SIST EN 419251-2:2013

Security requirements for device for authentication - Part 2: Protection profile for extension for trusted channel to certificate generation application

This European Standard is a Protection Profile that defines the security requirements for an authentication device.

Sicherheitsanforderungen für Geräte zur Authentifizierung - Teil 2: Schutzprofil für Erweiterung für vertrauenswürdigen Kanal zur zertifizierung von Generierungsanwendungen

Diese Europäische Norm ist ein Schutzprofil, das die Sicherheitsanforderungen an ein Gerät zur Authentisierung definiert.

Profils de protection pour dispositif d'authentification - Partie 2: Dispositf avec import de clé, génération de clé et administration; Communication sécurisée vers l'application de génération de certificats et l'application d'administration

Le présent document est un Profil de Protection qui définit les exigences de sécurité pour un dispositif
d’authentification.

Varnostne zahteve naprav za overjanje - 2. del: Profil zaščite za razširitev zaupnega kanala za aplikacijo, ki generira certifikat

Ta evropski standard je profil za zaščito, ki določa varnostne zahteve naprav za overjanje.

General Information

• Status: Published
• Public Enquiry End Date: 31-Jul-2011
• Publication Date: 14-Apr-2013
• ICS: 35.240.15 - Identification cards. Chip cards. Biometrics
• Technical Committee: ITC - Information technology
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 20-Mar-2013
• Due Date: 25-May-2013
• Completion Date: 15-Apr-2013
• Ref Project: EN 419251-2:2013 - Security requirements for device for authentication - Part 2: Protection profile for extension for trusted channel to certificate generation application

Standards Content (Sample)

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Sicherheitsanforderungen für
Geräte zur Authentifizierung - Teil 2: Schutzprofil für Erweiterung für vertrauenswürdigen Kanal zur zertifizierung von GenerierungsanwendungenProfils de protection pour dispositif d'authentification - Partie 2: Dispositf avec import de clé, génération de clé et administration; Communication sécurisée vers l'application de génération de certificats et l'application d'administrationSecurity requirements for device for authentication - Part 2: Protection profile for extension for trusted channel to certificate generation application35.240.15Identifikacijske kartice in sorodne napraveIdentification cards and related devicesICS:Ta slovenski standard je istoveten z:EN 419251-2:2013SIST EN 419251-2:2013en01-maj-2013SIST EN 419251-2:2013SLOVENSKI
STANDARD



SIST EN 419251-2:2013



EUROPEAN STANDARD NORME EUROPÉENNE EUROPÄISCHE NORM
EN 419251-2
March 2013 ICS 35.240.15 English Version
Security requirements for device for authentication - Part 2: Protection profile for extension for trusted channel to certificate generation application
Profils de protection pour dispositif d'authentification - Partie 2: Dispositf avec import de clé, génération de clé et administration; Communication sécurisée vers l'application de génération de certificats et l'application d'administration Sicherheitsanforderungen für Geräte zur Authentisierung - Teil 2: Schutzprofil für Erweiterung für vertrauenswürdigen Kanal zur Zertifikaterzeugungsanwendung This European Standard was approved by CEN on 7 December 2012.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION EUROPÄISCHES KOMITEE FÜR NORMUNG
Management Centre:
Avenue Marnix 17,
B-1000 Brussels © 2013 CEN All rights of exploitation in any form and by any means reserved worldwide for CEN national Members. Ref. No. EN 419251-2:2013: ESIST EN 419251-2:2013



EN 419251-2:2013 (E) 2 Contents Page Foreword . 5 1 Scope . 6 2 Normative references . 6 3 Conformance . 6 3.1 CC Conformance Claim . 6 3.2 PP Claim . 6 3.3 Package Claim . 6 3.4 Conformance Rationale . 6 3.5 Conformance Statement . 6 4 Terms and definitions . 7 5 Symbols and abbreviations . 9 6 Overview of the target of evaluation . 9 6.1 TOE Type . 9 6.2 TOE Usage . 9 6.3 Security Features of the TOE . 9 6.4 Examples of applications. 11 6.4.1 E-government . 11 6.4.2 Multiple applications . 11 6.5 Required non-TOE Hardware and Software . 12 6.6 Protection Profile Usage . 12 7 TOE Environment . 13 7.1 Overall view . 13 7.2 Personalisation application . 14 7.2.1 General . 14 7.2.2 Functionalities . 14 7.2.3 Communication . 14 7.3 Administration application . 15 7.3.1 General . 15 7.3.2 Functionalities . 15 7.3.3 Communication . 15 7.4 Authentication application . 16 7.4.1 General . 16 7.4.2 Functionalities . 16 7.4.3 Communication . 16 7.5 Verifier . 17 7.5.1 Functionalities . 17 7.5.2 Communication . 17 7.6 Key Generator . 17 7.6.1 Functionalities . 17 7.6.2 Communication . 17 7.7 Certification Authority . 18 7.7.1 Functionalities . 18 7.7.2 Communication . 18 8 Life Cycle . 19 8.1 Overview . 19 8.2 Pre-Personalisation phase . 20 8.3 Personalisation phase . 20 8.3.1 General . 20 SIST EN 419251-2:2013



EN 419251-2:2013 (E) 3 8.3.2 Personalisation application . 21 8.4 Usage phase . 21 8.4.1 Authentication application . 21 8.4.2 Administration application . 22 8.4.3 Verifier . 23 9 Security problem definition . 23 9.1 Assets . 23 9.1.1 General . 23 9.1.2 Assets protected by the TOE . 23 9.1.3 Sensitive assets of the TOE . 23 9.2 Users . 24 9.3 Threats . 25 9.4 Organisational security policies . 27 9.4.1 Provided services . 27 9.4.2 Other services . 27 9.5 Assumptions . 28 10 Security objectives . 29 10.1 General . 29 10.2 Security objectives for the TOE . 29 10.2.1 Provided service . 29 10.2.2 Authentication to the TOE . 29 10.2.3 TOE management . 30 10.3 Security objectives for the operational environment. 31 10.4 Rationale for Security objectives . 33 11 Extended component definition – Definition of the Family FCS_RNG . 38 12 Security requirements . 39 12.1 General . 39 12.2 Introduction . 40 12.2.1 Subjects Objects and security attributes . 40 12.2.2 Operations . 40 12.3 Security functional requirements . 41 12.3.1 General . 41 12.3.2 Core . 41 12.3.3 KeyImp . 49 12.3.4 KeyGen . 52 12.3.5 Admin . 55 12.3.6 Untrusted CA . 59 12.3.7 Untrusted AdminAppli . 60 12.4 Security assurance requirements . 61 12.5 SFR / Security objectives . 61 12.6 SFR Dependencies . 67 12.7 Rationale for the Assurance Requirements . 69 Bibliography . 70 Index . 71
Figures Figure 1 — TOE Security Features . 13 Figure 2 — Personalisation application environment . 14 Figure 3 — Administration application environment . 15 Figure 4 — Authentication application environment . 16 Figure 5 — TOE Life Cycle . 19 SIST EN 419251-2:2013



EN 419251-2:2013 (E) 4 Tables Table 1 — protection of sensitive data . 29 Table 2 — Security objectives vs problem definition rationale . 34 Table 3 — Security attributes . 40 Table 4 — Core security attributes . 44 Table 5 — Core operations . 44 Table 6 — Core security attributes - operation. 46 Table 7 — Core security attributes - initial value . 46 Table 8 — Core security attributes – updates . 47 Table 9 — TSF data – updates . 47 Table 10 — KeyImp security attributes . 49 Table 11 — KeyImp security attributes - operations . 50 Table 12 — KeyImp security attributes – update authorised roles . 51 Table 13 — KeyImp security attributes – update values . 52 Table 14 — KeyGen operations . 53 Table 15 — KeyGen security attributes . 53 Table 16 — KeyGen operation rules . 54 Table 17 — KeyGen security attributes – update authorised roles . 54 Table 18 — KeyGen security attributes – initial values . 55 Table 19 — KeyGen security attributes – update values . 55 Table 20 — Admin security attributes – update authorised roles . 58 Table 21 — Admin security attributes – initial values . 58 Table 22 — Admin security attributes – update values . 58 Table 23 — Admin TSF data – operations . 59 Table 24 — SFR vs Security objectives rationale . 62 Table 25 — SFR dependencies . 67
SIST EN 419251-2:2013



EN 419251-2:2013 (E) 5 Foreword This document (EN 419251-2:2013) has been prepared by Technical Committee CEN/TC 224 “Personal identification, electronic signature and cards and their related systems and operations”, the secretariat of which is held by AFNOR. This European Standard shall be given the status of a national standard, either by publication of an identical text or by endorsement, at the latest by September 2013, and conflicting national standards shall be withdrawn at the latest by September 2013. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent rights. EN 419251 contains the following parts:  EN 419251-1, Security requirements for device for authentication — Part 1: Protection profile for core functionality;  EN 419251-2, Security requirements for device for authentication — Part 2: Protection profile for extension for trusted channel to certificate generation application (the present document);  EN 419251-3, Security requirements for device for authentication — Part 3: Additional functionality for security targets. The present document was submitted to the Enquiry under the reference prEN 16248-2. According to the CEN/CENELEC Internal Regulations, the national standards organisations of the following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United Kingdom. SIST EN 419251-2:2013



EN 419251-2:2013 (E) 6 1 Scope This European Standard is a Protection Profile that defines the security requirements for an authentication device. 2 Normative references The following documents, in whole or in part, are normatively referenced in this document and are indispensable for its application. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 10181-2:1996, Information technology — Open Systems Interconnection — Security frameworks for open systems: Authentication framework ISO/IEC 15408-1:20091), Information technology — Security techniques — Evaluation criteria for IT security — Part 1: Introduction and general model
ISO/IEC 15408-21), Information technology — Security techniques — Evaluation criteria for IT security — Part 2: Security functional components ISO/IEC 15408-31), Information technology — Security techniques — Evaluation criteria for IT security — Part 3: Security assurance components ISO/IEC 18045, Information technology — Security techniques — Methodology for IT security evaluation 3 Conformance 3.1 CC Conformance Claim This Protection Profile (PP) is CC Part 2 extended and CC Part 3 conformant and written according to ISO/IEC 15408-1, -2, -3 and ISO/IEC 18045. 3.2 PP Claim This PP does not claim conformance to any other Protection Profile. 3.3 Package Claim The evaluation assurance level for this PP is EAL4-augmented with the assurance components AVA_VAN.5 and ALC_DVS.2. 3.4 Conformance Rationale Since this PP is not claiming conformance to any other protection profile, no rationale is necessary here.
3.5 Conformance Statement The conformance required by this PP is the demonstrable-PP conformance. This would facilitate conformance claim to both the PP “Authentication device” and other PPs for Security Target (ST) authors.
1) ISO/IEC 15408-1, -2 and -3 respectively correspond to Common Criteria for Information Technology Security Evaluation, Parts 1, 2 and 3. SIST EN 419251-2:2013



EN 419251-2:2013 (E) 7 4 Terms and definitions For the purposes of this document, the following terms and definitions apply. 4.1 Administrator person who is allowed administration operations on the authentication device Note 1 to entry: See 9.2 for more details. 4.2
Authentication Protocol sensitive data data used in the process of authentication of the TOE by the external entity Note 1 to entry: These data are linked to the Authentication private key, e.g. Authentication Certificate or APuK. Note 2 to entry: Authentication Protocol sensitive data may be empty if the environment is trusted, and the holder public key known to the system. 4.3 Certificate electronic attestation, which links the APuK to a person and confirms the identity of that person (as defined in Directive [8], article 2, Clause 9) 4.4 Certificate Info information associated with an Authentication key pair that consists of either:  a signer's public key certificate; or
 one or more hash values of a signer's public key certificate together the identifier of the hash function used to compute these hash values, and some information which allows the signer to disambiguate between several signers certificates 4.5 Configuration set of groups Note 1 to entry: Each configuration corresponds to one PP. It has its own rationale. See [2]. 4.6 Group set of Assets, threats, objectives, and Requirements, addressing a specific function Note 1 to entry: See [2]. 4.7 Holder legitimate holder of the authentication device Note 1 to entry: See 9.2 for more details. 4.8 Issuer user of the authentication device during personalisation Note 1 to entry: See 9.2 for more details. SIST EN 419251-2:2013



EN 419251-2:2013 (E) 8 4.9 Protection Profile PP implementation-independent statement of security needs for a TOE [SOURCE: ISO/IEC 15408-1:2009, Clause 4 "Terms and definitions", modified  in ISO/IEC 15408-1, the protection profile refers to a TOE type instead of a TOE in this document] 4.10 PP collection document defining groups and configurations 4.11 Reference Authentication Data usually called RAD, data stored inside the TOE and used as a reference to which the VAD will be compared Note 1 to entry: This RAD can be biometrics data, a PIN, or a symmetric key. It can also be a combination of these factors. The RAD is not an Asset, it is TSF data. 4.12 Trusted channel means by which a TSF and a remote trusted IT product can communicate with necessary confidence [SOURCE: ISO/IEC 15408-1:2009, Clause 4 "Terms and definitions"] 4.13 Trusted Environment environment that ensures the protection of sensitive data transfers between the TOE and a remote trusted IT product (resp. a user) Note 1 to entry: A trusted (or untrusted) environment relates to the whole communication channel between the TOE and the remote trusted IT product (resp. the user). 4.14 Untrusted Environment environment that does not ensure the protection of sensitive data transfers between the TOE and a remote trusted IT product (resp. a user) Note 1 to entry: An untrusted (or trusted) environment relates to the whole communication channel between the TOE and the remote trusted IT product (resp. the user). 4.15 User current User of the TOE Note 1 to entry: The User can be the Issuer, the Holder, the Administrator. 4.16 Verifier entity which is or represents the entity requiring an authenticated identity Note 1 to entry: A verifier includes the functions necessary for engaging in authentication exchanges. [SOURCE: ISO/IEC 10181-2:1996, modified  the full sentence at the end of the definition in the ISO/IEC has been turned into the present Note 1 to entry] 4.17 Verification Authentication Data usually called VAD, data entered into the TOE and checked against the RAD as a means of authentication SIST EN 419251-2:2013



EN 419251-2:2013 (E) 9 Note 1 to entry: As the RAD, the VAD is not an Asset, it is TSF data. 5 Symbols and abbreviations APSD Authentication Protocol Sensitive Data APrK Authentication Private Key APuK Authentication Public Key CA Certificate Authority CC Common Criteria OBKG On-Board Key Generation PIN Personal Identification Number PC Personal Computer PP Protection Profile RAD Reference Authentication Data SSCD Secure Signature Creation Device ST Security Target TOE Target of Evaluation VAD Verification Authentication Data
6 Overview of the target of evaluation 6.1 TOE Type The aimed objective is to define security requirements that an authentication device shall conform to in the perspective of a security evaluation. The Target of Evaluation (TOE 2)) considered in this PP corresponds to a hardware device (such as, for example, a smart card or USB token) allowing its legitimate holder to authenticate himself when accessing an on-line service or to guarantee the origin authentication of data sent by the User to a distant agent 3). This PP has been constructed such as
...