1. Manager, Product Evaluation
The Trusted PKI
Marc Laroche
Manager, Product Evaluation
(613)

2. Agenda
The Entrust PKI, an overview
Evaluation approach
Common Criteria Certification: Functionality and assurance covered
What is next? Entrust/PKI v5.0 evaluation
Summary

3. Entrust/PKI The main components Entrust/Authority Database CM LDAP CRLOS
Entrust/Authority
Database CM
LDAP OS
CRL
X.500 Directory

4. Entrust/PKI The main components Entrust/Authority Entrust/RA Admin APIOS
Entrust/Authority
Entrust/RA
Admin API
Database CM CM
PKIX-CMP OS
LDAP OS
CRL
X.500 Directory

5. Entrust/PKI The main components Entrust/Authority Entrust/RA Admin APIOS
Entrust/Authority
Entrust/RA
Admin API
Database CM CM
PKIX-CMP OS
LDAP OS
Entrust-Ready
Applications
Other CAs OS
CRL CM OS
X.500 Directory
Other Applications

6. Evaluation Scope Database Entrust/Authority CM Entrust/RA CM CRL
ADM API
PKIX-CMP
CRL
Other Applications CM
X.500 Directory
Entrust-Ready Applications

7. Evaluation Scope Database Entrust/Authority CM Entrust/RA CM CRL
ADM API
PKIX-CMP
CRL
Non Entrust-Ready Applications CM
X.500 Directory
Entrust-Ready Applications

8. Evaluation Scope Database Entrust/Authority CM Entrust/RA CM CRL
ADM API
PKIX-CMP
CRL
Non Entrust-Ready Applications CM
X.500 Directory
Entrust-Ready Applications

9. Evaluation Scope Database Entrust/Authority CM Entrust/RA CM CRL
ADM API
PKIX-CMP
CRL
Non Entrust-Ready Applications CM
X.500 Directory
Entrust-Ready Applications

10. Entrust/PKI 4.0a Certification: Evaluated Functionality
User identification and authentication
Entrust/Authority CM
Entrust/RA
ADM API CM
PKIX-CMP
Other CAs
End-Entities

11. User identification and authentication
User I&A before any action (FIA_UID.2 and FIA_UIA.2)
Password rules (FIA_SOS.1)
Single use authentication for user initialization, key recovery and enabling of CA cross-certification (FIA_UAU.4)
Enforced re-authentication to complete sensitive operations and after session time-out has occurred (FIA_UAU.6)
Protected authentication feedback (FIA_UAU.7)
Authentication failure handling (FIA_AFL.1)

12. Access Control Entrust/Authority CM Functions Entrust/RA CM Data
ADM API CM
Data
PKIX-CMP
Access Control
Mediation
User Id
Role
Privileges
Other CAs
End-Entities

13. Access Control
Complete access control on CA data objects (e.g. CA signing key, user privilege vector, policy, etc) and functions (FDP_ACC.2)
Security attribute based access control (i.e. user id, role and permissions) (FDP_ACF.1)
Secure management of security attributes, including access control and enforcement of secure values (FMT_MSA.1, FMT_MSA.2, FMT_MSA.3, FIA_ATD.1)
Secure management of security enforcing data objects (e.g. integrity check rate, database encryption algorithm, CA signing algorithm, etc.), including access control and enforcement of secure values (FMT_MTD.1 and FMT_MTD.3)

14. Separation of duties Security Officer Administrator Master User
Entrust/Authority CM
Entrust/RA
Administrator
ADM API CM
Master User
PKIX-CMP
Auditor
End User
Directory
Administrator
Others
(Custom-defined)

15. Separation of duties
Maintenance of roles and associations between users and roles (FMT_SMR.2)
Management of security functions behavior restricted to distinct roles (FMT_MOF.1 and FMT_SAE.1)

16. Key Management Database Entrust/Authority CM Entrust/RA X.509v3 CM
PKCS#1,3
FIPS 140-1
FIPS 186-1
PKIX-CMP CM
ADM API
CRL CM
X.500 Directory
End User

17. Key Management
Certificate-based key management that meets the following standards: X.509v3, PKCS#1 and 3, FIPS and 186-1, LDAP, PKIX-CMP (FCS_CKM.2)
User initialization, key update, key recovery and encryption key back-up IAW PKIX-CMP and FIPS (FCS_CKM.3)
Use of secrets generated by a FIPS cryptographic module is enforced (FIA_SOS.2)

18. Audit
Audit records are generated for a defined list of events; each record includes: log number, event description, severity level, user id, user type and state (FAU_GEN.1 and FAU_GEN.2)
Any modification to audit records is detected (FAU_STG.2)
Privileged users are provided with the capability to read audit records and look for specific information based on user-defined search criteria (FAU_SAR.1 and FAU_SAR.3)
Database
Entrust/Authority CM
Entrust/RA
ADM API CM
X.500 Directory
CRL
PKIX-CMP
End Users
Other CAs

19. Trusted Path and Data Protection
Database
Entrust/Authority CM
Entrust/RA
ADM API CM
PKIX-CMP
CRL CM
X.500 Directory
End Users
Other CAs

20. Trusted Path and Data Protection
Communications with remote administrative users, end users and external CAs are authenticated and protected from modification and disclosure (FTP_TRP.1)
Communications involved with automatic key management operations (e.g. key update) are protected from modification and disclosure (FTP_ITC.1)
The access control policy is enforced when data is transmitted and received, and modification, deletion, insertion or replay is detected (FPT_ITI.1)
Exchanged data is consistently interpreted (FPT_TDC.1)
Generation of evidence of origin for CA certificates, user certificates, CRLs and ARLs is enforced, and the capability to verify the evidence of origin is provided (FCO_NRO.2)

21. Trusted Path and Data Protection (continued)
Generation of evidence that can be used as a guarantee of the validity of CA certificates, user certificates, CRLs and ARLs is enforced, and the capability to verify evidence of the validity is provided (FDP_DAU.1)
Data stored in the local database is monitored for integrity errors (FDP_SDI.1)

22. Non-bypassability
Security enforcing functions are invoked and succeed before each function within the CA allowed to proceed (FPT_RVM.1)

23. Cryptographic services (Environmental)
Database
Entrust/Authority CM
Entrust/RA CM
ADM API
PKIX-CMP
CRL CM
End-Users
X.500 Directory

24. Cryptographic services
Key and secret generation is performed by a FIPS validated module (FCS_CKM.1 and FIA_SOS.2.1)
All plaintext keys are zeroized by a FIPS validated cryptographic module (FCS_CKM.4)
All cryptographic operations, including pseudo-random number generation, short term key storage, encryption/decryption, signature generation and verification, hashing and MAC generation and verification are performed by a FIPS validated cryptographic module (FCS_COP.1)

25. Abstract Machine Services (Environmental)
Reliable time stamps are provided for own use (FPT_STM.1)
Audit records are protected against unauthorized deletion (FAU_STG.2.1)
A security domain for own execution is maintained, which provides protection against interference and tampering by untrusted applications (FPT_SEP.1) OS OS
Entrust/Authority CM
Audit
Entrust/RA
ADM API CM
PKIX-CMP
Time
Time

26. And what EAL3+ means …
Internal development processes and systems were documented and reviewed.
Configuration management (source code, documentation, test plans); evidence that CM is actually used; measures that allow only authorized changes to configuration items.
Security measures (physical, procedural, personnel and other used to protect the development environment).
Flaw reporting procedures +
Problem tracking +
Product delivery
Design was documented and reviewed for conformance with claimed functionality.
Informal functional specification
High-level design (description of security functions in terms of subsystems and relates subsystems to the functions that they provide; description of the interfaces between these subsystems).

27. Continued ... User documentation was reviewed: Installation guidance
Administrative guidance
Informal correspondence demonstration was reviewed:
More abstract representation (claimed functionality) is correctly and completely refined in the less abstract representation (FS and HLS).
Test plans, test procedures, expected test results and actual test results were submitted and reviewed:
Demonstrate that each security function was tested against the functional specification in a systematic manner.
Demonstrate that the tests are sufficient to confirm that the security functions operate IAW the High-Level Design; demonstrate that the internal interfaces are exercised.
Vulnerability analysis was submitted and reviewed.
Categorization report was submitted and reviewed.+
subcomponents are described as security enforcing or not.

28. Entrust/PKI 5.0 evaluation: Augmented from 4.0a
Functionality
Enforced proof of receipt - keys and certificate (FCO_NRR.2)
Residual information protection (FDP_RIP.1)
Automated recovery of services (FPT_RCV.2)
Replay detection - certificate request (FPT_RPL.1)
Session locking (FTA_SSL.1 and FTA_SSL.2)
Assurance - EAL-CS2
ADV_SPM.1 Informal TOE security policy model
AVA_MSU.2 Validation of analysis

29. In summary The Entrust/PKI evaluations cover: cryptographic services
essential public key management functionality
supportive security critical functionality
The Common Criteria certification serves as a fundamental extension to the FIPS process.
The selected CC assurance components (EAL3+) provide a maximum amount of confidence consistent with existing best practices for COTS development.

30. Questions? For more information:
Tel: (613)