@@ -1203,9 +1203,9 @@ The post-release period of the product lifecycle is addressed in [5.5 Security u
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (b).
***SBD_TECH-1** The product shall implement **CON_CRYPTO-1** in all interfaces, except the ones that are available and reachable only in localhost by the local processes.
***SBD_TECH-1** The product shall implement Annex K in all interfaces, except the ones that are available and reachable only in localhost by the local processes.
> NOTE: Cryptographic mechanisms not covered by **CON_CRYPTO-1** are disabled by default.
> NOTE: Cryptographic mechanisms not covered by Annex K are disabled by default.
***SBD_TECH-2** For backward compatibility, if supported:
* the product shall inform the user about the security implications when not using the default configuration;
@@ -1349,8 +1349,7 @@ As the product is delivered without known exploitable vulnerabilities, those leg
***CON_CRYPTO-1** The product shall implement Annex K where relevant.
***CON_CRYPTO-2** To prevent rollback or downgrade [i.17] the product shall:
***CON_CRYPTO-1** To prevent rollback or downgrade [i.17] the product shall:
* enforce a monotonic cipher suite policy configuration (or equivalent mechanism);
* preven the re-enabling of deprecated algorithms or the disabling of security checks via a rollback operation without having an explicit logged administrative override in place.
@@ -1360,7 +1359,7 @@ A **secure channel** used in transportation is a cryptographically protected com
When privileged information is transferred or accessed, the transport channel provides confidentiality, integrity protection, endpoint authentication, and protection against downgrading to less secure configurations.
TLS may be used for this purpose, but other mechanisms may also be used where they provide an equivalent level of protection and are implemented as defined in Annex K.
***CON_CHANNEL-1** The product shall ensure that the secure channel uses cryptographic functions and configuration according to the **CON_CRYPTO-1**.
***CON_CHANNEL-1** The product shall ensure that the secure channel uses cryptographic functions and configuration according to the Annex K.
***CON_CHANNEL-2** All endpoints in a secure channel shall cryptographically verify others through mutual authentication.
@@ -1988,7 +1987,7 @@ Verify that:
**Supporting Evidence:**
1. Listing of tested interfaces and the protocol replies that show that cryptography as of **CON_CRYPTO-1** is used.
1. Listing of tested interfaces and the protocol replies that show that cryptography as of Annex K is used.
2. Listing of the interfaces, their deployed protocols with the invoked cryptographic means.
### 6.4.2 SBD_TECH-2
@@ -2008,7 +2007,7 @@ Verify that:
**Verdict:**
1. Pass, if the listed requirements are implemented when backward compatibility is offered.
2. Pass, if no backward compatibility is offered and the cryptography on the product is state-of-the-art as defined in **CON_CRYPTO-1**.
2. Pass, if no backward compatibility is offered and the cryptography on the product is state-of-the-art as defined in Annex K.
3. Fail otherwise.
**Supporting Evidence:**
@@ -2564,7 +2563,7 @@ Verify that:
1. Investigate the product and the documentation;
2. Identify all interfaces that are used to interface with users, other systems or components;
3. Check whether each interface deploys a protocol with appropriate cryptography from CON_CRYPTO-1.
3. Check whether each interface deploys a protocol with appropriate cryptography from Annex K.
**Verdict:**
@@ -2840,10 +2839,6 @@ Verify that:
#### 6.7.1.1 CON_CRYPTO-1
Assessments are defined in [Annex K](#annex-k-normative-generic-cryptographic-requirements-and-assessment)
#### 6.7.1.2 CON_CRYPTO-2
**Objective:** Attackers cannot version-rollback, downgrade or shorten key length of the actually deployed cipher suite.
**Preparation:**
@@ -4107,12 +4102,12 @@ Outcomes:
**Activities:**
1. Export the previously in-product generated data and verify that a secure protocol as out of CON_CRYPTO-1 is deployed
2. Import the externally present data set and verify that a secure protocol as out of CON_CRYPTO-1 is deployed
1. Export the previously in-product generated data and verify that a secure protocol as out of Annex K is deployed
2. Import the externally present data set and verify that a secure protocol as out of Annex K is deployed
**Verdict:**
1. Pass, if for import and export a protocol as of **CON_CRYPTO-1** is deployed
1. Pass, if for import and export a protocol as of Annex K is deployed
