1、BSI Standards PublicationBS EN 419211-3:2013Protection profiles for securesignature creation devicePart 3: Device with key importBS EN 419211-3:2013 BRITISH STANDARDNational forewordThis British Standard is the UK implementation of EN 419211-3:2013.The UK participation in its preparation was entrust
2、ed to TechnicalCommittee IST/17, Cards and personal identification.A list of organizations represented on this committee can beobtained on request to its secretary.This publication does not purport to include all the necessaryprovisions of a contract. Users are responsible for its correctapplication
3、. The British Standards Institution 2013. Published by BSI StandardsLimited 2013ISBN 978 0 580 71697 3ICS 03.160; 35.040; 35.240.15Compliance with a British Standard cannot confer immunity fromlegal obligations.This British Standard was published under the authority of theStandards Policy and Strate
4、gy Committee on 30 November 2013.Amendments issued since publicationDate Text affectedBS EN 419211-3:2013EUROPEAN STANDARD NORME EUROPENNE EUROPISCHE NORM EN 419211-3 October 2013 ICS 03.160; 35.040; 35.240.15 Supersedes CWA 14169:2004English Version Protection profiles for secure signature creation
5、 device - Part 3: Device with key import Profils de protection des dispositifs scuriss de cration de signature - Partie 3: Dispositif avec import de cl Schutzprofile fr sichere Signaturerstellungseinheiten - Teil 3: Einheiten mit Schlsselimport This European Standard was approved by CEN on 14 Septem
6、ber 2013. CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obt
7、ained on application to the CEN-CENELEC Management Centre or to any CEN member. This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN member into its own language and notified to the C
8、EN-CENELEC Management Centre has the same status as the official versions. CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Irelan
9、d, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and United Kingdom. EUROPEAN COMMITTEE FOR STANDARDIZATION COMIT EUROPEN DE NORMALISATION EUROPISCHES KOMITEE FR NORMUNG CEN-CENELEC Management Centr
10、e: Avenue Marnix 17, B-1000 Brussels 2013 CEN All rights of exploitation in any form and by any means reserved worldwide for CEN national Members. Ref. No. EN 419211-3:2013 EBS EN 419211-3:2013EN 419211-3:2013 (E) 2 Contents Foreword 3 1 Scope . 5 2 Normative references. 5 3 Terms and definitions 5
11、4 PP introduction . 5 4.1 PP reference . 5 4.2 PP overview 5 4.3 TOE overview 6 5 Conformance claims 11 5.1 CC conformance claim 11 5.2 PP claim, Package claim . 11 5.3 Conformance rationale 11 5.4 Conformance statement 11 6 Security problem definition . 12 6.1 Assets, users and threat agents . 12 6
12、.2 Threats 12 6.3 Organisational security policies . 13 6.4 Assumptions . 14 7 Security objectives. 14 7.1 Security objectives for the TOE 14 7.2 Security objectives for the operational environment . 16 7.3 Security objectives rationale 18 8 Extended components definition . 22 9 Security requirement
13、s . 23 9.1 Security functional requirements . 23 9.2 Security assurance requirements 38 9.3 Security requirements rationale . 39 Bibliography 45 BS EN 419211-3:2013EN 419211-3:2013 (E) 3 Foreword This document (EN 419211-3:2013) has been prepared by Technical Committee CEN/TC 224 “Personal identific
14、ation, electronic signature and cards and their related systems and operations”, the secretariat of which is held by AFNOR. This European Standard shall be given the status of a national standard, either by publication of an identical text or by endorsement, at the latest by April 2014, and conflict
15、ing national standards shall be withdrawn at the latest by April 2014. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN and/or CENELEC shall not be held responsible for identifying any or all such patent rights. This document s
16、upersedes CWA 14169:2004. This document was submitted to the CEN Enquiry under reference prEN 14169-3. According to the CEN/CENELEC Internal Regulations, the national standards organisations of the following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia
17、, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the
18、United Kingdom. BS EN 419211-3:2013EN 419211-3:2013 (E) 4 Introduction This series of European Standards specifies Common Criteria protection profiles for secure signature creation devices and is issued by the European Committee for Standardization, Information Society Standardization System (CEN/IS
19、SS) as update of the Electronic Signatures (E-SIGN) CEN/ISSS workshop agreement (CWA) 14169:2004, Annex B and Annex C on the protection profile secure signature creation devices, “EAL 4+“. This series of European Standards consists of the following parts: Protection profiles for secure signature cre
20、ation device Part 1: Overview; Protection profiles for secure signature creation device Part 2: Device with key generation; Protection profiles for secure signature creation device Part 3: Device with key import; Protection profiles for secure signature creation device Part 4: Extension for device w
21、ith key generation and trusted channel to certificate generation application; Protection profiles for secure signature creation device Part 5: Extension for device with key generation and trusted channel to signature creation application; Protection profiles for secure signature creation device Part
22、 6: Extension for device with key import and trusted channel to signature creation application. Preparation of this document as a protection profile (PP) follows the rules of the Common Criteria version 3.1 2, 3 and 4. BS EN 419211-3:2013EN 419211-3:2013 (E) 5 1 Scope This European Standard specifie
23、s a protection profile for a secure signature creation device with signing keys import possibility: SSCD with key import (SSCD KI). 2 Normative references The following documents, in whole or in part, are normatively referenced in this document and are indispensable for its application. For dated re
24、ferences, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. prEN 14169-1:2011, Protection profiles for secure signature creation device Part 1: Overview 3 Terms and definitions For the purposes of this document,
25、the acronyms, terms and definitions given in prEN 14169-1:2011 apply. 4 PP introduction 4.1 PP reference Title: Protection profiles for secure signature creation device Part 3: Device with key import Version: 1.0.2 Author: CEN / CENELEC (TC224/WG17) Publication date: 2012-07-24 Registration: BSI-CC-
26、PP-0075 CC version: 3.1 Revision 3 Editor: Arnold Abromeit, TV Informationstechnik GmbH General status: final Keywords: secure signature creation device, electronic signature, digital signature, key import 4.2 PP overview This Protection Profile is established by CEN as a European Standard for produ
27、cts to create electronic signatures. It fulfils requirements of Directive11999/93/ec of the European parliament and of the council of 13 December 1999 on a community framework for electronic signatures. In accordance with article 9 of this European Directive this standard can be indicated by the Eur
28、opean commission in the Official Journal of the European Communities as generally recognised standard for electronic signature products. This protection profile defines security functional requirements and security assurance requirements that comply with those defined in Annex III of the Directive f
29、or a secure signature creation device (SSCD). This secure signature creation device is the target of evaluation (TOE) for this protection profile. 1This European Directive is referred to in this PP as “the directive”. BS EN 419211-3:2013EN 419211-3:2013 (E) 6 European Union Member States may presume
30、 that there is compliance with the requirements laid down in Annex III of the Directive 1 when an electronic signature product is evaluated to a Security Target (ST) that is compliant with this Protection Profile (PP). This Protection Profile describes core security requirements for a secure device
31、that can import a signing key2(signature creation data, SCD) and operates to create electronic signatures with the imported key. A device evaluated according to this protection profile and used in the specified environments can be trusted to create any type of digital signature. As such this PP can
32、be used for any device that has been configured to create a digital signature. Specifically this PP allows the qualification of a product as a device for creating an advanced electronic signature as defined in the Directive. The intent of this Protection Profile is to specify security functional and
33、 assurance requirements defined in the Directive 1, Annex III for secure signature creation devices (SSCD), which is the target of evaluation (TOE). Member States shall presume that there is compliance with the requirements laid down in Annex III of the Directive 1 when an electronic signature produ
34、ct is evaluated to a Security Target (ST) that is compliant with this Protection Profile (PP). EN 419211-3 defines the core security requirements for SSCD importing signature creation data (SCD) and creating advanced electronic signature, which if based on valid qualified certificates are qualified
35、electronic signatures. A SSCD, which fulfils only these core security requirements, may be used by the signatory in a secure environment for signature creation. The CSP will generate SCD/SVD pair in a secure environment and import the SCD into the SSCD so that it can be delivered to the signer with
36、at least one SCD and possibly Certificate info stored in the SSCD. The TOE may implement additional security functions e.g. to support integrity protection of imported data to be signed. The related security requirements are not subject of this core PP but extended PP EN14169-6 “Protection profiles
37、for secure signature creation device Part 6: Device with key import and Trusted Communication with Signature creation application” will address them claiming conformance to this core PP. The assurance level for this PP is EAL4 augmented with AVA_VAN.5. 4.3 TOE overview 4.3.1 Operation of the TOE Thi
38、s subclause presents a functional overview of the TOE in its distinct operational environments: - The preparation environment, where the TOE interacts with a certification service provider (CSP) through a SCD/SVD generation application to import the signature creation data (SCD) and a certificate ge
39、neration application (CGA) to obtain a certificate for the signature validation data (SVD) corresponding to the SCD the certification service provider has generated. The SCD/SVD generation application transmits the SVD to the CGA. The initialisation environment interacts further with the TOE to pers
40、onalise it with the initial value of the reference authentication data (RAD). - The signing environment where the TOE interacts with a signer through a signature creation application (SCA) to sign data after authenticating the signer as its signatory. The signature creation 2An SSCD that can import
41、SCD/SVD was defined in the previous version of this PP (CWA 14169) as a Type 2 SSCD. The notion of types does not exist anymore in this series of ENs. In order to refer to the same functionality, a reference to EN 419211-3 (i.e. Part 3) should be used. BS EN 419211-3:2013EN 419211-3:2013 (E) 7 appli
42、cation provides the data to be signed (DTBS), or a unique representation thereof (DTBS/R) as input to the TOE signature creation function and obtains the resulting digital signature3. - The management environments where the TOE interacts with the user or an SSCD-provisioning service provider to perf
43、orm management operations, e.g. for the signatory to reset a blocked RAD. A single device, e.g. a smart card terminal, may provide the required secure environment for management and signing. The preparation environment, the signing environment and the management environment are secure and protect da
44、ta exchanged with the TOE. Figure 3 in prEN 14169-1:2011 illustrates the operational environment. The TOE stores signature creation data (SCD) and reference authentication data (RAD). The TOE may store multiple instances of SCD. In this case the TOE provides a function to identify each SCD and the S
45、CA can provide an interface to the signer to select an SCD for use in the signature creation function of the SSCD. The TOE protects the confidentiality and integrity of the SCD and restricts its use in signature creation to its signatory. The digital signature created by the TOE may be used to creat
46、e an advanced electronic signature as defined in Article 5.1 of the Directive. Determining the state of the certificate as qualified is beyond the scope of this standard. The signature creation application is assumed to protect the integrity of the input it provides to the TOE signature creation fun
47、ction as being consistent with the user data authorised for signing by the signatory. Unless implicitly known to the TOE, the SCA indicates the kind of the signing input (as DTBS/R) it provides and computes any hash value required. The TOE may augment the DTBS/R with signature parameters it stores a
48、nd then computes a hash value over the input as needed by the kind of input and the used cryptographic algorithm. The TOE stores signatory reference authentication data (RAD) to authenticate a user as its signatory. The RAD is a password (e.g. PIN), a biometric template or a combination of these. Th
49、e TOE protects the confidentiality and integrity of the RAD. The TOE may provide a user interface to directly receive verification authentication data (VAD) from the user, alternatively, the TOE receive the VAD from the signature creation application (SCA). If the signature creation application handles, is requesting or obtaining a VAD from the user, it is assumed to protect the confidentiality and integrity of this data. A certification service provider and a SSCD-provisioning service provider interact with the TOE in the secure prep
