Slides · 10 slides
Common Criteria (ISO/IEC 15408): evaluating products against the claims they choose
The same page told visually, ready to present. Speaker notes carry the full explanation.
Certification
Common Criteria
Evaluating products against the claims they choose
Evaluate once instead of three times
The key difference
No single list of requirements
A firewall, a smart card and an OS can all be certified against completely different claims
Vocabulary
Five terms that carry the meaning
Seven EALs
Depth of checking, not strength of product
Weak claims checked at EAL4 are still weak claims
Reading 'EAL4+'
The plus that matters: AVA_VAN.5
Why smart card chips and HSMs say 'EAL4+ (AVA_VAN.5)' or 'EAL5+'
Protection profiles
Making certificates comparable again
Under eIDAS
A remote qualified signing device
EN 419221-5 HSMs typically claim EAL4 augmented with AVA_VAN.5
Recognition
Who recognizes whose certificate
Certificates come from national bodies: BSI, ANSSI, NIAP and others
Side by side
FIPS 140-3 vs Common Criteria
Serious HSM vendors hold both; payment HSMs add PCI PTS HSM
Keeping current
CC:2022 and the v3.1 transition
Check the certificate or a maintenance report covers the version you run
Keys: ← → move, F full screen, G all slides, N notes