protocol has been completed, the TOE rejects those commands that cause a failure of Secure Messaging (FIA_UAU.6/PACE). Session keys are overwritten with zeroes after usage (FCS_CKM.4). 7.1.3 SS.ACC_CNTRL Storage and Access Control of Data Objects This security service meets the following SFRs: FDP_ACC.1/TRM, FDP_ACF.1/TRM, FAU_SAS.1, FDP_UCT.1/TRM, FDP_UIT.1/TRM, FMT_SMF.1, FMT_SMR.1/PACE, FMT_LIM.1, FMT_LIM.2, FMT_MTD.1/INI_ENA, Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 110 of 127 FMT_MTD.1/INI_DIS, FMT_MTD.1/CVCA_INI, FMT_MTD.1/CVCA_UPD, FMT_MTD.1/DATE, FMT_MTD.1/ADDTSF_WRITE, FMT_MTD.1/CAPK, FMT_MTD.1/KEY_READ, FMT_MTD.1/PA, FMT_MTD.1/AAPK, FDP_RIP.1 As required in FDP_ACF.1/TRM, read and write access to stored data must be controlled in different phases of the production and during operational use. This security service ensures that the assets (user data and TSF data) can only be accessed as defined by the access right written during the personalization process and allows the access to the TOE identification data in the Personalization phase. Furthermore, the access conditions allow to differentiate the roles based on the knowledge of secret keys. Any access not explicitly allowed is denied. The TOE identification data, the DF LDS and the Initialization key are written during the IC manufacturing by the IC Manufacturer. The OS configuration parameters are written during initialization by the Initialization Agent. The Document Basic Access Keys, the current date, the CVCA public key, the trustpoint, the EF.CVCA, the Document Number, the PACE key and the Security Environment object will be written during the personalization phase by the Personalization Agent. After keys have been written any type of direct access to any key is not allowed. In the operational phase access to initialization is denied. 7.1.4 SS.LFC_MNG Life cycle management This security service meets the following SFRs: FMT_MTD.1/LCS_UPDATE, FMT_SMF.1, FMT_SMR.1/PACE It ensures that the TOE life cycle status is set in an irreversible way to mark the transition to the operational use status. The only role allowed to set the life cycle status is the Personalization Agent. 7.1.5 SS.SW_INT_CHECK Software integrity check of TOE’s assets This security service meets the following SFRs: FMT_LIM.1, FMT_LIM.2, FPT_TST.1 The TOE doesn’t allow to analyze, debug or modify TOE’s software during the operational use. In phase 3 and 4 no commands are allowed to load executable code. Self tests are executed at initial start-up on ROM area (this functionality is implemented by the underlying hardware). This security service also checks the integrity of the following assets: • application files, • security data objects. Integrity checks will be executed before any use of TSF data. This SF warns the entity connected upon detection of an integrity error of the sensitive data stored within the TOE Scope of Control and preserves a secure state when failure is detected by TSF. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 111 of 127 7.1.6 SS.SF_HW Security features provided by the hardware This security service meets the following SFRs: FCS_RND.1, FMT_LIM.1, FMT_LIM.2, FPT_EMS.1, FPT_TST.1, FPT_FLS.1, FPT_PHP.3. The TOE benefits of a set of features provided by the integrated circuit to enforce security. The security features of the hardware platform are reported in[R1]. These security functions have already been evaluated and certified being the chip already certified; a more detailed formulation of the security functions provided by the chip can be found in the security target of the IC[R1]. 7.1.7 SS.SIG_VER Verification of digital signatures This security service meets the following SFRs: Terminal Autentication FCS_COP.1/SIG_VER, FMT_SMR.1/PACE, FMT_MTD.1/CVCA_INI, FMT_MTD.1/CVCA_UPD, FMT_MTD.1/DATE, FMT_MTD.3, FCS_COP.1/AA_SIG The signatures to be verified are based on (i) RSA according to PKCS#1 [R30] with key sizes up to 3072 bit or (ii) ECDSA with key sizes up to 256 (FCS_COP.1/SIG_VER). The signature verification is performed through the check of the certificate chain up to a trusted start point (a public key of the Country Verifying Certificate Authority, see FMT_MTD.3) and the current date handling (cf. [BSI, 2.2.4]). Once a signature is recognized as valid then security roles can be maintained according to FMT_SMR.1 and the CVCA certificate and the current date can be updated (FMT_MTD.1/CVCA_UPD, FMT_MTD.1/DATE). The validity of the certificate chain is proven at the TOE current date if and only if: i. the digital signature of the Inspection System Certificate, checked using the public key of the Document Verifier Certificate, is recognized as valid and the Inspection System Certificate is not expired ii. the digital signature of the Document Verifier Certificate, checked using the public key in the Certificate of the Country Verifying Certification Authority, is recognized as valid and the Document Verifier Certificate is not expired iii. the digital signature of the Certificate of the Country Verifying Certification Authority , checked using its own public key, is recognized as valid and certificate of the Country Verifying Certification Authority is not expired Active Authentication FCS_COP.1/AA_SIGN The Inspection system can have a proof of the TOE identity by verifying signatures based on the algorithm RSA with SHA-256 and cryptographic key sizes 1024 and 2048 bits that meet the following the Digital Signature Standards (complying with ISO/IEC 9796-2:2002 Digital Signature scheme 1 [R17]. Table 29 shows the coverage of SFR by the security services described above. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 112 of 127 Table 29 Coverage of SFRs by security services SS.AUTH_IDENT Agents Identification & Authentication SS.SEC_MSG Data exchange with Secure Messaging SS.ACC_CNTRL Access Control of Stored Data Object SS.LFC_MNG Life Cycle Management SS.SW_INT_CHECK SW Integrity check of TOE’s Assets SS.SF_HW Security features provided by the hardware SS.SIG_VER Verification of digital signatures FAU_SAS.1 X FCS_CKM.1/DH_PACE X FCS_CKM.1/CA X FCS_CKM.4 X X FCS_COP.1/PACE_ENC X FCS_COP.1/PACE_MAC X FCS_COP.1/CA_ENC X FCS_COP.1/CA_MAC X FCS_COP.1/SIG_VER X FCS_COP.1/AA_SIG X X FCS_RND.1 X FIA_AFL.1/PACE X FIA_UID.1/PACE X FIA_UAU.1/PACE X FIA_UAU.4/PACE X FIA_UAU.5/PACE X FIA_UAU.6/EAC X X FIA_UAU.6/PACE X X FIA_API.1/CA X FIA_API.1/AA X FDP_ACC.1/TRM X FDP_ACF.1/TRM X FDP_UCT.1/TRM X FDP_UIT.1/TRM X FDP_RIP.1 X X X FTP_ITC.1/PACE X FMT_SMF.1 X X FMT_SMR.1/PACE X X X FMT_LIM.1 X X X FMT_LIM.2 X X X FMT_MTD.1/INI_ENA X FMT_MTD.1/INI_DIS X FMT_MTD.1/CVCA_INI X X FMT_MTD.1/CVCA_UPD X X FMT_MTD.1/DATE X X FMT_MTD.1/ADDTSF_WRITE X FMT_MTD.1/LCS_UPDATE X Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 113 of 127 FMT_MTD.1/CAPK X FMT_MTD.1/KEY_READ X FMT_MTD.1/PA X FMT_MTD.1/AAPK X FMT_MTD.3 X FPT_EMS.1 X FPT_FLS.1 X FPT_TST.1 X X FPT_PHP.3 X 7.2 Assurance Measures Assurance measures applied to the TOE are fully compliant to those described in part 3 of the Common Criteria v3.1 [R12]. The implementation is based on a description of the security architecture of the TOE and on an semi-formal high-level and low-level design of the components of the TOE. The description is sufficient to generate the TOE without other design requirements. These documents, together with the source code of the software, address the ADV_ARC, ADV_FSP, ADV_TDS and ADV_IMP families. The configuration management plan addresses the ALC_CMC and ALC_CMS families and enforces good practices to securely manage configuration items including, but not limiting to, design documentation, user documentation, source code, test documentation and test data. The configuration management process guarantees the separation of the development configuration libraries from the configuration library containing the releases and also supports the generation of the TOE. All the configuration items are managed with the help of automated tools. In particular configuration items regarding security flaws are managed with the support of an issue tracking system, while all the other configuration items are managed with the help of a version control system. The software test process, addressing the class ATE, is machine-assisted to guarantee a repeatable error-free execution of the same test chains in both the system test and in the validation phases. A secure delivery of the TOE is guaranteed by the application of dedicated procedures. The prevention measures, the checks and all the actions to be performed at the developer’s site are described in the secure delivery procedure addressing the family ALC_DEL, while the security measures related to delivery to be applied at the user’s site are defined in the pre- personalization guidance. The latter document also addresses the family AGD_PRE. The necessary information for the document personalization is provided by a dedicated guidance and the information for its usage after delivery to the legitimate holder is provided by the guidance for the operational use. These documents address the AGD_OPE assurance family. To protect the confidentiality and integrity of the TOE design and implementation, the development and production environment and tools conform to the security policies defined in the documentation dedicated to the development security, which addresses the family ALC_DVS. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 114 of 127 The life-cycle model adopted in the manufacturing phases and the tools supporting the development and production of the TOE are described in a dedicated document addressing the assurance family ALC_LCD. Tools and techniques adopted in the development process are documented, thus addressing the assurance family ALC_TAT. An independent vulnerability analysis, meeting requirements of the family AVA_VAN, is conducted by a third party. Due to the composite nature of the evaluation, which is based on the CC evaluation of the hardware, the assurance measures related to the platform (IC) are covered by documents from the IC manufacturer. The security recommendations described in such documents have been taken into consideration. Table 30 shows the documentation that provides the necessary information related to the assurance requirements defined in this security target. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 115 of 127 Table 30 Assurance Requirements documentation Security Assurance Requirements Documentation ADV_ARC.1 Description of the Security Architecture of the ASapp-eID embedded software ADV_FSP.5 Functional Specification for the ASapp-eID embedded software ADV_IMP.1 Source code of the ASapp-eID embedded software ADV_INT.2 Rationale of the quality characteristics of ASapp-eID embedded software. ADV_TDS.4 Description of the Design of the ASapp-eID embedded software ADV_COMP.1 Rationale for Embedded Software Design Compliance concerning the composite evaluation of the ASapp-eID electronic document. AGD_OPE.1 Personalization Guidance for the ASapp-eID electronic document User Guidance for the ASapp-eID electronic document AGD_PRE.1 Pre-personalization guidance for the ASapp-eID electronic document. ALC_CMC.4, ALC_CMS.5 Configuration Management Plan, configuration list evidences of configuration management ALC_DEL.1 Secure Delivery procedure Delivery documentation ALC_DVS.2 Development security description Development security documentation ALC_LCD.1 Life-cycle definition ALC_TAT.2 Tools and techniques definition ATE_COV.2 Coverage of Test Analysis for the ASapp-eID Electronic Document ATE_DPT.3 Depth of Test Analysis for the ASapp-eID Electronic Document ATE_FUN.1 Functional Test Specification for the ASapp-eID Electronic Document Evidences of tests ATE_IND.2 Documentation related to an independent test. AVA_VAN.5 Documentation related to an independent vulnerability analysis. Assurance measures described in this section cover the assurance requirements in section 6.3.3. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 116 of 127 8. References 8.1 Abbreviations BAC Basic Access Control BIS Basic Inspection System CDS DS Public Key Certificate CBC Cipher-block Chaining (block cipher mode of operation) CC Common Criteria COM Common data group of the LDS (ICAO Doc 9303-10) CPU Central Processing Unit CSCA Country Signing Certification Authority CVCA Country Verifying Certification Authority DF Dedicated File (ISO 7816) DG Data Group (ICAO Doc 9303-10) DPA Differential Power Analysis DS Document Signer DV Document Verifier EAC Extended Access Control ECB Electronic Codebook (block cipher mode of operation) EEPROM Electrically Erasable Read Only Memory EF Elementary File (ISO 7816) EIS Extended Inspection System ESW Embedded Software GIS General Inspection System IC Integrated Circuit IS Inspection System LDS Logical Data Structure LCS Life Cycle Status MAC Message Authentication Code MF Master File (ISO 7816) MMU Memory Management Unit MRTD Machine Readable Travel Document MRZ Machine Readable Zone N/A Not Applicable n.a. Not Applicable OCR Optical Character Recognition OS Operating System OSP Organization Security Policy PACE Password Authenticated Connection Establishment PACE-GM PACE with Generic Mapping PP Protection Profile RAM Random Access Memory RNG Random Number Generator ROM Read Only Memory SAR Security Assurance Requirement SFP Security Function Policy SFR Security Functional Requirement SOD Document Security Object SOF Strength of Function SPA Simple Power Analysis Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 117 of 127 SSCD Secure Signature Creation Device ST Security Target 3DES Triple DES TOE Target of Evaluation TSC TOE Scope of Control TSF TOE Security Functions TR Technical Report VIZ Visual Inspection Zone 8.2 Glossary Active Authentication Security mechanism defined in ICAO Doc 9303-11 [R40] option by which means the MTRD’s chip proves and the inspection system verifies the identity and authenticity of the MTRD’s chip as part of a genuine e-Document issued by a known state or organization. application note Additional information that is considered relevant or useful for the construction, evaluation, or use of the TOE. audit records Write-only-once non-volatile memory area of the e- Documents chip to store the Initialization Data. authenticity Ability to confirm the e-Document and its data elements on the e-Document’s chip were created by the Issuing State or Organization. Basic Access Control Security mechanism defined by ICAO [R40] by which means the MTRD’s chip proves and the inspection system protect their communication by means of secure messaging with the Document BAC Keys. Basic Inspection System An inspection system which implements the terminals part of the BAC Mechanism and authenticates themselves to the e-Document’s chip using the Document BAC Keys derived from the printed MRZ data for reading the logical e-Document. biographical data The personalized details of the bearer of the document appearing as text in the Visual Inspection Zone (VIZ) and Machine Readble Zone (MRZ) on the biographical data page of a document book or card [R39]. biometric reference data Data stored for biometric authentication of the e- Document holder in the e-Document’s chip as (i) digital portrait and (ii) optional biometric reference data. Certificate chain Hierarchical sequence of Inspection System Certificate (lowest level), Document Verifier Certificate and Country Verifying Certification Authority Certificates (highest level), where the certificate of a lower level is signed with the private key corresponding to the public key in the certificate of the next higher level . The Country Verifying Certification Authority Certificate is signed with the private key corresponding to the public key it contains (self- signed certificate). Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 118 of 127 Chip Authentication Authentication protocol used to verify the genuinity of the e-Document chip. counterfeit An unauthorized copy or reproduction of a genuine security document made by whatever means. Country Signing Certification Authority (CSCA) Certification Authority of the Issuing State or Organization which attests the validity of certificates and digital signatures issued by the Document Signer. Country Signing Certification Authority Certificate (CCSCA) Certificate of the Country Signing Certification Authority Public Key (PKCSCA) issued by Country Signing Certification Authority stored in the inspection system. Country Verifying Certification Authority (CVCA) The country specific root of the PKI of Inspection Systems and creates the Document Verifier Certificates within this PKI. It enforces the Privacy policy of the issuing Country or Organization in respect to the protection of sensitive biometric reference data stored in the e-Document. Current Date The maximum of the effective dates of valid CVCA, DV and domestic Inspection System certificates known to the TOE. It is used the validate card verifiable certificates. CVCA link Certificate Certificate of the new public key of the Country Verifying Certification Authority signed with the old public key of the Country Verifying Certification Authority where the certificate effective date for the new keys is before the certificate expiration date of the certificate for the old key. Document Basic Access Keys Pair of symmetric 3DES keys used for secure messaging with encryption and message authentication of data transmitted between the e-Document’s chip and the inspection system [R40]. It is derived from the printed MRZ of the document book to authenticate an entity able to read the printed MRZ of the document book. Document Security Object A RFC3369 CMS Signed Data Structure, signed by the Document Signer. It carries the hash values of the LDS DG’s and is stored in the e-Document’s chip. It may carry the Document Signer Certificate (CDS) [R40]. Document Signer Entity delegated by the Issuing State or Organization to digitally sign the DG’s present in the LDS. eavesdropper A threat agent with low attack potential reading the communication between the e-Document’s chip and the inspection system to gain the data on the e-Document’s chip. e-Document A document or other official document of identity issued by a State or organization, which may be used by the rightful holder. e-Document applet It includes: i. the file structure implementing the LDS [R39], ii. the definition of the User Data, but does not include the User Data itself (i.e. content of EF.DG1 to EF.DG14 and EF.DG 16) and Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 119 of 127 iii. the TSF Data including the definition the authentication data but except the authentication data itself. e-Document Basic Access Control Mutual authentication protocol followed by secure messaging between the inspection system and the e- Document’s chip based on MRZ information as a key seed and access condition to data stored on e- Document’s chip according to LDS. e-Document holder The rightful holder of the e-Document for whom the issuing State or Organization personalized the e- Document. e-Document’s chip An integrated circuit chip complying with ISO/IEC 14443 (contactless interface) and/or ISO/IEC 7816-2 (contact interface) and programmed according to the LDS [R39]. e-Document’s chip Embedded Software Software embedded in an e-Document’s chip and not being developed by the IC Designer. The e-Document’s chip Embedded Software is designed in phase 1 and embedded into the e-Document’s chip in Phase 2 of the TOE life-cycle. enrolment The process of collecting biometric samples from a person and the subsequent preparation and storage of biometric reference templates representing that person's identity [R39]. Extended Access Control Security mechanism identified in BSI TR-03110 [R8] by which means the MTRD’s chip (i) verifies the authentication of the inspection systems authorized to read the optional biometric reference data, (ii) controls the access to the optional biometric reference data and (iii) protects the confidentiality and integrity of the optional biometric reference data during their transmission to the inspection system by secure messaging. The Personalization Agent may use the same mechanism to authenticate themselves with Personalization Agent Authentication Private Keys and to get write and read access to the logical e-Document and TSF data. Extended Inspection System A role of a terminal as part of an inspection system which is in addition to the BIS authorized by the Issuing State or Organization to read the optional biometric reference data and supports the terminals part of the Extended Access Control Authentication Mechanism. Forgery Fraudulent alteration of any part of the genuine document, e.g. changes to the biographical data or the portrait [R39]. General Inspection System A Basic Inspection System which implements sensitively the Chip Authentication Mechanism. Global interoperability The capability of inspection systems (either manual or automated) in different States throughout the world to exchange data, to process data received from systems in other States, and to utilize that data in inspection operations in their respective States. Global Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 120 of 127 interoperability is a major objective of the standardized specifications for placement of both eye-readable and machine readable data in all e-Documents. IC Initialization Data Any data defined by the TOE Manufacturer and injected into the non-volatile memory by the Integrated Circuits manufacturer (Phase 2) in Step 3 IC Manufacturing. impostor A person who applies for and obtains a document by assuming a false name and identity, or a person who alters his or her physical appearance to represent himself or herself as another person for the purpose of using that person’s document. Initialization Agent The agent who initializes the e-Document by writing Initialization Data. This Agent is the IC Manufacturer Initialization Data Any data defined by the TOE Manufacturer and injected into the non-volatile memory by the Integrated Circuits Manufacturer . These data are, for instance, used for OS configuration, for traceability and for IC identification as e- Document’s material (IC identification data). Inspection The act of a State examining an e-Document presented to it by a user (the e-Document holder) and verifying its authenticity. Inspection System A technical system used by the border control officer of the receiving State (i) examining an e-Document presented by the user and verifying its authenticity and (ii) verifying the user as e-Document holder. Integrated Circuit Electronic component(s) designed to perform processing and/or memory functions. The e-Document’s chip is an integrated circuit. integrity Ability to confirm the e-Document and its data elements on the e-Document’s chip have not been altered from that created by the Issuing State or Organization Issuing Organization Organization authorized to issue an official e-Document (e.g. the United Nations Organization, issuer of the document). Issuing State The Country issuing the e-Document. Logical Data Structure The collection of groupings of DG’s stored in the optional capacity expansion technology [R39]. The capacity expansion technology used is the e-Document’s chip. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 121 of 127 Logical e-Document Data of the e-Document holder stored according to the LDS [R40] as specified by ICAO on the IC. It presents contact or contactless readable data including (but not limited to): i. personal data of the e-Document holder ii. the digital Machine Readable Zone Data (digital MRZ data, EF.DG1), iii. the digitized portraits (EF.DG2), iv. the biometric reference data of finger(s) (EF.DG3) or iris image(s) (EF.DG4) or both and v. the other data according to LDS (EF.DG5 to EF.DG16). Machine Readable Electronic Document Official document issued by a State or Organization which is used by the holder for various purposes (e.g. travel document, visa, official document of identity) and which contains mandatory visual (eye readable) data and a separate mandatory data summary, intended for global use, reflecting essential data elements capable of being machine read [R10] [R40]. Machine Readable Zone Fixed dimensional area located on the front of the e- Document Data Page or, in the case of the TD1, the back of the e-Document, containing mandatory and optional data for machine reading using OCR methods [R39]. machine-verifiable biometrics feature A unique physical personal identification feature (e.g. an iris pattern, fingerprint or facial characteristics) stored on a e-Document in a form that can be read and verified by machine. Optional biometric reference data Data stored for biometric authentication of the e- Document holder in the e-Document’s chip as (i) encoded finger image(s) (EF.DG3) or (ii) encoded iris image(s) (EF.DG4) or (iii) both. Note that the European commission decided to use only finger print and not to use iris images as optional biometric reference data. Passive Authentication Passive Authentication is a mechanism that ensures the authenticity of the DG’s present in the LDS by: i. the verification of the digital signature of the SOD and ii. comparing the hash values of the read LDS data fields with the hash values contained in the SOD. Personalization The process by which the portrait, signature and biographical data are applied to the document [R39]. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 122 of 127 Personalization Agent The agent delegated by the Issuing State or Organization to personalize the e-Document for the holder by i. establishing the identity the holder for the biographic data in the e-Document, ii. enrolling the biometric reference data of the e- Document holder i.e. the portrait, the encoded finger image(s) or the encoded iris image(s) and iii. writing these data on the physical and logical e- Document for the holder. Personalization Agent Authentication Information TSF data used for authentication proof and verification of the Personalization Agent. Physical e-Document e-Document in the form of paper, plastic and chip using secure printing to present data including (but not limited to): i. biographical data, ii. data of the MRZ, iii. photographic image and iv. other data. presenter A person presenting the e-Document to the inspection system and claiming the identity of the e-Document holder. Primary Inspection System An inspection system that contains a terminal for the contact or contactless communication with the e- Document’s chip and does not implement the terminals part of the Basic Access Control Mechanism. Receiving State The Country to which the e-Document holder is applying for entry [R41]. reference data Data enrolled for a known identity and used by the verifier to check the verification data provided by an entity to prove this identity in an authentication attempt. secure messaging Secure messaging using encryption and message authentication code according to ISO/IEC 7816-4 [R40]. skimming Imitation of the inspection system to read the logical e- Document or parts of it via the contact or contactless communication channel of the TOE without knowledge of the printed MRZ data. TOE Initialization Data Any data defined by the TOE Manufacturer and injected into the non-volatile memory by the Integrated Circuits manufacturer in Step 3. TSF data Data created by and for the TOE, that might affect the operation of the TOE [R10]. Unpersonalized e-Document e-Document material prepared to produce an personalized e-Document containing an initialized e- Document’s chip. User data Data created by and for the user, that does not affect the operation of the TSF [R10]. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 123 of 127 Verification The process of comparing a submitted biometric sample against the biometric reference template of a single enrollee whose identity is being claimed, to determine whether it matches the enrollee’s template [R40]. Verification data Data provided by an entity in an authentication attempt to prove their identity to the verifier. The verifier checks whether the verification data match the reference data known for the claimed identity. 8.3 Technical References [R1] NXP: JCOP 3 SECID P60 (OSA) PL2/5 Security Target lite, Rev. 1.6 – 2016-12- 20, NSCIB-CC-16-99111 [R2] TUV Rheinland Nederland B.V.: JCOP 3 SECID P60 (OSA) PL2/5 , certification report, 2016-12-21, NSCIB-CC-16-99111CR2 [R3] BSI: Functionality classes and evaluation methodology for physical random number generators, AIS31, Version 1, 25.9.2001 [R4] BSI: Security IC Platform Protection Profile version 1.0 15 June, 2007; registered and certified by Bundesamt für Sicherheit in der Informationstechnik (BSI) under the reference BSI-PP-0035 [R5] BSI: Common Criteria Protection Profile Machine Readable Travel Document with „ICAO Application ", Basic Access Control, Version 1.10, 25th March 2009, BSI-CC- PP-0055. [R6] BSI: Common Criteria Protection Profile Machine Readable Travel Document with „ICAO Application ", Extended Access Control with PACE, Version 1.3.2, 5th December 2012, BSI-CC-PP-0056-V2-2012. Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 124 of 127 [R7] BSI: Common Criteria Protection Profile Machine Readable Travel Document using Standard Inspection Procedure with PACE (PACE PP), Version 1.0, 2nd November 2011, BSI-CC-PP-0068-V2-2011. [R8] BSI: Technical Guideline TR-03110 Advanced Security Mechanisms for Machine Readable Travel Documents, parts 1-2-3, version 2.10, 20. March 2012 [R9] BSI: Technical Guideline TR-03111 Elliptic Curve Cryptography, TR-03111, version 1.11, 17 April 2012 [R10] CCRA: Common Criteria for Information Technology Security Evaluation, Part 1: Introduction and general model, September 2012, version 3.1 rev.4, CCMB-2012-09- 001 [R11] CCRA: Common Criteria for Information Technology Security Evaluation, Part 2: Security Functional Components, September 2012, version 3.1 rev.4, CCMB-2012- 09-002 [R12] CCRA: Common Criteria for Information Technology Security Evaluation, Part 3: Security Assurance Components, September 2012, version 3.1 rev 4, CCMB-2012- 09-003 [R13] EMV CPS: EMV Card Personalization Specification – version 1.0, June 2003 [R14] Arjo Systems: Security Target ASapp-eID Machine Readable Electronic Document, Basic Access Control, ref. TCAE160088, version 7. [R15] IETF Network Working Group: Request For Comments 2119, Key words for use in RFCs to Indicate Requirement Levels, March 1997. [R16] ISO/IEC: International Standard 7816-4 2005 Information Technology – Integrated circuit(s) cards with contacts – Part 4: Interindustry commands for interchange – January 15, 2005 [R17] ISO/IEC: International Standard 9796-2:2002 Information Technology – Security Techniques – Digital signature schemes giving message recovery – Part 2: Integer factorization based mechanism, Second edition 2002-10-01 [R18] ISO/IEC: International Standard 9797-1 1999 Information Technology – Security Techniques – Message Authentication Codes – Part 1: Mechanisms using a block cipher, 1999 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 125 of 127 [R19] ISO/IEC: International Standard 14443-1 - Identification cards – Contactless Integrated circuit cards – Proximity cards. Part 1: Physical characteristics. [R20] ISO/IEC: International Standard 14443-2 - Identification cards – Contactless Integrated circuit cards – Proximity cards. Part 2: Radio frequency interface power and signal interface. [R21] ISO/IEC: International Standard 14443-3 - Identification cards – Contactless Integrated circuit cards – Proximity cards. Part 3: Initialization and anticollision. [R22] ISO/IEC: International Standard 14443-4 - Identification cards – Contactless Integrated circuit cards – Proximity cards. Part 4: Transmission protocol. [R23] JIL: Joint Interpretation Library, Composite product evaluation for Smart Cards and similar devices, version 1.2, January 2012. [R24] NIST: Federal Information Processing Standards Publication FIPS PUB 46-3, DATA ENCRYPTION STANDARD (DES), Reaffirmed 1999 October 25, U.S. DEPARTMENT OF COMMERCE/National Institute of Standards and Technology [R25] NIST: Federal Information Processing Standards Publication FIPS PUB 186-2, DIGITAL SIGNATURE STANDARD (DSS), U.S. DEPARTMENT OF COMMERCE/National Institute of Standards and Technology, January 2000 [R26] NIST: Federal Information Processing Standards Publication FIPS PUB 180-2, SECURE HASH STANDARD, U.S. DEPARTMENT OF COMMERCE/National Institute of Standards and Technology – 2002 August 1 [R27] NIST: Special pubblication 800-38B, Recommendation for block cipher modes of operation, The CMAC mode for authentication, 2005 [R28] NIST: Federal Information Processing Standards Publication FIPS PUB 46-3, Data Encryption Standard (DES), 1999 [R29] NIST: Federal Information Processing Standards Publication FIPS PUB 197, Specification fot the Advanced Encryption Standard (AES), 2001 Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 126 of 127 [R30] RSA Laboratories: PKCS#1 – RSA cryptography standard, An RSA Laboratories Technical Note, version 2.1 June 2002. [R31] RSA Laboratories: PKCS #3 - Diffie-Hellman Key-Agreement Standard, An RSA Laboratories Technical Note, version 1.4 November 1993. [R32] RSA Laboratories: PKCS #15 v1.1: Cryptographic Token Information Syntax Standard [R33] Arjo Systems: Initialization Guidance for ASapp-eID Machine Readable Electronic Document, ref. TCAE160083 [R34] Arjo Systems: Personalization Guidance for ASapp-eID Machine Readable Electronic Document ICAO Application, ref. TCAE160084 [R35] Arjo Systems: Operational User Guidance for ASapp-eID Machine Readable Electronic Document SSCD Application, ref. TCAE160075 [R36] ISO/IEC: International Standard 10116:2006 – Information technology – Security techniques – Modes of operation for a n-bit block cipher, third edition 2006-02-01 [R37] ISO/IEC: International Standard 7816-2:2007 Identification cards - Integrated circuit cards – Part 2: Cards with contacts – Dimension and location of the contacts [R38] EuroSmart: Security IC Platform Protection Profile with Augmentation Packages version 1.0, ref. BSI-CC-PP-0084-2014, 13 01 2014 [R39] ICAO: Doc 9303 Machine Readable Travel Documents, Seventh Edition, 2015, Part 10: Logical Data Structure (LDS) for Storage of Biometrics and Other Data in the Contactless Integrated Circuit (IC) [R40] ICAO: Doc 9303 Machine Readable Travel Documents, Seventh Edition, 2015, Part 11: Security Mechanisms for MRTDs [R41] ICAO: Doc 9303 Machine Readable Travel Documents, Seventh Edition, 2015, Part 12: Public Key Infrastructure for MRTDs Security Target Lite – ASapp-eID (EAC-PACE-AA) ASE Version: 1 Date: 2017-08-15 Reference: TCLE160092 page 127 of 127 Appendix A Platform JCOP3 This section provides a statement of compatibility between this security target (Composite- ST) and the platform JCOP3 security target (Platform-ST) [R1]. In some detail, they identify the elements of the Platform-ST being relevant for the composite TOE, map such elements to the corresponding ones of the Composite-ST, and provide a rationale for this mapping. A.1 Platform Identification The platform on which the TOE is based is a secure microcontroller P6022J-VB equipped with a multi-applications operating system Java Card 3.0.4, Software for implementing cryptographic operations on the Micro Controller (called Crypto Lib) and Software for implementing content management according to GlobalPlatform. This platform received a Common Criteria certification at the EAL5 assurance level augmented by AVA_VAN.5, ALC_DVS.2, ASE_TSS.2 and ALC_FLR.1 [R1][R2] with certification ID: CC-16-99111-CR2 The platform’s certificate is valid and up-to-date. A.2 IC Developer Identification The developer of the P6022J VB IC is NXP. A.3 IC Manufacturer Identification The manufacturer of the P6022J VBchip is NXP. A.4 Operating System Developer Identification The developer of the multi-applications operating system JCOP 3 implementing Java Card 3.0.4 is NXP. END OF DOCUMENT