update fp usage

Author: marcj-l

input/stip.xml

@@ -315,6 +315,14 @@
     	Package Usage guidance defined in the TOE's relevant Base-PP applies to the usage of the packages for this module, unless explicitly stated otherwise in this section.
       <package-usage-list>
         <package-usage ref="X509">
+          <usage id="usage-x509-iteration" title="Required Iteration of X.509 Package Requirements for STIP Operations">
+            <description>
+              The ST author shall include an iteration of the <xref to="X509"/> requirements in the ST for STIP purposes using the suffix "STIP".
+            </description>
+            <config>
+              <ref-id>dummy-ref-id</ref-id>
+            </config>
+          </usage>
           <usage id="usage-x509-roles" title="Required Role Selections in FIA_XCU_EXT.1.1">
             <description>
             The ST author shall select the option to validate X.509 certificates in FIA_XCU_EXT.1.1. If the TOE supports certificate-based authentication for EST operations, the ST author shall also select the option to assert certificate identities.
@@ -323,6 +331,43 @@
               <ref-id>dummy-ref-id</ref-id>
             </config>
           </usage>
+          <usage id="usage-x509-extensions" title="Required Extension Processing in FIA_X509_EXT.1.2">
+            <description>
+              The ST author shall select the option to process the basic constraints and extended key usage extensions.
+            </description>
+            <config>
+              <ref-id>dummy-ref-id</ref-id>
+            </config>
+          </usage>
+          <usage id="usage-x509-revocation-methods" title="CRL or OCSP-based Revocation Required for FIA_X509_EXT.1.3 ">
+						<description>
+						The TOE must support revocation that only involves CRL or OCSP. Accordingly, the TOE shall select only from options involving CRL or OCSP in FIA_X509_EXT.1.3 (e.g., the selection to treat all certificates older than a given short timeframe is not an acceptable substitute or alternative 
+            for supporting CRL or OCSP).
+						</description> 
+						<config>
+						<ref-id>dummy-ref-id</ref-id>
+						</config>
+					</usage>
+          <usage id="usage-x509-revocation-connections" title="Connections to CRL or OCSP Servers Required for FIA_X509_EXT.1.4">
+						<description>
+						Because the TOE is required to support CRL or OCSP, the TSF shall support an appropriate mechanism for obtaining revocation status information. In the case of CRL, the ST author shall claim that revocation status information is obtained via network connection to a CRL distribution point. 
+            In the case of OCSP, the ST author shall claim that revocation status information is obtained via network connection to an OCSP responder, via OCSP stapling, or via OCSP multi-stapling.
+						</description>
+						<config>
+						<ref-id>dummy-ref-id</ref-id>
+						</config>
+					</usage>
+          <usage id="usage-x509-eku-values" title="Restrictions on Acceptable Key Usage Values for FIA_X509_EXT.1.5">
+            <description>
+              The TOE will always support the use of extendedKeyUsage values to verify that X.509 certificates are used in accordance with their intended purpose. Accordingly, the ST author shall claim that the TOE supports the processing of extendedKeyUsage fields in the leaf certificate (as opposed 
+              to application of trust store context rules or passing the certification path or other supported context information to an external function) and shall select all values that are relevant to the claimed uses of X.509 in the ST. In particular, the ST author shall include the options to require 
+              TLS servers to have the Server Authentication key purpose, TLS clients to have the Client Authentication key purpose, OCSP signers to have the OCSP signing key purpose, and update signing certificates to have the Code Signing key purpose.
+              The ST author shall utilize the assignment for other EKU values to specify that certificates must not contain the 'any' key purpose.
+            </description>
+            <config>
+              <ref-id>dummy-ref-id</ref-id>
+            </config>
+          </usage>
         </package-usage>
         <package-usage ref="tls">
           <usage id="usage-tls-roles" title="Required Selections in FCS_TLS_EXT.1.1">