page 54 about the possible as well as acceptable of the requirement for non frequency for the transfer of audit data.” real-time audit transfer. NDcPP, mandates compliance to Remove this statement. 1 Statement removed. “FCS_CKM.1 FIPS 186-4. Implementations according to AppNote FIPS 186-2 shall be accepted for products 8 entering evaluation no later than December page 56 31, 2015.” Should we even allow FIPS 186-2 anymore? By the time this version is published, Dec 2015 will be a long time ago. This looks like a non-compliance being allowed. TSF validate the revocation status “The Make RFC 5759 selectable or 1 No change. RFC 5759 is of the certificate using [selection: the Section optional. already selectable in the Online Certificate Status Protocol (OCSP) 6.5.5.1 SFR. as specified in RFC 6960, a Certificate Page 64 Revocation List (CRL) as specified in RFC 5280, Certificate Revocation List (CRL) as specified in [assignment: list of RFC 5759, sections which TSF enforces] ].” RDC 5759, section 5, requires that CRL must be signed ECDSA based on Suite B NSA requirement. ECDSA signature/verification is not mandated by NDcPP. See FCS_COP.1.1/SigGen.
page 54 about the possible as well as acceptable frequency for the transfer of audit data.” of the requirement for non real-time audit transfer. NDcPP, AppNote 8 page 56 “FCS_CKM.1 mandates compliance to FIPS 186-4. Implementations according to FIPS 186-2 shall be accepted for products entering evaluation no later than December 31, 2015.” Should we even allow FIPS 186-2 anymore? By the time this version is published, Dec 2015 will be a long time ago. This looks like a non-compliance being allowed. Remove this statement. 1 Statement removed. Section 6.5.5.1 Page 64 “The TSF validate the revocation status of the certificate using [selection: the Online Certificate Status Protocol (OCSP) as specified in RFC 6960, a Certificate Revocation List (CRL) as specified in RFC 5280, Certificate Revocation List (CRL) as specified in RFC 5759, [assignment: list of sections which TSF enforces] ].” RDC 5759, section 5, requires that CRL must be signed ECDSA based on Suite B NSA requirement. ECDSA signature/verification is not mandated by NDcPP. See FCS_COP.1.1/SigGen. Make RFC 5759 selectable or optional. 1 No change. RFC 5759 is already selectable in the SFR.