FIPS140-2 standard specifies the following conditional test to be performed by the cryptographic module if software or firmware components can be externally loaded into a cryptographic module:
- An Approved authentication technique (e.g., an Approved message authentication code, digital signature algorithm, or HMAC) shall be applied to all validated software and firmware components when the components are externally loaded into a cryptographic module. The software/firmware load test is not required for any software and firmware components excluded from the security requirements of this standard (refer to Section 4.1).
- The calculated result shall be compared with a previously generated result. If the calculated result does not equal the previously generated result, the software/firmware load test shall fail.
Section 4.1: Hardware, software, and firmware components of a cryptographic module can be excluded from the requirements of this standard if shown that these components do not affect the security of the module.
Should I argue that the boot code can be excluded according to Section 4.1, thus boot code does not affect the security of the module, since there are attacks that involve the boot code like "Evil Maid"?
Note: this cryptographic module is defined as a hardware cryptographic module. The cryptographic officer can upgrade the boot code that bootstraps the firmware implementing the cryptographic functionality.
Do I have to add a digital signature or HMAC for the new boot code when upgrading is desired OR should I argue to exclude it?