Therefore, this RFC should be selectable (i.e., optional) for consistency purpose. When the TSF “FIA_X509_EXT.2.2 We should make it explicitly clear 3 Application Note 22 a cannot establish a connection to determine Section this is only applicable for HTTPS updated to reflect that the the validity of a certificate, the TSF 6.5.5.2 only. For TLS and IPsec, if the peer selection within [selection: allow the administrator to certificate is invalid for any reason, FIA_X509_EXT.2.2 Page 65 choose whether to accept the certificate the connection cannot be should be consistent with in these cases, accept the certificate, not established period (See FCS_IPSEC_EXT.1.14 accept the certificate].” FCS_IPSEC_EXT.1.14 and and FCS_TLSC_EXT.1/2.3). FCS_TLSC_EXT.1/2.3 NDcPP, Ability to configure the interaction Ability to configure the 3 Suggested change Section between TOE components; interaction between TOE implemented. 6.6.3.1 components, if applicable; Page 67 Since distributed TOE is optional, we should make that clear. NDcPP, any situation in which a secret any situation in which a 2 Added reference to “highlight “highlight Section value may be transmitted over a channel secret value/key may be transmitted comparable strength with 7.3.2 that uses a shorter key than the transmitted over a channel that uses less high level definition. key” comparable strength than the Reference NIST 800-57 Page 80 transmitted key” for further guidance. We should use strengths” from “comparable NIST 800-57 asymmetric and symmetric algorithms have different key length. The TSF shall We should make it explicitly clear “FCS_HTTPS_EXT.1.3 NDcPP, 2 Selection updated to [selection: not establish the connection, that the first two options are only Section remove the assignment request authorization to establish the applicable if we are claiming a C.2.1.1 other action’ option. ‘no
Therefore, this RFC should be selectable (i.e., optional) for consistency purpose. a Section 6.5.5.2 Page 65 “FIA_X509_EXT.2.2 When the TSF cannot establish a connection to determine the validity of a certificate, the TSF [selection: allow the administrator to choose whether to accept the certificate in these cases, accept the certificate, not accept the certificate].” We should make it explicitly clear this is only applicable for HTTPS only. For TLS and IPsec, if the peer certificate is invalid for any reason, the connection cannot be established period (See FCS_IPSEC_EXT.1.14 and FCS_TLSC_EXT.1/2.3). 3 Application Note 22 updated to reflect that the selection within FIA_X509_EXT.2.2 should be consistent with FCS_IPSEC_EXT.1.14 and FCS_TLSC_EXT.1/2.3 NDcPP, Section 6.6.3.1 Page 67 Ability to configure the interaction between TOE components; Since distributed TOE is optional, we should make that clear. Ability to configure the interaction between TOE components, if applicable; 3 Suggested change implemented. NDcPP, Section 7.3.2 Page 80 “highlight any situation in which a secret value may be transmitted over a channel that uses a shorter key than the transmitted key” We should use “comparable strengths” from NIST 800-57 asymmetric and symmetric algorithms have different key length. “highlight any situation in which a secret value/key may be transmitted over a channel that uses less comparable strength than the transmitted key” 2 Added reference to comparable strength with high level definition. Reference NIST 800-57 for further guidance. NDcPP, Section C.2.1.1 “FCS_HTTPS_EXT.1.3 The TSF shall [selection: not establish the connection, request authorization to establish the We should make it explicitly clear that the first two options are only applicable if we are claiming a 2 Selection updated to remove the assignment ‘no other action’ option.
ConsolidatediTCcomments-NDcPPv2-20160721_v2.9.docx