Verified Commit 2faf0ac5 authored by Aki Braun's avatar Aki Braun
Browse files

Spell check

parent 9031a99e

EN-304-620-1.md

+1 −1
Original line number Diff line number Diff line
@@ -227,7 +227,7 @@ The following referenced documents may be useful in implementing an ETSI deliver 


* <a name="_ref_i.1">[i.1]</a>    Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

* <a name="_ref_i.2">[i.2]</a>    Commission Implementing Regulation (EU) TK TODO on the technical description of the categories of important and critical products with digital elements pursuant to Regulation (EU) 2024/2847 of the European Parliament and of the Council (Text with EEA relevance)

* <a name="_ref_i.3">[i.3]</a>    C(2025)618 – Standardisation request M/606: Commission Implementing decision of 3.2.2025 on a standardisation request to the European Committee for Standardisation (CEN), the European Committee for Electrotechnical Standardisation (Cenelec) and the European Telecommunications Standards Institute (ETSI) as regards products with digital elements in support of Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020and Directive (EU) 2020/1828 (Cyber Resilience Act)

* <a name="_ref_i.3">[i.3]</a>    C(2025)618 – Standardisation request M/606: Commission Implementing decision of 3.2.2025 on a standardisation request to the European Committee for Standardisation (CEN), the European Committee for Electrotechnical Standardisation (CENELEC) and the European Telecommunications Standards Institute (ETSI) as regards products with digital elements in support of Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020and Directive (EU) 2020/1828 (Cyber Resilience Act)

* <a name="_ref_i.4">[i.4]</a>    Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (Text with EEA relevance) (notified under document number C(2003) 1422)

* <a name="_ref_i.5">[i.5]</a>    Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act)

clauses/5.Requirements.md

+17 −15
Original line number Diff line number Diff line 
## 5.1 General



> TODO-HAS: availability protecton (? failover? redundancy?)

> TODO-HAS: availability protection (? failover? redundancy?)



## 5.2 Technical security requirements specifications
@@ -579,14 +579,14 @@ The VPN client shall clearly inform the user about the operator of the DNS serve 
#### 5.2.9.9 Mapping of mitigations to risk factors and security profiles



| Risk factors      | Requires mitigations                                           |

|-------------------|--------------------------------------------------------|

|-------------------|----------------------------------------------------------------|

| DAT < 1           | DNSL-1, DNSL-2, DNSL-8                                         |

| DAT < 2 & ADM > 0 | DNSL-1, DNSL-2, DNSL-3, DNSL-4, DNSL-8                         |

| DAT > 1           | DNSL-1, DNSL-2, DNSL-3, DNSL-4, DNSL-5, DNSL-6, DNSL-7, DNSL-8 |

| ADM < 1           | DNSL-2, DNSL-4                                                 |



| Security Profile | Requires mitigations                                           |

|------------------|--------------------------------------------------------|

|------------------|----------------------------------------------------------------|

| UC-1             | DNSL-1, DNSL-2, DNSL-8                                         |

| UC-2             | DNSL-1, DNSL-2, DNSL-3, DNSL-4, DNSL-8                         |

| UC-3             | DNSL-1, DNSL-2, DNSL-3, DNSL-4, DNSL-5, DNSL-6, DNSL-7, DNSL-8 |
@@ -788,7 +788,7 @@ If the VPN provider claims to support IPv6, it shall provide full, native IPv6 c 


#### 5.2.14.1 Overview: TR-CRYPT



The VPN provider shall use strong cryptograpy

The VPN provider shall use strong cryptography



#### 5.2.14.2 **MI-CRYPT-1**: Use a PSK
@@ -804,13 +804,15 @@ The VPN provider shall use a preshared key to mitigate post-quantum decryption 


#### 5.2.14.3 **MI-CRYPT-2**: Use conformant encryption



VPN encryption shall use cryptographic algorithms, keys, and parameters as described in EUCC Guidelines Cryptography v2 [3] or demonstrably equivalent state-of-the-art mechanisms.

> TODO-HAS: Fill in below



VPN encryption shall use cryptographic algorithms, keys, and parameters as described in EUCC Guidelines Cryptography v2 [\[3\]](#_ref_3) or demonstrably equivalent state-of-the-art mechanisms.



  * Reference: TR-CRYPT

  * Objective: Confidentiality

  * Preparation: Perform a factory reset or new installation of the VPN client.

  * Activities: Start the VPN connection using the default configuration. Capture traffic on all interfaces.

  * Verdict: The traffic pertaining to the VPN connection uses the algorithms, keys and parameters as descibed in EUCC guidelines or demonstrably equivalent state-of-the-art mechanisms.

  * Verdict: The traffic pertaining to the VPN connection uses the algorithms, keys and parameters as described in EUCC guidelines or demonstrably equivalent state-of-the-art mechanisms.

  * Evidence: Packet capture showing the encryption headers.



#### 5.2.14.4 Mapping of mitigations to risk factors and security profiles