@@ -2132,7 +2132,7 @@ The validity of the cryptographic mechanisms used to encure those funtions is co
### 6.8.2 DM - Secret management
- REFERENCE: ACC-PKI-DM-04
- OBJECTIVE:
- Determine whether all key generation operations are performed exclusively by approved Secure Cryptographic Devices (SCDs) or remote Key Management Systems (KMSs) implementing cryptographic mechanisms conformant with Annex K.
- Determine whether all key generation operations are performed exclusively by Secure Cryptographic Devices (SCDs) or remote Key Management Systems (KMSs) implementing cryptographic mechanisms conformant with Annex K.
- PREPARATION:
- Cryptographic architecture documentation.
- Documentation for the SCD or KMS.
@@ -2157,95 +2157,6 @@ The validity of the cryptographic mechanisms used to encure those funtions is co
- Configuration files.
- Assessment records demonstrating key generation paths.
### 6.8.2 DM - Secret management
- REFERENCE: ACC_PKI_DM_03
- OBJECTIVE:
- Verify the product only creates keys by means of a SCD appropriate for this use.
- PREPARATION:
- Document the profiles of private and symmetric keys manipulated by the product, and how they are created by the product.
- ACTIVITIES:
- Verify that all keys are created by an appropriate secure cryptographic device.
- VERDICT:
- SUCCESS: Verification passes
- FAIL: Identification of keys not created by SCD or with improper algorithm or size.
- EVIDENCE:
- The documentation of private and symmetric keys profiles and how these keys are created.
REFERENCE: ACC_PKI_DM_04
- OBJECTIVE:
- Verify that the product establishes and maintains a secure and correctly configured communication link with the SCD, and that the SCD interface is properly configured and called.
- PREPARATION:
- Document the following:
- The communication protocols (e.g., TLS, IPsec) and their configurations used to connect to the SCD.
- The SCD interface specifications, including supported commands, data formats, and authentication mechanisms.
- The expected behavior of the product when interacting with the SCD (e.g., error handling, retries, timeouts).
- ACTIVITIES:
- Verify that the communication link with the SCD is encrypted and authenticated according to the documented protocols and configurations.
- Verify that the product correctly configures the SCD interface (e.g., parameters, credentials, or certificates).
- Verify that all calls to the SCD interface use the correct commands, data formats, and authentication mechanisms as specified.
- Test edge cases, such as network interruptions or invalid responses, to ensure robust handling.
- VERDICT:
- SUCCESS: All communication links are secure, and the SCD interface is correctly configured and called.
- FAIL: Identification of insecure communication links, misconfigured SCD interfaces, or incorrect calls to the SCD interface.
- EVIDENCE:
- Documentation of the communication protocols, configurations, and SCD interface specifications.
- Logs or test results demonstrating secure communication and correct SCD interface calls.
- Evidence of error handling and robustness during edge case testing.
- REFERENCE: ACC_PKI_DM_05
- OBJECTIVE:
- Verify the product does not persistently store private or symmetric keys in plaintext form.
- PREPARATION: Document the profiles of private and symmetric keys manipulated by the product, and how they are manipulated by the product.
- ACTIVITIES: Verify that keys accessed in plaintext form are only used to perform a single operation once, or operations in a single batch.
- VERDICT: SUCCESS if the verification passes; else FAIL.
- EVIDENCE:
a) The documentation of private and symmetric keys profiles and how these keys are manipulated.
- REFERENCE: ACC_PKI_DM_06
- OBJECTIVE:
- Verify public keys stored within the product outside a secure cryptographic device are protected against undetected modification, and that public keys are not released or used after a detected modification.
- PREPARATION:
- Document public keys manipulated by the product outside a secure cryptographic device, and how they are manipulated by the product.
- Ability to directly modify such a stored public key. Ability to directly modify digital signatures, keyed hashes, or authentication codes associated to such stored public keys.
- Ability to request the public key (if applicable). Ability to trigger an action of the product making it use the public key (if applicable).
- ACTIVITIES: For every public key stored within the product outside a secure cryptographic device:
a) directly modify the stored public key;
b) attempt to request the public key;
c) verify the request fails;
d) attempt to trigger an operation whereby the product makes use of the public key;
e) verify the operation fails because of the state of the public key;
f) restore the stored public key;
g) directly modify the digital signature, keyed hash, or authentication code associated to the stored public key;
h) attempt to request the public key;
i) verify the request fails;
j) attempt to trigger an operation whereby the product makes use of the public key;
k) verify the operation fails because of the state of the public key.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
- The documentation of public keys and how they are manipulated;
- The way the public keys were requested, and the response from the product;
- The way operations making use of public keys were attempted to be triggered, and the response from the product;
- REFERENCE: ACC_PKI_DM_07
- OBJECTIVE: Verify that the product perform zeroization of secrets when no longer used.
- PREPARATION:
- Document secrets manipulated by the product in plaintext form outside a secure cryptographic device.
- When possible, access to product source codes.
- ACTIVITIES:
a) When source code is accessible, for every such secret, verify related source codes systematically perform its secure zeroization after the secret is used;
b) For every zeroization method employed, identify a related secret in memory while it is used, and verify the secret to be irrecoverable in full after zeroization.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
a) The documentation of secrets and how they are manipulated;
b) the documentation of zeroization methods employed.
- REFERENCE: ACC_PKI_DM_08
- OBJECTIVE: Verify the product cannot export private or symmetric keys in plaintext form.
- PREPARATION: Document how private and symmetric keys may be exported by the product.
- ACTIVITIES: For each method of export, verify the secret key is not in plaintext form.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE: The documentation of supported export methods.
## 6.9 Availability protection
## 6.9.1 AP - Certificate suspension and revocation
