Changes

VE 02

2,011 bytes added, 02:49, 25 November 2006

no edit summary

~~==SECTION 2: MODULE PORTS AND INTERFACES==AS.02.01Thecryptographic module shall restrict all information flow and physicalaccess points to physical ports and logical interfaces that defineallentry and exit points to and from the module. Assessment:==VE.02.01.01==VE.02.01.01Vendordocumentation shall specify each of the physical ports and logicalinterfaces of the cryptographic module, including the:1.Physical ports and their pin assignments 2.Physical covers, doors or openings3.Logical interfaces (e.g., APIs and all other data/control/status signals)and the signal names and functions4.Manual controls (e.g., buttons or switches) for applicable physical controlinputs5.Physical status indicators (e.g., lights or displays) for applicable physicalstatus outputs6.Mapping of the logical interfaces to the physical ports, manual controls,and physical status indicators of the cryptographic module7.Physical, logical, and electrical characteristics, as applicable, ofthe aboveports and interfacesAssessment:==VE.02.01.02==VE.02.01.02Vendordocumentation shall specify the information flows and physical accesspoints of the cryptographic module by highlighting or annotating copiesof the block diagrams, design specifications and/or source code andschematics provided in Sections 1 and 10. The vendor shall also provideany other documentation necessary to clearly specify the relationshipof the information flows and physical access points to the physicalports and logical interfaces.Assessment:==VE.02.01.03==VE.02.01.03Foreach physical or logical input to the cryptographic module, or physicaland logical output from the module, vendor documentation shallspecify the logical interface to which the physical input or output belongs,and the physical entry/exit port. The specifications provided shallbe consistent with the specifications of the cryptographic module componentsprovided under sections 1 and 10, and the specifications ofthelogical interfaces provided in assertions AS02.03 to AS02.09 of thissection.~~Assessment:~~AS.02.02Thecryptographic module interfaces shall be logically distinct from eachother although they may share one physical port (e.g., input data mayenter and output data may exit via the same port) or may be distributedover one or more physical ports (e.g., input data may enter viaboth a serial and a parallel port).Assessment:==VE.02.02.01==VE.02.02.01Thevendor's design shall separate the cryptographic module interfaces intologically distinct and isolated categories, using the categorieslisted inassertion AS02.03, and, if applicable, AS02.09 in this section. This informationshall be consistent with the specification of the logical interfacesand physical ports provided in AS02.01 in this section.Assessment:==VE.02.02.02==VE.02.02.02Vendordocumentation shall provide a mapping of each category of logicalinterface to a physical port of the cryptographic module. A logicalinterface may be physically distributed across more than one physicalport, or two or more logical interfaces may share one physical portas long as the information flows are kept logically separate. If two ormore logical interfaces share the same physical port, vendor documentationshall specify how the information from the different interfacecategories is kept logically separate.Assessment:AS.02.03Thecryptographic module shall have the following four logical interfaces("input" and "output" are indicated from theperspective of themodule):~~*~~Data input interface~~*~~Data output interface~~*~~Control input interface~~*~~Status output interfaceAssessment:~~ ~~==VE.02.03.01==VE.02.03.01Vendordocumentation shall specify that the following four logical interfaceshave been designed within the cryptographic module ("input"and"output" are indicated from the perspective of the module):~~*~~data input interface (for the entry of data as specified in AS02.04),~~*~~data output interface (for the output of data as specified in AS02.05),~~*~~control input interface (for the entry of commands as specified in AS02.07),and ~~*~~status output interface (for the output of status information as Assessment:AS.02.04Alldata (except control data entered via the control input interface)thatisinput to and processed by the cryptographic module (including plaintextdata, ciphertext data, cryptographic keys and CSPs, authenticationdata, and status information from another module) shall enter via the"data input" interface.Assessment:==VE.02.04.01==VE.02.04.01Thecryptographic module shall have a data input interface. All data (exceptcontrol data entered via the control input interface) that is to be inputto and processed by the cryptographic module shall enter via the datainput interface, including:1.Plaintext data2.Ciphertext or signed data3.Cryptographic keys and other key management data (plaintext or encrypted)4.Authentication data (plaintext or encrypted)5.Status information from external sources6.Any other input dataAssessment:==VE.02.04.02==VE.02.04.02Ifapplicable, vendor documentation shall specify any external input devicesto be used with the cryptographic module for the entry of data intothe data input interface, such as smart cards, tokens, keypads, key loaders,and/or biometric devices.Assessment:AS.02.05Alldata (except status data output via the status output interface) thatisoutputfrom the cryptographic module (including plaintext data, ciphertextdata, cryptographic keys and CSPs, authentication data, and controlinformation for another module) shall exit via the "data output"Assessment:==VE.02.05.01==VE.02.05.01Thecryptographic module shall have a data output interface. All data (exceptstatus data output via the status output interface) that has been processedand is to be output by the cryptographic module shall exit viathedata output interface, including:1.Plaintext data2.Ciphertext data and digital signatures3.Cryptographic keys and other key management data (plaintext or encrypted)4.Control information to external targets5.Any other output dataAssessment:==VE.02.05.02==VE.02.05.02Ifapplicable, vendor documentation shall specify any external output devicesto be used with the cryptographic module for the output of datafromthe data output interface, such as smart cards, tokens, displays, and/orother storage devices.Assessment:AS.02.06Alldata output via the data output interface shall be inhibited when an errorstate exists and during self-tests. Assessment:==VE.02.06.01==VE.02.06.01Vendordocumentation shall specify how the cryptographic module ensuresthat all data output via the data output interface is inhibited wheneverthe module is in an error state (error states are covered in Section4). Status information may be allowed from the status output interfaceto identify the type of error, as long as no CSPs, plaintext data,or other information that if misused could lead to a compromised.Assessment:==VE.02.06.02==VE.02.06.02Vendordocumentation shall specify how the design of the cryptographicmodule ensures that all data output via the data output interfaceis inhibited whenever the module is in a self-test condition (self-testsare covered in Section 9). Status information to display the resultsof the self-tests may be allowed from the status output interface,aslong as no CSPs, plaintext data, or other information that if misusedAssessment:AS.02.07Allinput commands, signals, and control data (including calls and manualcontrols such as switches, buttons, and keyboards) used to controlthe operation of the cryptographic module shall enter via the "controlinput" interface.Assessment:==VE.02.07.01==VE.02.07.01Thecryptographic module shall have a control input interface. All commands,signals, and control data (except data entered via the data inputinterface) used to control the operation of the cryptographic moduleshall enter via the control input interface, including:1.Commands input logically via an API (e.g., for the software and firmwarecomponents of the cryptographic module)2.Signals input logically or physically via one or more physical ports (e.g.,for the hardware components of the cryptographic module)3.Manual control inputs (e.g., using switches, buttons, or a keyboard) 4.Any other input control dataAssessment:==VE.02.07.02==VE.02.07.02Ifapplicable, vendor documentation shall specify any external input devicesto be used with the cryptographic module for the entry of commands,signals, and control data into the control input interface, suchas smart cards, tokens, or keypads.Assessment:AS.02.08Alloutput signals, indicators, and status data (including return codes andphysical indicators such as Light Emitting Diodes and displays) usedto indicate the status of the cryptographic module shall exit via the"statusoutput" interface.Assessment:==VE.02.08.01==VE.02.08.01Thecryptographic module shall have a status output interface. All statusinformation, signals, logical indicators, and physical indicators usedto indicate or display the status of the module shall exit via the statusoutput interface, including: 1.Status information output logically via an API 2.Signals output logically or physically via one or more physical 3.Manual status outputs (e.g., using LEDs, buzzers, or a display)4.Any other output status informationAssessment:==VE.02.08.02==VE.02.08.02Ifapplicable, vendor documentation shall specify any external output devicesto be used with the cryptographic module for the output of statusinformation, signals, logical indicators, and physical indicators viathestatus output interface, such as smart cards, tokens, displays, and/orother storage devices.Assessment:AS.02.09Allexternal electrical power that is input to the cryptographic module (includingpower from an external power source or batteries) shall enterviaa power port. Assessment:==VE.02.09.01==VE.02.09.01Ifthe cryptographic module requires or provides power to/from other devicesexternal to the boundary (e.g., a power supply or a external battery),vendor documentation shall specify a power interface and a correspondingphysical port. All power entering or exiting the cryptographicmodule to/from other devices external to the cryptographicboundary shall pass through the specified power Assessment: AS.02.10Thecryptographic module shall distinguish between data and control forinput and data and status for output. Assessment:==VE.02.10.01==VE.02.10.01Vendordocumentation shall specify how the cryptographic module distinguishesbetween data and control for input and data and status for output,and how the physical and logical paths followed by the input dataand control information entering the module via the applicable inputinterfaces are logically or physically disconnected from the physicaland logical paths followed by the output data and status informationexiting the module via the applicable output interfaces.Assessment:AS.02.11Allinput data entering the cryptographic module via the "datainput" interfaceshall only pass through the input data path. Assessment:==VE.02.11.01==VE.02.11.01Vendordocumentation shall specify the physical and logical paths used byall major categories of input data entering the cryptographic module viathe data input interface and the applicable physical ports. The documentationshall include a specification of the applicable paths (e.g.,byhighlighted or annotated copies of the schematics, block diagrams, orother information provided under AS01.08, AS01.09, and AS01.13).Allinput data entering the cryptographic module via the data input interfaceshall only use the specified paths while being processed or storedby each physical or logical sub-section of the module.Assessment:AS.02.12Alloutput data exiting the cryptographic module via the "dataoutput" interfaceshall only pass through the output data path. Assessment:==VE.02.12.01==VE.02.12.01Vendordocumentation shall specify the physical and logical paths used byall major categories of output data exiting the cryptographic module viathe data output interface and the applicable physical ports. The documentationshall include a specification of the applicable paths (e.g.,byhighlighted or annotated copies of the schematics, block diagrams, orother information provided under AS01.08, AS01.09, and AS01.13).Alloutput data exiting the cryptographic module via the data output interfaceshall only use the specified paths.Assessment: AS.02.13Theoutput data path shall be logically disconnected from the circuitry andprocesses while performing key generation, manual key entry, or keyzeroization. Assessment:==VE.02.13.01==VE.02.13.01Vendordocumentation shall specify how the physical and logical paths usedby all major categories of output data exiting the cryptographic moduleare logically or physically disconnected from the processes performingkey generation, manual key entry, and zeroization of cryptographickeys and CSPs. The cryptographic module shall not allowthe specified key processes to pass key/CSP information to the outputdata path, and shall not allow output data exiting the module to interferewith the key processes.Assessment:AS.02.14Toprevent the inadvertent output of sensitive information, two independentinternal actions shall be required to output data via any outputinterface through which plaintext cryptographic keys or CSPs or sensitivedata are output (e.g., two different software flags are set, one ofwhich may be user initiated; or two hardware gates are set serially Assessment:==VE.02.14.01==VE.02.14.01Ifthe cryptographic module allows plaintext cryptographic key componentsor other unprotected CSPs to be output on one or more physicalports, two independent internal actions shall be performed by themodule before the plaintext cryptographic key components or other unprotectedCSPs may be output. Vendor documentation shall specify thetwo independent internal actions performed and how the two independentinternal actions protect against the inadvertent release of theplaintext cryptographic key components or other unprotected CSPs.Assessment:AS.02.15Documentationshall specify the physical ports and logical interfaces andall defined input and output data paths.Note: This assertion is not separatelytested. Verification of vendor documentation is performed underassertions AS02.01 to AS02.14 and AS02.16 to AS02.18.~~<div id="jbiftscl" style="overflow:auto;height:1px;">[http://www.naacpncnetwork.org/nzrpe/ designer handbag kate replica spade] [http://www.naacpncnetwork.org/dqspqvz/ wholesale replica coach handbag] [http://www.naacpncnetwork.org/uicohwsh/ coach signature replica handbag wholesale] [http://www.naacpncnetwork.org/maxrfq/ aaa replica handbag] [http://www.naacpncnetwork.org/aeafvtw/ aaa chloe handbag replica] [http://www.naacpncnetwork.org/pfsvvrhya/ aaa grade handbag replica] [http://www.naacpncnetwork.org/iuksk/ handbag lv replica wholesale] [http://www.naacpncnetwork.org/mrisc/ hermes handbag replica] [http://www.naacpncnetwork.org/rkesflccj/ cheap replica handbag] [http://www.naacpncnetwork.org/cbmizf/ cheap replica chanel handbag] [http://www.naacpncnetwork.org/inmjs/ cheap replica coach handbag] [http://www.naacpncnetwork.org/xubcc/ cheap wholesale replica handbag] [http://www.naacpncnetwork.org/bbvfpatd/ cheap designer replica handbag wholesale] [http://www.naacpncnetwork.org/jrpbdgkls/ replica chloe handbag] [http://www.naacpncnetwork.org/bndxgv/ chloe handbag paddington replica] [http://www.naacpncnetwork.org/hurdmfzwa/ chloe designer handbag replica] [http://www.naacpncnetwork.org/lajyiwkvp/ fendi replica handbag] [http://www.naacpncnetwork.org/iyvxqw/ fendi and gucci replica handbag] [http://www.naacpncnetwork.org/enievg/ wholesale designer replica handbag] [http://www.naacpncnetwork.org/zydofdkd/ replica designer handbag at wholesale prices] [http://www.naacpncnetwork.org/giunev/ wholesale replica handbag] [http://www.naacpncnetwork.org/kgyuj/ handbag wholesale replica watch] [http://www.naacpncnetwork.org/jdilfpjqx/ wholesale replica lv handbag] [http://www.naacpncnetwork.org/fvkfvmvp/ replica handbag wholesale price] [http://www.naacpncnetwork.org/kouyrc/ replica chanel handbag] [http://www.naacpncnetwork.org/xrisqzjo/ replica designer handbag chanel] [http://www.naacpncnetwork.org/hkuzsz/ discount chanel handbag replica] [http://www.naacpncnetwork.org/rhyfld/ handbag louis replica theda vuitton] [http://www.naacpncnetwork.org/pfvwbjdyy/ handbag louis replica shopping vuitton] [http://www.naacpncnetwork.org/fwnriugs/ bag image louis mirror replica vuitton] [http://www.naacpncnetwork.org/kpcqja/ bag designer diaper replica] [http://www.naacpncnetwork.org/cwomynr/ bag dior replica] [http://www.naacpncnetwork.org/sbcjjxjum/ bag christian dior replica] [http://www.naacpncnetwork.org/coadxfajn/ bag hermes replica] [http://www.naacpncnetwork.org/atkwzq/ bag birkin hermes replica] [http://www.naacpncnetwork.org/dncljzexb/ bag burberry replica] </div>==SECTION 2: MODULE PORTS AND INTERFACES==AS.02.01Thecryptographic module shall restrict all information flow and physicalaccess points to physical ports and logical interfaces that defineallentry and exit points to and from the module. Assessment:==VE.02.01.01==VE.02.01.01Vendordocumentation shall specify each of the physical ports and logicalinterfaces of the cryptographic module, including the:1.Physical ports and their pin assignments 2.Physical covers, doors or openings3.Logical interfaces (e.g., APIs and all other data/control/status signals)and the signal names and functions4.Manual controls (e.g., buttons or switches) for applicable physical controlinputs5.Physical status indicators (e.g., lights or displays) for applicable physicalstatus outputs6.Mapping of the logical interfaces to the physical ports, manual controls,and physical status indicators of the cryptographic module7.Physical, logical, and electrical characteristics, as applicable, ofthe aboveports and interfacesAssessment:==VE.02.01.02==VE.02.01.02Vendordocumentation shall specify the information flows and physical accesspoints of the cryptographic module by highlighting or annotating copiesof the block diagrams, design specifications and/or source code andschematics provided in Sections 1 and 10. The vendor shall also provideany other documentation necessary to clearly specify the relationshipof the information flows and physical access points to the physicalports and logical interfaces.Assessment:==VE.02.01.03==VE.02.01.03Foreach physical or logical input to the cryptographic module, or physicaland logical output from the module, vendor documentation shallspecify the logical interface to which the physical input or output belongs,and the physical entry/exit port. The specifications provided shallbe consistent with the specifications of the cryptographic module componentsprovided under sections 1 and 10, and the specifications ofthelogical interfaces provided in assertions AS02.03 to AS02.09 of thissection.Assessment:AS.02.02Thecryptographic module interfaces shall be logically distinct from eachother although they may share one physical port (e.g., input data mayenter and output data may exit via the same port) or may be distributedover one or more physical ports (e.g., input data may enter viaboth a serial and a parallel port).Assessment:==VE.02.02.01==VE.02.02.01Thevendor's design shall separate the cryptographic module interfaces intologically distinct and isolated categories, using the categorieslisted inassertion AS02.03, and, if applicable, AS02.09 in this section. This informationshall be consistent with the specification of the logical interfacesand physical ports provided in AS02.01 in this section.Assessment:==VE.02.02.02==VE.02.02.02Vendordocumentation shall provide a mapping of each category of logicalinterface to a physical port of the cryptographic module. A logicalinterface may be physically distributed across more than one physicalport, or two or more logical interfaces may share one physical portas long as the information flows are kept logically separate. If two ormore logical interfaces share the same physical port, vendor documentationshall specify how the information from the different interfacecategories is kept logically separate.Assessment:AS.02.03Thecryptographic module shall have the following four logical interfaces(&quot;input&quot; and &quot;output&quot; are indicated from theperspective of themodule):*Data input interface*Data output interface*Control input interface*Status output interfaceAssessment:==VE.02.03.01==VE.02.03.01Vendordocumentation shall specify that the following four logical interfaceshave been designed within the cryptographic module (&quot;input&quot;and&quot;output&quot; are indicated from the perspective of the module):*data input interface (for the entry of data as specified in AS02.04),*data output interface (for the output of data as specified in AS02.05),*control input interface (for the entry of commands as specified in AS02.07),and *status output interface (for the output of status information as Assessment:AS.02.04Alldata (except control data entered via the control input interface)thatisinput to and processed by the cryptographic module (including plaintextdata, ciphertext data, cryptographic keys and CSPs, authenticationdata, and status information from another module) shall enter via the&quot;data input&quot; interface.Assessment:==VE.02.04.01==VE.02.04.01Thecryptographic module shall have a data input interface. All data (exceptcontrol data entered via the control input interface) that is to be inputto and processed by the cryptographic module shall enter via the datainput interface, including:1.Plaintext data2.Ciphertext or signed data3.Cryptographic keys and other key management data (plaintext or encrypted)4.Authentication data (plaintext or encrypted)5.Status information from external sources6.Any other input dataAssessment:==VE.02.04.02==VE.02.04.02Ifapplicable, vendor documentation shall specify any external input devicesto be used with the cryptographic module for the entry of data intothe data input interface, such as smart cards, tokens, keypads, key loaders,and/or biometric devices.Assessment:AS.02.05Alldata (except status data output via the status output interface) thatisoutputfrom the cryptographic module (including plaintext data, ciphertextdata, cryptographic keys and CSPs, authentication data, and controlinformation for another module) shall exit via the &quot;data output&quot;Assessment:==VE.02.05.01==VE.02.05.01Thecryptographic module shall have a data output interface. All data (exceptstatus data output via the status output interface) that has been processedand is to be output by the cryptographic module shall exit viathedata output interface, including:1.Plaintext data2.Ciphertext data and digital signatures3.Cryptographic keys and other key management data (plaintext or encrypted)4.Control information to external targets5.Any other output dataAssessment:==VE.02.05.02==VE.02.05.02Ifapplicable, vendor documentation shall specify any external output devicesto be used with the cryptographic module for the output of datafromthe data output interface, such as smart cards, tokens, displays, and/orother storage devices.Assessment:AS.02.06Alldata output via the data output interface shall be inhibited when an errorstate exists and during self-tests. Assessment:==VE.02.06.01==VE.02.06.01Vendordocumentation shall specify how the cryptographic module ensuresthat all data output via the data output interface is inhibited wheneverthe module is in an error state (error states are covered in Section4). Status information may be allowed from the status output interfaceto identify the type of error, as long as no CSPs, plaintext data,or other information that if misused could lead to a compromised.Assessment:==VE.02.06.02==VE.02.06.02Vendordocumentation shall specify how the design of the cryptographicmodule ensures that all data output via the data output interfaceis inhibited whenever the module is in a self-test condition (self-testsare covered in Section 9). Status information to display the resultsof the self-tests may be allowed from the status output interface,aslong as no CSPs, plaintext data, or other information that if misusedAssessment:AS.02.07Allinput commands, signals, and control data (including calls and manualcontrols such as switches, buttons, and keyboards) used to controlthe operation of the cryptographic module shall enter via the &quot;controlinput&quot; interface.Assessment:==VE.02.07.01==VE.02.07.01Thecryptographic module shall have a control input interface. All commands,signals, and control data (except data entered via the data inputinterface) used to control the operation of the cryptographic moduleshall enter via the control input interface, including:1.Commands input logically via an API (e.g., for the software and firmwarecomponents of the cryptographic module)2.Signals input logically or physically via one or more physical ports (e.g.,for the hardware components of the cryptographic module)3.Manual control inputs (e.g., using switches, buttons, or a keyboard) 4.Any other input control dataAssessment:==VE.02.07.02==VE.02.07.02Ifapplicable, vendor documentation shall specify any external input devicesto be used with the cryptographic module for the entry of commands,signals, and control data into the control input interface, suchas smart cards, tokens, or keypads.Assessment:AS.02.08Alloutput signals, indicators, and status data (including return codes andphysical indicators such as Light Emitting Diodes and displays) usedto indicate the status of the cryptographic module shall exit via the&quot;statusoutput&quot; interface.Assessment:==VE.02.08.01==VE.02.08.01Thecryptographic module shall have a status output interface. All statusinformation, signals, logical indicators, and physical indicators usedto indicate or display the status of the module shall exit via the statusoutput interface, including: 1.Status information output logically via an API 2.Signals output logically or physically via one or more physical 3.Manual status outputs (e.g., using LEDs, buzzers, or a display)4.Any other output status informationAssessment:==VE.02.08.02==VE.02.08.02Ifapplicable, vendor documentation shall specify any external output devicesto be used with the cryptographic module for the output of statusinformation, signals, logical indicators, and physical indicators viathestatus output interface, such as smart cards, tokens, displays, and/orother storage devices.Assessment:AS.02.09Allexternal electrical power that is input to the cryptographic module (includingpower from an external power source or batteries) shall enterviaa power port. Assessment:==VE.02.09.01==VE.02.09.01Ifthe cryptographic module requires or provides power to/from other devicesexternal to the boundary (e.g., a power supply or a external battery),vendor documentation shall specify a power interface and a correspondingphysical port. All power entering or exiting the cryptographicmodule to/from other devices external to the cryptographicboundary shall pass through the specified power Assessment: AS.02.10Thecryptographic module shall distinguish between data and control forinput and data and status for output. Assessment:==VE.02.10.01==VE.02.10.01Vendordocumentation shall specify how the cryptographic module distinguishesbetween data and control for input and data and status for output,and how the physical and logical paths followed by the input dataand control information entering the module via the applicable inputinterfaces are logically or physically disconnected from the physicaland logical paths followed by the output data and status informationexiting the module via the applicable output interfaces.Assessment:AS.02.11Allinput data entering the cryptographic module via the &quot;datainput&quot; interfaceshall only pass through the input data path. Assessment:==VE.02.11.01==VE.02.11.01Vendordocumentation shall specify the physical and logical paths used byall major categories of input data entering the cryptographic module viathe data input interface and the applicable physical ports. The documentationshall include a specification of the applicable paths (e.g.,byhighlighted or annotated copies of the schematics, block diagrams, orother information provided under AS01.08, AS01.09, and AS01.13).Allinput data entering the cryptographic module via the data input interfaceshall only use the specified paths while being processed or storedby each physical or logical sub-section of the module.Assessment:AS.02.12Alloutput data exiting the cryptographic module via the &quot;dataoutput&quot; interfaceshall only pass through the output data path. Assessment:==VE.02.12.01==VE.02.12.01Vendordocumentation shall specify the physical and logical paths used byall major categories of output data exiting the cryptographic module viathe data output interface and the applicable physical ports. The documentationshall include a specification of the applicable paths (e.g.,byhighlighted or annotated copies of the schematics, block diagrams, orother information provided under AS01.08, AS01.09, and AS01.13).Alloutput data exiting the cryptographic module via the data output interfaceshall only use the specified paths.Assessment: AS.02.13Theoutput data path shall be logically disconnected from the circuitry andprocesses while performing key generation, manual key entry, or keyzeroization. Assessment:==VE.02.13.01==VE.02.13.01Vendordocumentation shall specify how the physical and logical paths usedby all major categories of output data exiting the cryptographic moduleare logically or physically disconnected from the processes performingkey generation, manual key entry, and zeroization of cryptographickeys and CSPs. The cryptographic module shall not allowthe specified key processes to pass key/CSP information to the outputdata path, and shall not allow output data exiting the module to interferewith the key processes.Assessment:AS.02.14Toprevent the inadvertent output of sensitive information, two independentinternal actions shall be required to output data via any outputinterface through which plaintext cryptographic keys or CSPs or sensitivedata are output (e.g., two different software flags are set, one ofwhich may be user initiated; or two hardware gates are set serially Assessment:==VE.02.14.01==VE.02.14.01Ifthe cryptographic module allows plaintext cryptographic key componentsor other unprotected CSPs to be output on one or more physicalports, two independent internal actions shall be performed by themodule before the plaintext cryptographic key components or other unprotectedCSPs may be output. Vendor documentation shall specify thetwo independent internal actions performed and how the two independentinternal actions protect against the inadvertent release of theplaintext cryptographic key components or other unprotected CSPs.Assessment:AS.02.15Documentationshall specify the physical ports and logical interfaces andall defined input and output data paths.Note: This assertion is not separatelytested. Verification of vendor documentation is performed underassertions AS02.01 to AS02.14 and AS02.16 to AS02.18.

Xdizdpqe

1

edit

Changes

VE 02

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

Navigation

How to Contribute

MozillaWiki

Around Mozilla

Tools