Skip to content

JISEC-C0499.md

Latest commit

 

History

History
36 lines (24 loc) · 3.64 KB

JISEC-C0499.md

File metadata and controls

36 lines (24 loc) · 3.64 KB
Raw

Introduction

JISEC-C0499 was developed by Passport Division, Consular Affairs Bureau, Ministry of Foreign Affairs of Japan, evaluated by ECSEC Laboratory, an Evaluation Facility in Japan, and certified by JISEC, CC Certification Body in Japan.

Section 6.1.11 FCS_RND.1 Quality standards for random numbers

In Note 6-5, it is stated as follows:

When implementing ECDSA calculation defined by FCS_COP.1a with high-level software, the ST author shall iterate this requirement for the quality of random numbers generated in the calculation process.

Note here that almost the same content as this note is again pointed out in EXAMPLE 1 in E3.2.1 of CC:2022 Part 1.

The underlying thought would be as follows:

ECDSA signature generation requires a per-message secret, or a random number and its length is equal to key length. For example, if NIST P-256 curve is used, then 256-bit random number is required. If a physical random number generator is directly used to generate the random number, it would be time consuming to generate such length of random number by using narrow output bit-length of typical physical random number generators. Also FIPS 186-5 requires DRBG specified by NIST SP800-90A. So it is not likely to use a physical random number generator directly in the ECDSA signature generation and/or in elliptic curve key pair generation.

Let us investigate whether the above note is really followed.

Recently new Security Target was released claiming conformance to this PP.

In the Security Target, FCS_RND appears only once and Class PTG2 of the AIS31 is assigned to defined quality standard, and it is claimed that the random numbers for ephemeral key pairs generation are generated by using the TRNG, under Section 8.2.2. Note here that TRNG stands for True Random Number Generator.

  • It is stated that FCS_CKM.1e depends on FCS_CKM.1/EC-3 specified in the platform security target.
  • The referenced FCS_CKM.1/EC-3 claims conformance to ANSI X9.62-2005 as stated in the platform security target,
  • ANSI X9.62-2005 requests approved random number generator conforming to ANSI X9.82 standard.
  • Here ANSI X9.82 standard specifies NRBG and DRBG, however, there is no approved NRBG conforming to ANSI X9.82 standard.

From the above, the unique solution is to use DRBG, or hybrid DRNG as in BSI AIS 20 / AIS 31, for random number generation to be used inside ECDSA signature generation and/or elliptic curve key pair generation.

If so, FCS_CKM.1e shoud use hybrid DRNG, while the DRNG is not associated with any SFR in the Passport Security Target, therefore the DRNG is considered not SFR-enforcing.

Finally we can conclude that the original note in the PP has been neglected in the Security Target, which would raise questions for procurement authorities whether the TOE meets the PP.