However some distributed components will from the current find its based on messaged FCS_TLS_EXT.1 component. “Gatekeeper” exchanged in a process. Based ‘discovery’ on attributes returned in those messages it This would permit an ST author selects a to begin the “Gatekeeper” to select TLS in FPT_ITT.1 authentication and join process. (and in FTP_TRP.1/Admin) without the issue as identified This means the doesn’t in the comment column. “joiner” independently build a reference identifier, nor is it possible to configure one. The requirement to verify that Therefore it’s not accurate to apply RFC the presented identifier matches 6125 in FCS_TLSC_EXT.1.2 for these the reference identifier would distributed TOEs. remain in the FCS_TLS_EXT.2 component, which is required FCO_CPC_EXT.1 which requires the to be selected for TLS administrator to enable communications connections to external IT between the pair of TOE components is entities. acceptable/sufficient for distributed TOEs. NDcPP, FPT_ITT.1 needs to allow use of DTLS as a Due to space limitations see 1 Requestor has been asked A.5.2 protocol. For a component to manage attached document to supply a more “Suggested another component as described in use case Change-Add DTLS” for details. comprehensive set of 3, some distributed TOEs may use a DTLS SFR(s) and EAs different protocol. for consideration by the iTC. This is work in progress now within the DTLS is similar to TLS but uses UDP iTC. instead of TCP.
However some distributed components will find its “Gatekeeper” based on messaged exchanged in a ‘discovery’ process. Based on attributes returned in those messages it selects a “Gatekeeper” to begin the authentication and join process. This means the “joiner” doesn’t independently build a reference identifier, nor is it possible to configure one. Therefore it’s not accurate to apply RFC 6125 in FCS_TLSC_EXT.1.2 for these distributed TOEs. FCO_CPC_EXT.1 which requires the administrator to enable communications between the pair of TOE components is acceptable/sufficient for distributed TOEs. from the current FCS_TLS_EXT.1 component. This would permit an ST author to select TLS in FPT_ITT.1 (and in FTP_TRP.1/Admin) without the issue as identified in the comment column. The requirement to verify that the presented identifier matches the reference identifier would remain in the FCS_TLS_EXT.2 component, which is required to be selected for TLS connections to external IT entities. NDcPP, A.5.2 FPT_ITT.1 needs to allow use of DTLS as a protocol. For a component to manage another component as described in use case 3, some distributed TOEs may use a different protocol. DTLS is similar to TLS but uses UDP instead of TCP. Due to space limitations see attached document “Suggested Change-Add DTLS” for details. 1 Requestor has been asked to supply a more comprehensive set of DTLS SFR(s) and EAs for consideration by the iTC. This is work in progress now within the iTC.
ConsolidatediTCcomments-NDcPPv2-20160721_v2.9.docx