Common Criteria for Information Technology Security Evaluation v3.1 Revision 5 — Part 3

Note

Common Criteria v3.1, revision 5, part 3: assurance requirements, including the evaluation assurance levels (EAL), the composition packages (CAP) and the evaluation criteria for protection profiles and security targets.

Summary

Purpose

Part 3 of the Common Criteria, version 3.1 revision 5 (April 2017, reference CCMB-2017-04-003), is the catalogue of security assurance components of that version CC v3.1 R5 Part 3:

It includes the evaluation assurance levels (EAL), which form a scale for measuring the assurance of an evaluated product, the composed assurance packages (CAP) for composed products, the assurance components of which these levels are made up, and the criteria for evaluating protection profiles and security targets CC v3.1 R5 Part 3, § 2 Scope. Part 1 of the same version provides the overall model CC v3.1 R5 Part 1, Part 2 the functional components CC v3.1 R5 Part 2.

Who it applies to

The document is addressed to consumers, who choose an assurance level, to developers who respond to it and to evaluators, for whom these requirements are the mandatory evaluation criteria CC v3.1 R5 Part 3, § 1 Introduction.

In the corpus, version 3.1 is now accepted only in defined cases, with distinct wordings, in particular:

• The EUCC. Until 31 December 2027, a certificate under the European EUCC scheme may still be issued applying the Common Criteria “version 3.1, revision 5” Art. 3(2). Until the same date, a certificate based on the 2022 standards may certify conformity with a protection profile established under those version 3.1 standards Art. 3(3). With no date in the article, a certificate based on the 2022 standards may certify conformity with a protection profile established under version 3.1, revisions 1 to 4, if the use of that profile is required in particular by Regulation 910/2014 or Implementing Decision 2016/650 Art. 3(4).
• Qualified electronic attestations of attributes and those of the public sector. Providers of qualified attestations and providers of attestations issued by or on behalf of a public sector body responsible for an authentic source comply with the standards and specifications of Annex I to Implementing Regulation 2025/1569 Art. 3(1). According to that annex, the provider ensures in particular that the signatures or seals used to provide the service, other than that of the attestation, are created by means of a certified secure cryptographic device. One of the options is certification under the Common Criteria “version 3.1 (CC3.1) until 31.08.2027”, or under CC:2022 or ISO/IEC 15408, “and certified to EAL 4 or higher”; the EUCC and the FIPS standards are other options Annex I. The EAL level is defined in this Part 3 CC v3.1 R5 Part 3, § 8.1 Evaluation assurance level (EAL) overview.

Implementing Decision 2016/650 cites standard ISO/IEC 15408-3:2008, and not CC 3.1 Annex; the comparison between these texts is given in a sheet written by us ISO/IEC 15408 (1-5) and ISO/IEC 18045. The detail of these rules is in the summary of Part 1 CC v3.1 R5 Part 1.

Key points

• Seven hierarchical EAL levels. Each level provides more assurance than the lower levels, by replacing a component with a more demanding component of the same family or by adding components from other families CC v3.1 R5 Part 3, § 8.1 Evaluation assurance level (EAL) overview.
• Augmentation. Only EAL levels may be augmented, by adding or replacing a component; an EAL level from which one of its components has been removed is not a valid claim CC v3.1 R5 Part 3, § 8.1 Evaluation assurance level (EAL) overview.
• EAL 4 is aimed at cases where a moderate to high level of independently assured security is required in conventional products, and where additional security engineering costs are accepted CC v3.1 R5 Part 3, Objectives.
• The AVA_VAN vulnerability analysis has five components, up to the advanced methodical vulnerability analysis AVA_VAN.5 CC v3.1 R5 Part 3, AVA_VAN.5 Advanced methodical vulnerability analysis. Decision 2016/650 cites protection profile EN 419211-2:2013 Annex. The version of that profile present in the corpus is certified profile BSI-CC-PP-0059, version 1.03 BSI-CC-PP-0059 (EN 419211-2), § 5.2 Protection Profile Reference; it claims the EAL4 assurance package augmented by the AVA_VAN.5 component of Part 3, in version 3.1 revision 3 BSI-CC-PP-0059 (EN 419211-2), § 6.1 CC Conformance Claim BSI-CC-PP-0059 (EN 419211-2), § 6.2 PP Claim, Package Claim.
• A transition governed by the CCRA. Revision 5 could be used for evaluations started no later than 30 June 2024, subject to the other rules of the transition policy CCMC-2023-04-001, _Introduction_ ~~es~~.

Links

• Parts 1 and 2 of the same version CC v3.1 R5 Part 1 CC v3.1 R5 Part 2; associated evaluation methodology, CEM 3.1 revision 5 CEM v3.1 R5; current version CC:2022, Part 3 CC:2022 R1 Part 3.
• CCRA transition policy CCMC-2023-04-001; ISO/IEC 15408 and 18045 sheet ISO/IEC 15408 (1-5) and ISO/IEC 18045.
• Learning path: step 5, certification and standards.

Written by Asphalia.