@@ -1753,7 +1753,7 @@ Validity of access control requirement are covered by section 6.5:
- Audit logs of key management operations.
- Configuration files and screenshots.
- REFERENCE: ACC-PKI-DM-02
- REFERENCE: ACC-PKI-CAN-02
- OBJECTIVE:
- Verify that when a pseudonymous certificate is used to exchange a public key associated with an ephemeral identity, the certificate contains no information that could directly or indirectly reveal, correlate, or facilitate identification of the sender, thereby preserving sender pseudonymity.
- PREPARATION:
@@ -1795,6 +1795,38 @@ Validity of access control requirement are covered by section 6.5:
- Correlation analysis results showing that certificate contents cannot be used to identify or link the sender.
- Assessor observations and test logs supporting the final determination.
- REFERENCE: ACC-PKI-CON-03
- OBJECTIVE:
Verify that all transmissions of personal or sensitive data are protected using state-of-the-art cryptographic mechanisms in accordance with Annex K.
- PREPARATION:
- Data flow diagrams or interface specifications.
- Data classification documentation identifying personal and sensitive data.
- Cryptographic configuration documentation.
- Network monitoring tools.
- Test environment including external components the product will connect to.
- ACTIVITIES:
- Identify all interfaces transmitting personal or sensitive data.
- Verify that transmitted data is protected by cryptographic mechanisms compliant with Annex K.
- Capture network traffic during data transmission.
- Verify that sensitive information is not transmitted in plaintext.
- VERDICT:
- SUCCESS:
- All identified sensitive data transmissions are cryptographically protected.
- The implemented cryptographic mechanisms conform to Annex K assessment requirement.
- No sensitive data is observable in plaintext.
- FAIL:
- Sensitive data is transmitted without cryptographic protection.
- Non-approved or weak cryptographic mechanisms are used.
- Sensitive information can be recovered from network captures.
- EVIDENCE:
- Data flow diagrams.
- Data classification documentation.
- Network packet captures.
- Cryptographic configuration files.
- Protocol inspection reports.
- Test execution records.
## 6.7 Integrity
Assessment requirements covering Monitoring are presented in section 6.13.
