Section C Table IV: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
No edit summary
 
mNo edit summary
 
Line 14: Line 14:
       </tr>
       </tr>
         <tr>
         <tr>
       <th rowspan="15">Certificate <br>
       <th rowspan="15">Certificate<br>Storage and <br>Retrieval</th>
      Storage and <br>
      Retrieval</th>


         <td rowspan="4">AddCertToPermDB()</td>
         <td rowspan="4">AddCertToPermDB()</td>
Line 516: Line 514:


         <tr>
         <tr>
       <th rowspan="24">Key <br>
       <th rowspan="24">Key<br>Generation</th>
      Generation</th>
         <td rowspan="3">PQG_ParamGen()</td>
         <td rowspan="3">PQG_ParamGen()</td>
         <td>PQGParams</td>
         <td>PQGParams</td>
Line 771: Line 768:
       </tr>
       </tr>
         <tr>
         <tr>
       <th rowspan="12">PKCS #5 <br>
       <th rowspan="12">PKCS #5<br>Password-Based<br>Encryption</th>
      Password-Based <br>
      Encryption</th>
         <td rowspan="2">SEC_PKCS5GetSalt()</td>
         <td rowspan="2">SEC_PKCS5GetSalt()</td>
         <td>SECAlgorithmID</td>
         <td>SECAlgorithmID</td>
Line 900: Line 895:
       </tr>
       </tr>
         <tr>
         <tr>
       <th rowspan="12">PKCS #12 <br>
       <th rowspan="12">PKCS #12<br>Personal<br>Information<br>Exchange</th>
 
      Personal <br>
      Information <br>
      Exchange</th>
         <td>SEC_PKCS12CreateExportContext()</td>
         <td>SEC_PKCS12CreateExportContext()</td>
         <td>SEC_PKCS12ExportContext</td>
         <td>SEC_PKCS12ExportContext</td>
Line 1,035: Line 1,026:
       </tr>
       </tr>
         <tr>
         <tr>
       <th rowspan="4">Prime <br>
       <th rowspan="4">Prime<br>Number<br>Generation</th>
      Number <br>
      Generation</th>


         <td rowspan="2">mpp_make_prime()</td>
         <td rowspan="2">mpp_make_prime()</td>
Line 1,081: Line 1,070:
       </tr>
       </tr>
         <tr>
         <tr>
       <th rowspan="15">Private Key <br>
       <th rowspan="15">Private Key<br>Storage and<br>Retrieval</th>
      Storage and <br>
 
      Retrieval</th>
         <td>SECKEY_CloseKeyDB()</td>
         <td>SECKEY_CloseKeyDB()</td>
         <td>SECKEYKeyDBHandle</td>
         <td>SECKEYKeyDBHandle</td>
Line 1,243: Line 1,229:
       </tr>
       </tr>
         <tr>
         <tr>
       <th rowspan="4">Pseudorandom <br>
       <th rowspan="4">Pseudorandom<br>Number<br>Generation</th>
 
      Number <br>
      Generation</th>
         <td>RNG_RNGInit()</td>
         <td>RNG_RNGInit()</td>
         <td>SECStatus</td>
         <td>SECStatus</td>
Line 1,292: Line 1,275:


         <tr>
         <tr>
       <th rowspan="7">SSL Session ID <br>
       <th rowspan="7">SSL Session ID<br>Cache<br>(Secret<br>Management)</th>
      Cache <br>
      (Secret <br>
      Management)</th>
         <td rowspan="2">ssl_ChooseSessionIDProcs()</td>
         <td rowspan="2">ssl_ChooseSessionIDProcs()</td>


Line 1,384: Line 1,364:
       </tr>
       </tr>
                          
                          
  </tbody>     
</table>
             
<h2> <a name="means"></a>
  1.8 Means of Access</h2>
      Prior to execution of the Client or Server products, the Security
Libraries    are stored on disk in compiled binary form. NSS<i> relies on
Discretionary    Access Controls (DAC)</i> to protect the binary image from
being tampered    with.     
<h2> <a name="zero"></a>
  1.9 Zeroization</h2>
      Within the Security Libraries, there are a number of explicit zeroization
  steps that are taken to clear the memory region previously occupied by
a  private key or password.  In summary, private keys are not stored in plaintext.
  Any key material that has been unwrapped for use is zeroed once the use
is complete.  The function used to both zero and free memory used by private
key material is PORT_ZFree().   
<h2> <a name="role-based"></a>
  1.10 Role-based Authentication</h2>
      Since all NSS-based products utilize role-based authentication, and
all  products use a single-role mechanism referred to above as a NSS User,
authentication  shall always be required upon initializing the FIPS Cryptographic
Module.  This is true of all NSS-based client and server products, and
shall  be handled  via the PKCS #11 mechanism of required authentication.
     
<h2> <a name="identity"></a>
  1.11 Identity-based Authentication</h2>
      This section is not applicable to NSS since it is only applicable
to  products  attempting to be certified to security level three or four.<br>
      <br>
         
<h2><a name="results"></a>
  Results of FIPS 140-1 Level 2 Maintenance Validation  of NSS 3.2.2</h2>
         
<table width="100%" border="1" cellspacing="2" cellpadding="2">
        <tbody>
          <tr>
            <td valign="Top" align="Center"><font size="+1"><b>FIPS 140-1
      <br>
      Section<br>
            </b></font></td>
            <td valign="Top" align="Center"><font size="+1"><b>Description<br>
            </b></font></td>
            <td valign="Top" align="Center"><font size="+1"><b>Validation<br>
      Level <br>
      Obtained<br>
            </b></font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">1.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Cryptographic Modules<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">2.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Module Interfaces<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">3.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Roles and Services<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">4.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Finite State Machine Model<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">5.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Physical Security<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">6.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Software Security<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">7.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Operating System Security<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">8.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Cryptographic Key Management<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">9.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Cryptographic Algorithms<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">10.0<br>
            </font></td>
            <td valign="Top"><font size="+1">EMI/EMC<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">11.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Self-Tests<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2</font><br>
            </td>
          </tr>
                     
  </tbody>     
</table>
      <br>
     
<h2><a name="results"></a>
  Results of FIPS 140-1 Level 1 Maintenance Validation  of NSS 3.2.2</h2>
         
<table width="100%" border="1" cellspacing="2" cellpadding="2">
        <tbody>
          <tr>
            <td valign="Top" align="Center"><font size="+1"><b>FIPS 140-1
      <br>
      Section<br>
            </b></font></td>
            <td valign="Top" align="Center"><font size="+1"><b>Description<br>
            </b></font></td>
            <td valign="Top" align="Center"><font size="+1"><b>Validation<br>
      Level <br>
      Obtained<br>
            </b></font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">1.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Cryptographic Modules<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">1<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">2.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Module Interfaces<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">1<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">3.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Roles and Services<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">2<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">4.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Finite State Machine Model<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">1<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">5.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Physical Security<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">1<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">6.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Software Security<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">1<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">7.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Operating System Security<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">1<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">8.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Cryptographic Key Management<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">1<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">9.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Cryptographic Algorithms<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">1<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">10.0<br>
            </font></td>
            <td valign="Top"><font size="+1">EMI/EMC<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">1<br>
            </font></td>
          </tr>
          <tr>
            <td valign="Top" align="Left"><font size="+1">11.0<br>
            </font></td>
            <td valign="Top"><font size="+1">Self-Tests<br>
            </font></td>
            <td valign="Top" align="Center"><font size="+1">1</font><br>
            </td>
          </tr>
                     
  </tbody>     
</table>
      <br>
         
<h2><a name="platforms"></a>
  Platform List</h2>
     
<p>To meet the FIPS 140-1 level 1 requirement, the operating system on which
  NSS runs must allow only one user at a time.</p>
 
<p> Windows 95, 98, and Me are single-user operating systems.  Other operating
systems (Windows NT 4.0, Windows 2000, SunOS, Linux, AIX, HP-UX, and OSF1)
must be running in single-user mode.</p>
 
<p>For the level 2 certificate, the platform validated was a Sun Ultra 1
running Solaris 8 and was configured according to the specifications listed
in the Common Criteria documents referred to in the link below</p>
 
<p></p>
 
<div><span style="color: red; "><font color="#0000ff"><a href="http://www.commoncriteria.org/ccc/epl/productType/epldetail.jsp?id=42">
  http://www.commoncriteria.org/ccc/epl/productType/epldetail.jsp?id=42</a>
  </font></span></div>
   
<p><br>
  </p>
         
<table cellpadding="2" cellspacing="2" border="1" width="100%">
        <tbody>
          <tr>
            <td valign="Middle" align="Center"><big><b>Platform Validated<br>
            </b></big></td>
            <td valign="Top" align="Center"><big><b>Level<br>
      Obtained<br>
            </b></big></td>
          </tr>
          <tr>
            <td valign="Top"><big>Windows 98</big><br>
        </td>
            <td valign="Top" align="Center"><big>1</big><big><br>
            </big></td>
          </tr>
                                                  <tr>
            <td valign="Top"><big>SunOS 5.8</big><br>
          </td>
            <td valign="Top" align="Center"><big>2</big><br>
            </td>
          </tr>
                     
  </tbody>     
</table>
</table>
  <br>

Latest revision as of 01:37, 13 April 2006

Table IV. Service Routine to Security Relevant Data Items Matrix
Service Service Routine Security Relevant Data Item Read
Access
Write
Access
Certificate
Storage and
Retrieval
AddCertToPermDB() CERTCertDBHandle
X
X
CERTCertificate
X
X
CERTCertTrust
X
X
certDBEntryCert
X
-
CERT_ClosePermCertDB() CERTCertDBHandle
X
X
SEC_FindPermCertByKey() CERTCertDBHandle
X
X
SECItem
X
X
certDBEntryCert
X
-
SEC_OpenPermCertDB() CERTCertDBHandle
X
X
SECStatus
X
-
SEC_DeletePermCertificate() CERTCertDBHandle
X
X
CERTCertificate
X
X
SECStatus
X
-
SEC_TraversePermCerts() CERTCertDBHandle
X
X
SECStatus
X
-
Digital
Signatures
DSA_SignDigest() DSAPrivateKey
X
-
SECStatus
X
-
DSA_VerifyDigest() DSAPublicKey
X
-
SECStatus
X
-
RSA_Sign() SECKEYLowPrivateKey
X
-
SECStatus
X
-
RSA_CheckSign() SECKEYLowPublicKey
X
-
SECStatus
X
-
RSA_CheckSignRecover() SECKEYLowPublicKey
X
-
SECStatus
X
-
RSA_SignRaw() SECKEYLowPrivateKey
X
-
SECStatus
X
-
RSA_CheckSignRaw() SECKEYLowPublicKey
X
-
SECStatus
X
-
RSA_CheckSignRecoverRaw() SECKEYLowPublicKey
X
-
SECStatus
X
-
Encryption/
Decryption
DES_CreateContext() DESContext
-
X
DES_Encrypt() DESContext
X
X
SECStatus
X
-
DES_Decrypt() DESContext
X
X
SECStatus
X
-
DES_DestroyContext() DESContext
-
X
Hashing SHA1_NewContext() SHA1Context
-
X
SHA1_CloneContext() SHA1Context
X
-
SHA1Context
-
X
SHA1_Begin() SHA1Context
-
X
SHA1_Update() SHA1Context
X
X
SHA1_End() SHA1Context
X
X
SHA1_HashBuf() SECStatus
X
-
SHA1_Hash() SECStatus
X
-
SHA1_DestroyContext() SHA1Context
-
X
Key
Generation
PQG_ParamGen() PQGParams
-
X
PQGVerify
-
X
SECStatus
X
-
PQG_ParamGenSeedLen() PQGParams
-
X
PQGVerify
-
X
SECStatus
X
-
PQG_VerifyParams() PQGParams
X
-
PQGVerify
X
-
SECStatus
X
-
DSA_NewKey() PQGParams
X
-
DSAPrivateKey
-
X
SECStatus
X
-
DSA_NewKeyFromSeed() PQGParams
X
-
DSAPrivateKey
-
X
SECStatus
X
-
RSA_NewKey() RSAPrivateKey
-
X
RSA_EncryptBlock() SECKEYLowPublicKey
X
-
SECStatus
X
-
RSA_DecryptBlock() SECKEYLowPrivateKey
X
-
SECStatus
X
-
RSA_EncryptRaw() SECKEYLowPublicKey
X
-
SECStatus
X
-
RSA_DecryptRaw() SECKEYLowPrivateKey
X
-
SECStatus
X
-
PKCS #5
Password-Based
Encryption
SEC_PKCS5GetSalt() SECAlgorithmID
X
X
SECItem
X
-
SEC_PKCS5GetIV() SECAlgorithmID
X
X
SECItem
X
-
SEC_PKCS5GetKey() SECAlgorithmID
X
X
SECItem
X
-
SEC_PKCS5CipherData() SECAlgorithmID
X
X
SECItem
X
X
SECItem
X
-
SEC_PKCS5CreateAlgorithmID() SECOidTag
X
-
SECItem
X
X
SECAlgorithmID
-
X
PKCS #12
Personal
Information
Exchange
SEC_PKCS12CreateExportContext() SEC_PKCS12ExportContext
X
X
SEC_PKCS12CreatePasswordPrivSafe() SEC_PKCS12ExportContext
X
-
SEC_PKCS12AddCertAndKey() SEC_PKCS12ExportContext
X
-
CERTCertificate
X
-
SECStatus
X
-
SEC_PKCS12Encode() SEC_PKCS12ExportContext
X
-
SECStatus
X
-
SEC_PKCS12DestroyExportContext() SEC_PKCS12ExportContext
-
X
SEC_PKCS12DecoderStart() SEC_PKCS12DecoderContext
X
X
SEC_PKCS12DecoderUpdate() SEC_PKCS12DecoderContext
X
-
SECStatus
X
-
SEC_PKCS12DecoderFinish() SEC_PKCS12DecoderContext
-
X
Prime
Number
Generation
mpp_make_prime() mp_int
X
X
mp_err
X
-
mpp_pprime() mp_int
X
-
mp_err
X
-
Private Key
Storage and
Retrieval
SECKEY_CloseKeyDB() SECKEYKeyDBHandle
X
X
SECKEY_DeleteKey() SECKEYKeyDBHandle
X
X
CERTCertificate
X
-
SECStatus
X
-
SECKEY_FindKeyByCert() SECKEYKeyDBHandle
X
X
CERTCertificate
X
X
SECKEYLowPrivateKey
X
X
SECKEY_OpenKeyDB() SECKEYKeyDBHandle
X
-
SECKEY_TraversePermKeys() SECKEYKeyDBHandle
X
X
SECStatus
X
-
SECKEY_UpdateKeyDBPass1() SECKEYKeyDBHandle
X
X
SECStatus
X
-
SECKEY_UpdateKeyDBPass2() SECKEYKeyDBHandle
X
X
SECItem
X
X
SECStatus
X
-
Pseudorandom
Number
Generation
RNG_RNGInit() SECStatus
X
-
RNG_GenerateGlobalRandomBytes() SECStatus
X
-
RNG_RandomUpdate() SECStatus
X
-
RNG_RNGShutdown() void
-
-
SSL Session ID
Cache
(Secret
Management)
ssl_ChooseSessionIDProcs() SSLSecurityInfo
X
X
SSLSessionID
-
X
SSL_ClearSessionCache() SSLSessionID
X
X
ssl_LookupSID() SSLSessionID
X
X
SSLSessionID
X
-
ssl_FreeSID() SSLSessionID
X
X
SSLSessionID
-
X
SSL pre-master secrets  pk11_PRF() const SECItem *secret
X
X