Common Criteria for Information Technology Security Evaluation CC:2022 Revision 1 — Part 3

Note

Common Criteria CC:2022, revision 1, part 3: assurance requirements, the components from which the evaluation assurance levels (EAL) are formed, and the evaluation criteria for protection profiles and security targets.

Summary

Purpose

Part 3 of the Common Criteria CC:2022, Revision 1 (November 2022), defines the security assurance components CC:2022 R1 Part 3:

It contains the components from which the EAL assurance levels and the other packages of Part 5 are composed, as well as the criteria for evaluating protection profiles and security targets CC:2022 R1 Part 3, § 1 Scope. Assurance components express in a standardised way what must be demonstrated to have confidence in the product evaluated CC:2022 R1 Part 3, Introduction.

Who it applies to

The document is aimed at those who set the required assurance level, at developers and at evaluators, for whom these requirements are the mandatory statement of the evaluation criteria CC:2022 R1 Part 3, Introduction.

Two types of reference exist in the corpus.

• The European wallet. Implementing Regulation 2024/2981 provides for a vulnerability assessment at level AVA_VAN.5, within the meaning of standard EN ISO/IEC 15408-3:2022, in accordance with Annex I to Implementing Regulation 2024/482, unless duly justified to the certification body. It applies to the wallet secure cryptographic application (WSCA) and, where the conditions laid down in the regulation are met Art. 3(3)(b), to all or part of the wallet secure cryptographic device (WSCD) § 2. Evaluation activities related to the wallet secure cryptographic device § 3. Evaluation activities related to the wallet secure cryptographic application (WSCA). EN ISO/IEC 15408-3:2022 is the European adoption of the ISO standard, of which CC:2022 Part 3 is the equivalent published by the CCRA § 1. Identification CC:2022 R1 Part 3, Foreword.
• Qualified trust services. Several implementing regulations refer to the Common Criteria “CC:2022, Parts 1 through 5” at level EAL 4 or higher; these references are detailed in the summary of Part 1 CC:2022 R1 Part 1.

Key points

• Nine assurance classes, including protection profile evaluation (APE), security target evaluation (ASE), development (ADV), life-cycle support (ALC), tests (ATE), vulnerability assessment (AVA) and composition (ACO) CC:2022 R1 Part 3, § 7 Class APE: Protection Profile (PP) evaluation CC:2022 R1 Part 3, § 15 Class ACO: Composition.
• Vulnerability analysis (AVA_VAN). It determines whether potential vulnerabilities could allow an attacker to violate the security functional requirements CC:2022 R1 Part 3, § 14.3.1 Objectives.
• Level AVA_VAN.5 is advanced methodical vulnerability analysis CC:2022 R1 Part 3, § 14.3.7 AVA_VAN.5 Advanced methodical vulnerability analysis:

• The link with EUCC. EUCC certificates at assurance level “high” cover levels AVA_VAN 3, 4 or 5 Art. 4.
• The link with the key attestation. In OpenID4VCI, the value iso_18045_high corresponds to resistance to a “High” attack potential, equivalent to VAN.5 OpenID4VCI 1.0, [D.2.](#appendix-D.2) [Attack Potential Resistance](#name-attack-potential-resistance).

Links

• Other parts: 1 CC:2022 R1 Part 1, 2 CC:2022 R1 Part 2, 4 CC:2022 R1 Part 4, 5 CC:2022 R1 Part 5; CEM:2022 methodology CEM:2022 R1.
• ISO/IEC 15408 and 18045 record ISO/IEC 15408 (1-5) and ISO/IEC 18045.
• Learning path: step 5, certification and standards.

Written by Asphalia.