Operational User Guidance (AGD_OPE.1) The operational user guidance does not have to be contained in a single document. Guidance to users, administrators and application developers can be spread among documents or web pages. The developer should review the Evaluation Activities contained in the SD to ascertain the specifics of the guidance that the evaluator will be checking for. This will provide the necessary information for the preparation of acceptable guidance. Preparative Procedures (AGD_PRE.1) As with the operational guidance, the developer should look to the Evaluation Activities to determine the required content with respect to preparative procedures. The refinement below describes some specific requirements for distributed TOEs. AGD_PRE.1 Preparative Procedures Refinement: The following specific topics must be addressed as part of the Preparative Procedures for the TOE: If the TOE is a distributed TOE and relies on the environment to provide security for the registration process when joining components to the TOE then the Preparative Procedures shall: clearly the strength of the authentication and encryption provided by the registration channel itself and the specific requirements on the environment used for joining components to the TOE (e.g. where the environment is relied upon to prevent interception of sensitive messages, IP spoofing attempts, attacks, or race conditions) identify what confidential values are transmitted over the enablement channel (e.g. any keys, their lengths, and their purposes), use of any non-confidential keys (e.g. where a developer uses the same key for more than one device or across all devices of a type or family), and use of any unauthenticated identification data (e.g. IP addresses, self-signed certificates) highlight any situation in which a secret value/key may be transmitted over a channel that uses a key of lower comparable strength than the transmitted value/key. Comparable strength is defined as the amount of work required to compromise the algorithm or key and is typically expressed as of security. ‘bits’ The ST author should consult NIST 800-57 Table 2 for further guidance on comparable algorithm strength. A distributed TOE that relies on the environment in this way is one where the ST author uses the FTP_TRP.1/Join channel type in the main selection for FCO_CPC_EXT.1.2, and the TOE relies on the operational environment to provide security for some aspects of the
Operational User Guidance (AGD_OPE.1) The operational user guidance does not have to be contained in a single document. Guidance to users, administrators and application developers can be spread among documents or web pages. The developer should review the Evaluation Activities contained in the SD to ascertain the specifics of the guidance that the evaluator will be checking for. This will provide the necessary information for the preparation of acceptable guidance. Preparative Procedures (AGD_PRE.1) As with the operational guidance, the developer should look to the Evaluation Activities to determine the required content with respect to preparative procedures. The refinement below describes some specific requirements for distributed TOEs. AGD_PRE.1 Preparative Procedures Refinement: The following specific topics must be addressed as part of the Preparative Procedures for the TOE: If the TOE is a distributed TOE and relies on the environment to provide security for the registration process when joining components to the TOE then the Preparative Procedures shall: clearly the strength of the authentication and encryption provided by the registration channel itself and the specific requirements on the environment used for joining components to the TOE (e.g. where the environment is relied upon to prevent interception of sensitive messages, IP spoofing attempts, attacks, or race conditions) identify what confidential values are transmitted over the enablement channel (e.g. any keys, their lengths, and their purposes), use of any non-confidential keys (e.g. where a developer uses the same key for more than one device or across all devices of a type or family), and use of any unauthenticated identification data (e.g. IP addresses, self-signed certificates) highlight any situation in which a secret value/key may be transmitted over a channel that uses a key of lower comparable strength than the transmitted value/key. Comparable strength is defined as the amount of work required to compromise the algorithm or key and is typically expressed as ‘bits’ of security. The ST author should consult NIST 800-57 Table 2 for further guidance on comparable algorithm strength. A distributed TOE that relies on the environment in this way is one where the ST author uses the FTP_TRP.1/Join channel type in the main selection for FCO_CPC_EXT.1.2, and the TOE relies on the operational environment to provide security for some aspects of the
ND_cPP_v1-1.docx