Cryptographic Key Generation (Bluetooth)

FCS_CKM_EXT.7 Extended: Bluetooth Key Generation

FCS_CKM_EXT.7.1 The TSF shall randomly generate public/private ECDH key pairs every [assignment: frequency of and/or criteria for new key pair generation].

Application Note: There are likely multiple acceptable ways of keeping ECDH key pairs adequately fresh, including a time-based approach such that the same key pairs will not be used for more than, for instance, 24 hours. Alternatively, the criteria might be linked to the number of passed or failed authentication attempts. As a starting point to determine reasonable authentication attempt-based replacement criteria, note that the Bluetooth specification (v4.1, Vol. 2, 5.1) suggests mitigating repeated authentication attempts by changing a device’s private key after three failed authentication attempts from any BD_ADDR, after ten successful pairings from any BD_ADDR, or after a combination of these such that any three successful pairings count as one failed pairing.

This requirement will be moved to Section 5 and will be mandatory for products entering into evaluation after Quarter 3, 2015.

Assurance Activity:

The evaluator shall ensure that the TSS describes the criteria used to determine the frequency of generating new ECDH public/private key pairs. In particular, the evaluator shall ensure that the implementation does not permit the use of static ECDH key pairs.

The evaluator shall perform the following test:

Test 1: The evaluator shall perform the following steps:

Step 1 - Pair the TOE to a remote Bluetooth device and record the public key currently in use by the TOE. (This public key can be obtained using a Bluetooth protocol analyzer to inspect packets exchanged during paring.)

Step 2 - Perform necessary actions to generate new ECDH public/private key pairs. (Note that this test step depends on how the TSS describes the criteria used to determine the frequency of generating new ECDH public/private key pairs.)

Step 3 - Pair the TOE to a remote Bluetooth device and again record the public key currently in use by the TOE.

Step 4 - Verify that the public key in Step 1 differs from the public key in Step 3.

D.2.2 Random Bit Generation (FCS_RBG)

FCS_RBG_EXT.1 Extended: Cryptographic Operation (Random Bit Generation)

FCS_RBG_EXT.1.4 The TSF shall allow applications to add data to the deterministic RBG using the Personalization String as defined in SP 800-90A.

Application Note: As specified in SP 800-90A the TSF shall not count data input from an application towards the entropy required by FCS_RBG_EXT.1. Thus, the TSF shall not allow the only input to the RBG seed to be from an application.

Assurance Activity: The evaluator shall verify that this function is included as an interface to the RBG in the documentation required by Appendix E and that the behaviour of the RBG following a call to this interface is described. The evaluator shall also verify that the documentation of the RBG describes the conditions of use and possible values for the

Personalization String input to the SP 800-90A specified DRBG. The evaluator shall also perform the following test.

Test 1: The evaluator shall write, or the developer shall provide, an application that adds data to the RBG via the Personalization String. The evaluator shall verify that the request succeeds.

FCS_RBG_EXT.1.5 The TSF shall save the state of the deterministic RBG at power-off, and shall use this state as input to the deterministic RBG at startup.

Application Note: The capability to add the state saved at power-off as input to the RBG prevents an RBG that is slow to gather entropy from producing the same output regularly and across reboots. Since there is no guarantee of the protections provided when the state is stored (or a requirement for any such protection), it is assumed that the state is 'known', and therefore cannot contribute entropy to the RBG, but can introduce enough variation that the initial RBG values are not predictable and exploitable.

Assurance Activity:

The assurance activity for this requirement is captured in the RBG documentation for Appendix E. The evaluator shall verify that the documentation describes how the state is generated so as to be available for the next startup, how the state is used as input to the DRBG, and any protection measures used for the state while the TOE is powered off.

D.2.3 Cryptographic Algorithm Services (FCS_SRV)

FCS_SRV_EXT.1 Extended: Cryptographic Algorithm Services

FCS_SRV_EXT.1.2 The TSF shall provide a mechanism for applications to request the TSF to perform the following cryptographic operations:

 Algorithms in FCS_COP.1(1)

 Algorithms in FCS_COP.1(3) by keys stored in the secure key storage.

Application Note: In the future, the TOE will not be permitted to transmit plaintext key material beyond the TOE, including to applications running on the TOE. The TOE will, therefore, be required to perform cryptographic operations on behalf of applications using the keys stored in the TOE’s secure key storage.

Assurance Activity:

The evaluator shall verify that the API documentation for the secure key storage includes the cryptographic operations by the stored keys.

The evaluator shall write, or the developer shall provide access to, an application that requests cryptographic operations of stored keys by the TSF. The evaluator shall verify that the results from the operation match the expected results according to the API documentation.

The evaluator shall use these APIs to test the functionality of the secure key storage according to the Assurance Activities in FCS_STG_EXT.1.

D.2.4 TLS Client Protocol (FCS_TLSC) D.2.4.1 EAP-TLS Client Protocol

FCS_TLSC_EXT.1 Extended: EAP-TLS Protocol

FCS_TLSC_EXT.1.6 The TSF shall present the signature_algorithms extension in the Client Hello with the supported_signature_algorithms value containing the following hash algorithms: [selection: SHA256, SHA384, SHA512] and no other hash algorithms.

Application Note: This requirement limits the hashing algorithms supported for the purpose of digital signature verification by the client and limits the server to the supported hashes for the purpose of digital signature generation by the server. The signature_algorithm extension is only supported by TLS 1.2.

Support for the signature_algorithms extension will be required for products entering into evaluation after Quarter 3, 2015.

Assurance Activity:

The evaluator shall verify that TSS describes the signature_algorithm extension and whether the required behavior is performed by default or may be configured. If the TSS indicates that the signature_algorithm extension must be configured to meet the requirement, the evaluator shall verify that AGD guidance includes configuration of the signature_algorithm extension.

The evaluator shall also perform the following test:

 Test: The evaluator shall configure the server to send a certificate in the TLS

connection that is not supported according to the Client’s HashAlgorithm enumeration within the signature_algorithms extension (for example, send a certificate with a SHA-1 signature). The evaluator shall verify that the TOE disconnects after receiving the server’s Certificate handshake message.

FCS_TLSC_EXT.1.7 The TSF shall support secure renegotiation through use of the

“renegotiation_info” TLS extension in accordance with RFC 5746.

FCS_TLSC_EXT.1.8 The TSF shall include [selection: choose only one of:

renegotiation_info extension, TLS_EMPTY_RENEGOTIATION_INFO_SCSV ciphersuite] in the ClientHello message.

Application Note: RFC 5746 defines an extension to TLS that binds renegotiation handshakes to the cryptography in the original handshake.

The ciphersuite included in the selection is a means for clients to be compatible with servers that don’t support the extension. It is recommended that client implementations support both the ciphersuite and the extension.

Assurance Activity:

The evaluator shall perform the following tests:

Test 1: The evaluator shall use a network packet analyzer/sniffer to capture the traffic between the two TLS endpoints. The evaluator shall verify that either the

“renegotiation_info” field or the SCSV ciphersuite is included in the ClientHello packet during the initial handshake.

Test 2: The evaluator shall verify the Client’s handling of ServerHello messages received during the initial handshake that include the “renegotiation_info” extension. The evaluator shall modify the length portion of this field in the ServerHello message to be non-zero and verify that the client sends a failure and terminates the connection. The evaluator shall verify that a properly formatted field results in a successful TLS connection.

Test 3: The evaluator shall verify that ServerHello messages received during secure renegotiation contain the “renegotiation_info” extension. The evaluator shall modify either the “client_verify_data” or “server_verify_data” value and verify that the client terminates the connection.

D.2.4.2 TLS Client Protocol

FCS_TLSC_EXT.2 Extended: TLS Protocol

FCS_TLSC_EXT.2.6 The TSF shall present the signature_algorithms extension in the Client Hello with the supported_signature_algorithms value containing the following hash algorithms: [selection: SHA256, SHA384, SHA512] and no other hash algorithms.

Application Note: This requirement limits the hashing algorithms supported for the purpose of digital signature verification by the client and limits the server to the supported hashes for the purpose of digital signature generation by the server. The signature_algorithm extension is only supported by TLS 1.2.

Support for the signature_algorithms extension will be required for products entering into evaluation after Quarter 3, 2015.

Assurance Activity:

The evaluator shall verify that TSS describes the signature_algorithm extension and whether the required behavior is performed by default or may be configured. If the TSS indicates that the signature_algorithm extension must be configured to meet the requirement, the evaluator shall verify that AGD guidance includes configuration of the signature_algorithm extension.

The evaluator shall also perform the following test:

 Test: The evaluator shall configure the server to send a certificate in the TLS

connection that is not supported according to the Client’s HashAlgorithm enumeration within the signature_algorithms extension (for example, send a certificate with a SHA-1 signature). The evaluator shall verify that the TOE disconnects after receiving the server’s Certificate handshake message.

FCS_TLSC_EXT.2.7 The TSF shall support secure renegotiation through use of the

“renegotiation_info” TLS extension in accordance with RFC 5746.

FCS_TLSC_EXT.2.8 The TSF shall include [selection: choose only one of:

renegotiation_info extension, TLS_EMPTY_RENEGOTIATION_INFO_SCSV ciphersuite] in the ClientHello message.

Application Note: RFC 5746 defines an extension to TLS that binds renegotiation handshakes to the cryptography in the original handshake.

The ciphersuite included in the selection is a means for clients to be compatible with servers that don’t support the extension. It is recommended that client implementations support both the ciphersuite and the extension.

Assurance Activity:

The evaluator shall perform the following tests:

Test 1: The evaluator shall use a network packet analyzer/sniffer to capture the traffic between the two TLS endpoints. The evaluator shall verify that either the

“renegotiation_info” field or the SCSV ciphersuite is included in the ClientHello packet during the initial handshake.

Test 2: The evaluator shall verify the Client’s handling of ServerHello messages received during the initial handshake that include the “renegotiation_info” extension. The evaluator shall modify the length portion of this field in the ServerHello message to be non-zero and verify that the client sends a failure and terminates the connection. The evaluator shall verify that a properly formatted field results in a successful TLS connection.

Test 3: The evaluator shall verify that ServerHello messages received during secure renegotiation contain the “renegotiation_info” extension. The evaluator shall modify either the “client_verify_data” or “server_verify_data” value and verify that the client terminates the connection.

D.3 Class: User Data Protection (FDP)

D.3.1 Access Control (FDP_ACF)

FDP_ACF_EXT.1 Extended: Security attribute based access control

FDP_ACF_EXT.1.3 The TSF shall enforce an access control policy that prohibits an application from granting both write and execute permission to a file on the device.

Assurance Activity:

Assurance Activity Note: The following tests require the developer to provide access to a test platform that provides the evaluator with tools that are typically not found on consumer Mobile Device products.

Test 1: The evaluator shall write, or the developer shall provide, an application which attempts to store a file with both write and execute permissions. The evaluator shall verify that this action fails and that the permissions on the file are not simultaneously write and execute.

Test 2: The evaluator shall traverse the file system examining the permission on each TSF file to verify that no file has both write and execute permissions set.