Effective banking products CC evaluations. CHIOCCA Martine Banking products Security Risk Manager 8 th I. C. C. C. Rome, September 26 th, 2007.
Context of efficient CC evaluations French Banking products required security evaluation since 1995 and annual certificate survey: § 1995 -2000: ITSEC xxxxx, § 2000 -now : CC EAL 4 + (VLA. 4, . . ) Scope of the evaluation : all payment applications on the card: § National & International EMV Payment § Legacy Payment § National purse Monéo Protection profiles : § PP/9911 (payment) & PP/0101(purse) § New European CAS Security Target Gemalto Public
Evaluation & Certification processes DCSSI CESTI Certificat EAL 4+ Evaluation Technical Report (ETR) Certificate Survey FOURNITURES Sponsor or Observer Preparation IC manufacturer Smart Card S/W developer Security Target Gemalto Public
Gemalto evaluation strategy Capitalize working with the same evaluation laboratory for each banking products’ type : native, java, contactless, … Advantages: § Parallelize as much as possible product design & evaluation § Capitalize on laboratory’s knowledge of the product § Better chance to get productive lab’s feedback § Reusability of assurance deliverables § Quicker and less expensive security evaluation Gemalto Public
Development and Evaluation processes Development Process Specification Development Emulator Card Testing. roming Testing Generic process Evaluation Process Target & Devpt. Method. Analysis specifications & Environment Imp. , Code. 2 to 3 months Card Testing & VLA End Eval. .
Synchronizes design and evaluation First step of evaluation : ASE, ADV deliveries , to reach the source code review § An card emulator and associated tools are given to the laboratory § Goal => get as much comments before Roming Second step : others deliveries ACM, ADO, ATE, § During roming most deliveries are updated Last step: AVA deliveries and penetration testing § Duration : 2 -3 months after the deliveries of the first cards § Cards characteritics : – With & without “coating” to gain time in preparation – With known & unknown data Gemalto Public
Security : Ever moving target What do we learn from the evaluations: § All code review gave feedback taken into account before roming. § Most penetration tests reveals us investigation tracks that could be enhanced in future products to make those tracks even less accessible Certification is a GOOD…. starting point…… Annual survey : required by French baking organizations § Each year the same laboratory re-assesses the product resistance Second evaluation derivates from exiting certified product => 50% less on Cost and Duration. Gemalto Public
Smart. Card Security : Still keep ahead ONLY WAY TO IMPLEMENT EFFICIENT SECURITY MECHANISMS => Internal Gemalto laboratory: § Equivalent technical level as external ITSEF § State of the Art at attacks techniques § More 10 experts investigating in S/W and H/W attacks New security mechanisms efficiency. § Privately evaluated to assess robustness § Internally and externally evaluated Gemalto Public
Conclusion of our CC evaluation experiences Effective CC evaluations § Operational way of practicing CC evaluation Efficient CC evaluations § All CC evaluated products gets certified at once. § All our banking customers are confident in the security level of the products. § Our experience in security proved our products do resist over time. Gemalto Public
The end… Contact : martine. chiocca@gemalto. com Tel : 33(1) 01 55 01 59 25 Questions ?
2007 Effective Smartcard Evaluations Process Jean-Pierre KRIMM Technical Manager of CESTI-LETI jean-pierre. krimm@cea. fr 8 th ICCC, Rome, September 26 th, 2007. © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA 11 Effective smartcard evaluations process - Jean. Pierre KRIMM
Context n Smartcard evaluations In the French Scheme of Certification l Using a composition scheme with CC v 2 l Based on the experience of a developer (Gemalto) and an evaluator (CESTI-LETI) l n The goal wishes is To reduce time and cost of an evaluation l Keeping the same efficiency as usually l n This part presents the evaluator point of view © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 12
Presentation Outline n Smartcard evaluations General presentation of the composition scheme l Description of the standard evaluation tasks sequencing l n How to save time: 4 recipes Adaptation of the standard tasks sequencing l The entire source code is provided l An IC emulator is kept available l The scheme is deeply involved in the evaluation l n Conclusion © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 13
Smartcard Evaluation Process n A typical smartcard architecture (closed) Applications OS Integrated Circuit (IC) n The composition scheme First, the IC is evaluated and certified l Then, the whole product is evaluated, using the results of the IC evaluation l These steps are not necessary performed by the same lab. l © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 14
Standard evaluation tasks sequencing n The path in red is the critical one n In practice Conformity tasks are performed first for acquiring the knowledge of the TOE, i. e. ADV, ACM, ALC, ADO, AGD l Efficiency ones are performed in last, i. e. AVA l Some of them shall be performed on the TOE suitable for testing i. e. ATE_IND, AVA_VLA, ADO_IGS, ACM_CAP, AVA_MSU l © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 15
How to save time in the evaluation n Identifying vulnerabilities or anomalies earlier to correct them as soon as possible n Penetration testing will be divided in two sub-sets l l A standard made of state of the art’s attacks related to a well known application A specific which refines the standard one, and adds new ones strongly dependent to the implementation and the IC vulnerabilities n To achieve this goal, 4 recipes: Adaptation of the standard tasks sequencing: a code review and standard attacks will be performed in advance 2. The entire source code is provided 3. An IC emulator is kept available 4. The scheme is deeply involved in the evaluation 1. © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 16
1 - Adaptation of the standard tasks sequencing n Context reminded: applications are well known l French banking applications: legacy, EMV, e-purse n Some evaluation tasks can be performed in advance A partial code review can be performed on its finale version. => a first feedback on the quality of the implementation can be provided to the developer l The standard sub-set of attacks can be performed in advance, in each banking application, as soon as samples are available => a first feedback on the resistance of the product can be provided to the developer l this leads to identify common vulnerabilities earlier and thus allows corrections earlier l n The standard evaluation tasks sequencing will be completed, performing the complete code analysis (ADV_IMP) and the specific sub-set of attacks © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 17
2 - The entire source code is provided n The entire application source code is provided To the lab. premises l Including cryptographic implementations l Including the generated assembler l n Benefits The evaluator has the source code always available l Guarantee the independence of the evaluator l Both levels of language are necessary for attacks, i. e. the high level to identify a vulnerability, and the low level for its exploitation l © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 18
3 - An IC emulator is kept available n An IC emulator is kept available In the case the evaluator needs it l Helpful to understand both H/W and S/W behaviors, l To save time simulating the feasibility of attacks l n Due to the composition scheme The IC is usually not well known by the lab. l Some H/W countermeasures are not fully explained l The IC is seen as a “grey box” l © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 19
4 - The scheme is deeply involved in the evaluation n The French Scheme is deeply involved in each evaluation n Benefits It allows an earlier detection of evaluation anomalies, which are taken into consideration when they appear l It allows to find a solution quickly when a problem occurs l It guarantees the level of the evaluation in real time, for a specific way to work l © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 20
Conclusion n It is possible to improve an evaluation process l l l in terms of time (and cost) for a well-known specific domain, i. e. smartcard experience driven, for both developer and evaluator through a specific scheme without a specific interpretation of the CEM keeping the same level of evaluation © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 21
Thank you for your attention Contact : jean-pierre. krimm@cea. fr Tel: +33 (0)4 38 78 49 13 © CEA 2007. Tous droits réservés. Toute reproduction totale ou partielle sur quelque support que ce soit ou utilisation du contenu de ce document est interdite sans l’autorisation écrite préalable du CEA All rights reserved. Any reproduction in whole or in part on any medium or use of the information contained herein is prohibited without the prior written consent of CEA Effective smartcard evaluations process - Jean-Pierre KRIMM 22
Скачать презентацию Effective banking products CC evaluations CHIOCCA Martine Banking
fb2e8cd85820b9e5ab6eefa49d57385d.ppt