Blog | Lightship Security

ACVP Vector Test Harness for OSSL 3.x

Jonathan Plata and Greg McLearn October 25, 2022 ACVP, Tools

Lightship has released, as open source, an ACVP vector test harness for OpenSSL 3.x.

The code can be found in our GitHub repository at https://github.com/lightshipsec/ls-acvp-harness.

The README.md contains the current capabilities which we expect to update and maintain. At the moment, we include most of the typical algorithms and properties that are often claimed or required in FIPS 140-3 and Common Criteria. The full set of supported algorithms, operating modes and properties are described in the README.md. Additional algorithms can be added as needed.

X.509 CA:FALSE Testing

Kenji Yoshino October 20, 2022 Certifications, Common Criteria

Many modern Common Criteria Protection Profiles include X.509 requirements requiring the evaluator to construct a series of certificates designed to verify that a system under test is correctly parsing and validating them. X.509 certificates appear relatively simple on the surface, but digging into the details uncovers a wealth of complexity and nuance in RFC5280, ASN.1, DER, and BER. We’ll explore this testing using a specific example of the basicConstraints:CA flag and show how common X.509 tools can represent — and potentially obscure — some of the requirements as it pertains to Common Criteria conformance testing.

ESV and Me!

James Ramage October 10, 2022 Entropy, FIPS 140-3

As of November 7, 2020, the Cryptographic Module Validation Program (CMVP) required that all FIPS 140-2 and FIPS 140-3 module validation submissions include documentation justifying conformance of the entropy source to NIST SP 800-90B, if the module is “either generating the entropy itself or it is making a call to request the entropy from a well-defined source”. Compliance documentation would include an Entropy Assessment Report (EAR) and statistical testing of entropy data samples using the NIST 90B Test Tool.

Entropy Validation in FIPS 140-3 (ENT vs ESV)

Ryan Thomas June 6, 2022 Entropy, FIPS 140-3

To get an entropy source approved under FIPS 140-3 there are two options:

ENT (P) or ENT (NP) entry on the FIPS module validation certificate (until October 1st, 2022)
ESV certificate awarded by NIST’s Entropy Source Validation Testing (ESVT)

This blog post will address these entropy validation requirements in FIPS 140-3. We’ll provide details on the differences between the “ENT” validation certificate entry and Entropy Source Validation or “ESV” certificates. Relevant NIST Special Publications (SPs), important Implementation Guidance (IG) and links to templates and other important references will also be provided.

Five Steps to Algorithm (CAVP) Validations at Lightship

Gillian Bedrosian and Dennis Momy March 21, 2022 ACVP, FIPS 140-2, FIPS 140-3

Algorithm validation testing is a critical path issue for FIPS 140-3 validations and for NIAP Protection Profile-based Common Criteria evaluations. Equipment vendors are often surprised at the level of effort and the potential challenges in successfully completing the algorithm testing process.

At Lightship, we have developed a suite of tools to allow us to standardize, simplify and streamline the process to obtain CAVP (Cryptographic Algorithm Validation Program) validation.

This post will outline each of the steps in addition to identifying where we will require input from the vendor.

Vulnerabilities and FIPS 140-3

James Ramage December 20, 2021 FIPS 140-3

Our previous article discussed how vulnerabilities are dealt with under the Common Criteria certification program in North America. All commercial product assurance programs deal with flaws and vulnerabilities in different ways, often with overlapping requirements, techniques and outcomes.

In this article, James Ramage of the Lightship Security FIPS team talks about how vulnerabilities are handled for FIPS 140-3 validations.

Vulnerabilities and Common Criteria

Greg McLearn December 19, 2021 Common Criteria

No computing system is free from security vulnerabilities. Such flaws can manifest themselves within software, firmware and hardware implementations. Often the ease in widespread mitigation is based in part on whether a vendor can provide updates to software (relatively easy), firmware (a bit harder), or whether a new version of hardware needs to be deployed (very difficult). The constraints and goals of point-in-time security certification programs such as Common Criteria (CC) and FIPS 140-3 can often conflict with the need to correct such security deficiencies. With the recent disclosure of CVE-2021-44228 (a remote code exploit [RCE] in the widely deployed log4j component in Java-based products), questions often come up as to how such vulnerabilities are handled within certain certification programs.

What’s New In App PP v1.4

Marina Ibrishimova December 2, 2021 Common Criteria

The Protection Profile for Application Software (APP PP) v1.4 has recently been published. Here are some key points from our initial review.

PP-Modules. Vendors are now allowed to specify additional protection profiles (PPs) and PP-Modules in a PP-Configuration with APP PP v1.4. Previously, only PP-Module for VPN Clients was allowed to be claimed with this PP.

SSH. Functional package for Secure Shell (SSH) v1.0 was added to APP PP v1.4. The Extended Package for Secure Shell (SSH) v1.0, which is about to sunset on November 13th, 2021, is superseded by the Functional Package for Secure Shell (SSH).

MEC. An optional selection to include FDP_PRT_EXT.1 from the PP-module for file encryption was added to FMT_MEC_EXT.1.

X509. Clarifications on when FIA_X509_EXT.1/2 need to be claimed.

Understanding the IUT and MIP Lists and Their Wait Times

Gillian Bedrosian June 16, 2021 FIPS 140-2, FIPS 140-3

The most common question we receive from clients on the FIPS Validation process is: “after my validation report has been sent to the Cryptographic Module Validation Program (“CMVP”), how long will it take to complete the Validation?”. This post outlines the various stages for a module to be validated in the CMVP’s review process, as well as the average duration of each stage.

Beyond the testing: FIPS 140-3 documentation inputs

Grace Grundy and Jason Cunningham May 26, 2021 Entropy, FIPS 140-2, FIPS 140-3

First time vendors to the FIPS 140 validation process are often not aware of the scope of supporting documentation and evidence required. These documentation inputs are integral to the lab being able to perform and finalize the full validation process.

The set of documents described below provide the testers with in an in-depth description, with evidence, of how a cryptographic implementation complies with the FIPS 140 standard and the most current Implementation Guidance (IG) from the CMVP. The core documents are the first thing the Lab will evaluate and ultimately forms the basis of the report that the CMVP assesses in consideration of awarding the validation. As an independent third-party, laboratories are not permitted to author original design documentation for cryptographic modules under test. As such, it’s important for vendors to plan their FIPS strategy in advance to determine if they should “build or buy” the documentation / consulting support that will be required. Generating adequately detailed documentation and design information can be time-consuming and onerous depending on your experience and the complexity of the module being validated. This effort should not be underestimated and needs to be factored into the overall cost and effort of undertaking a FIPS 140 validation.