Questions tagged [common-criteria]

The Common Criteria for Information Technology Security Evaluation (CC for short)

Filter by
Sorted by
Tagged with
1 vote
1 answer
119 views

Does defining "a minimum path length" for certification validation have any security benefit?

As you may know, Common Criteria (AKA ISO/IEC15408: A standard for IT Security Evaluation) have provided some security base-line documents named "Protection Profile" for software developers ...
Ebrahim Ghasemi's user avatar
0 votes
0 answers
171 views

Validate the conformance of an OpenSSL created certificate with FIPs standards

Trying to test the conformance of the certificates inside our application, with the below requirement: The application shall [selection: invoke platform-provided functionality, implement ...
DummyBeginner's user avatar
2 votes
2 answers
164 views

Can a software application / OS get past EAL4 if no source code is available

The EAL for Common Criteria are described briefly as: EAL1: Functionally Tested. ... EAL2: Structurally Tested. ... EAL3: Methodically Tested and Checked. ... EAL4: Methodically Designed, Tested, and ...
I'm Root James's user avatar
1 vote
0 answers
213 views

Are there any options for Root CA eIDAS compliant HSMs? [closed]

Building the eIDAS compliant certification authority in hierarchy, meaning that the Root CA will issue Subordinate CAs. Root CA will be offline almost whole year and Subordinate CA is online providing ...
user1563721's user avatar
  • 1,119
1 vote
0 answers
106 views

Get original text of Common Criteria protection profile [closed]

In translated from an English profile, combined from a couple of profiles (I found that one is Protection Profile for Application Software v1.2 of NIAP) I have something like "TOE security ...
Displayname's user avatar
0 votes
3 answers
141 views

What additional paperwork would be needed to get from EAL4 vertification to EAL7?

If my product is currently at EAL4, what is the process to get to EAL7? What additional paperwork or requirements would I need to complete?
penceyreject's user avatar
1 vote
2 answers
311 views

Where do Common Criteria threats, policies, assumptions and objectives come from?

When reading something dealing with Common Criteria for Information Technology Security Evaluation it is clear where ABC_DEF-type acronyms come from - they are thoroughly described in parts 2 and 3. ...
Eugene Ryabtsev's user avatar
0 votes
1 answer
126 views

Guidelines to make Windows Server 2008 Common Criteria Installation

I'm new to certification arguments. I have an issue with a requirement that is to make an application in a certified Windows 2008 environment. What are / where can I find a guide to WS2008 CC-...
DDS's user avatar
  • 101
0 votes
1 answer
115 views

why Common Criteria evaluation wont give 100% security [closed]

To understand Common Criteria in better way, could someone tell if system has passed a CC evaluation ie. EAL4, what can we say about the security of this system?
yourstruly's user avatar
1 vote
1 answer
640 views

WinHTTP and python requests package, fail to validate certificate containing valid CN but invalid SAN

We're using WinHTTP to send API calls from our client. Now according to Common Criteria, FCS_TLSC_EXT.1.2 assurance activity Test 2, if certificate contains a valid CN (common name) but invalid SAN(...
Muhammad Uzair Khan's user avatar
3 votes
2 answers
496 views

SP 800-56B compliance in OpenSSL

We are working to make a product Common Criteria Compliance for one of our customers. The Client part of the product uses OpenSSL for TLS communication, which implies that we need to fulfill the ...
Umair Durrani's user avatar
0 votes
1 answer
232 views

How to run FCS_TLSS tests of for common criteria evaluation? [closed]

So we are working on making a product of one of our clients common criteria compliant. We are using tls-cc-tools for running FCS_TLSC tests but we are unable to run FCS_TLSS_EXT.1.1 test 5. Please ...
Shahbaz Shueb's user avatar
3 votes
1 answer
801 views

WinHTTP - Prevent successful handshake if peer certificate is invalid

I am using WinHTTP on a Delphi project to make calls over to the server. Script: userAgent := 'TestClient.exe'; hsession := WinHttpOpen(pwidechar(userAgent), WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, nil,...
Muhammad Uzair Khan's user avatar
1 vote
1 answer
230 views

Which Protection Profiles required for EAL 1 test?

I have some question about PPs for EAL1 test. 1- Which PPs required for a Router Devices in EAL 1 test?We only need compliance with 'collaborative Protection Profile for Network Devices' (aka NDcPP) ...
alex's user avatar
  • 35
1 vote
0 answers
98 views

Are there any methodology for malware in case of threat assessment?

Malware is a threat in security assessment. Are there any criteria to assess malware in case of threat assessment?
khant's user avatar
  • 191
2 votes
2 answers
695 views

what is the relation between ISO IEC 15408 and Protection Profile?

I've been researching on EAL tests. there are some questions and i can't make heads or tails of them. I read ISO/IEC 15408-3 standard. I can't understand the numbers in the matrix table in page 33 (...
alex's user avatar
  • 35
1 vote
1 answer
183 views

Security certification of software products: what about libraries or third-party services?

How the security certification works if the software uses third party libraries or services? E.g., if someone would like to certify a software product following Common Criteria standard (let's say, ...
Andrey Sapegin's user avatar
13 votes
2 answers
25k views

Deference Between EAL 1-7 in Common Criteria Standard?

I have a question about ISO/IEC 15408 standard: I want know if the level of evaluation is higher we can conclude that a product is safer? i.e, if we have two products, is the one which has a higher ...
Juliet's user avatar
  • 187
2 votes
1 answer
627 views

Functional Specification for Common Criteria EAL 1 evaluation

I want to write a functional specification for CC EAL1 evaluation, There is an example in CC part 3 document but it is not enough complete, Are there any template or sample of a functional ...
mehdi yami's user avatar
4 votes
2 answers
232 views

Evaluating hosting providers for CC development environment

An organization that develops software that may be subject to security evaluations such as Common Criteria is looking to externalize part of its IT infrastructure, including critical components such ...
Gilles 'SO- stop being evil''s user avatar
8 votes
1 answer
784 views

What compliance problem does "Common Criteria Certification" solve?

It has been said Common Criteria solves a "Compliance problem, and not a security problem". Can someone explain where CC certification is required or benefits an industry? Is it simply a marketing ...
makerofthings7's user avatar
6 votes
2 answers
1k views

Is Common Criteria (CC) a suitable standard to certify web applications

I never came across a web application that has been certified according to Common Critera. As far as I know there isn't even a protection profile available for web applications. What is the reason ...
Demento's user avatar
  • 7,465