National Institute of Standards and Technology

Implementation Guidance for FIPS PUB 140-1, continued

PART 3 (sections 5-7)

Go to:

• Part 1 (Overview/General)
• Part 4 (sections 8-11)
• Part 5 (expired guidance)

Section 5 - Physical Security

5.1 Conformal coating features

Question/Problem

Resolution

Additional Comments

5.2 Tamper evidence requirements and logical module interfaces for PC-like modules

Question/Problem

Resolution

1. Keyboard port - logical data input interface;
2. Disk drive and network "ports" - logical data input/output interfaces; and
3. Monitor and printer port - logical data output interfaces.

The standard defines a port ("a functional unit of a cryptographic module through which data or signals can enter or exit the module"[Section 2.1]), and makes a distinction between ports and covers ("Documentation shall include a complete specification of the interfaces of a cryptographic module, including any physical or logical ports, physical covers or doors..."[Section 4.2]). At level 2 and above, there are no requirements or tests for tamper evidence other than on removable covers and doors. Thus, there are no requirements for tamper evidence on the various ports listed above (e.g., there does not have to be a tamper evident seal on the keyboard jack where it plugs into the keyboard port, etc.)

Additional Comments

5.3 Additional tamper evidence for embedded modules

Question/Problem

Resolution

Therefore, it may be desirable for the vendor or customer to use tamper evident measures (e.g., cover locks, tamper evident seals, etc.) on the larger embodiment that contains the embedded cryptomodule. However, this lies outside the scope of this standard.

Additional Comments

5.4 Tamper evidence for cryptomodules with physical security at levels 3 and 4

Question/Problem

Resolution

Tamper evidence and tamper detection/response are not necessarily mutually exclusive. The former warns the valid cryptomodule user that a tamper attempt has occurred, whether it has been successful or not, while the latter protects the cryptomodule from such tamper attempts. In addition, there may be cases where a failure in a module may cause it to be zeroized or disabled (e.g., a blown power supply). There may be cases where keys are zeroized, and without tamper evidence features, there would be no indication that tampering had occurred. The user is left to guess whether zeroization occurred because of tampering or some "natural" failure of the module. Awareness of such tampering would necessitate a more drastic course of action rather than just a simple maintenance procedure, which might be the response if the module simply indicates that keys were zeroized.

The standard and DTR are clear in the area of physical security, in that to meet a particular level, all requirements from lower levels must also be met for a particular type of implementation (e.g., single chip, multi-chip embedded, and multi-chip standalone).

Additional Comments

5.5 Physical security requirements (Level 2) for multi-chip standalone cryptographic modules

Question/Problem

Resolution

1. The fact that a cryptomodule's enclosure is designed to be non-removable does not imply that it is, in fact, non-removable. When testing a multi-chip standalone module for Level 2 compliance, the tester shall attempt to remove the cryptomodule's enclosure, even in cases where the manufacturer claims that the enclosure is non-removable. The tester shall apply a level of effort necessary to remove the cover. (Note that the definition of a "removable cover" - as opposed to a non-removable enclosure - is being reviewed by NIST and CSE.)
2. When a tester opens and closes the enclosure, attempting not to leave evidence of tampering, the time taken to accomplish this shall NOT include the time (or estimated time) needed to tamper with the cryptomodule's internal electronic components. This time shall include the time required to remove any additional physical barriers (e.g., epoxy over the components or internal shields) such that the internal electronic components of the cryptomodule can be accessed, and the "drying time" necessary for any sealant that is used to close and reseal the enclosure.
3. The tester shall only use tools and materials that are readily available in places such as a hardware store or hobby shop. The use of extremely expensive tools (e.g., a laser) are excessive for Level 2 physical security testing.
4. In opening and closing the enclosure, a tester shall use only cryptomodule components that are part of the cryptomodule being tested. For example, a tester shall not use another enclosure, label, or seal in place of the original.
5. The tester shall have some experience attempting to open and close the cryptomodule; however, the tester is not assumed to be an expert at penetrating the cryptomodule being tested. Rather, the assumption is that the tester has experience with LESS THAN 10 instances of the cryptomodule being tested.

Additional Comments

1. If a tester needs 2 hours or more to open the enclosure, gain access to the internal electronic components, and close the enclosure on a cryptomodule WITHOUT leaving evidence of tampering, then this is sufficient for passing test TE05.19.01.
2. "Detectable signs" and "tamper evidence" shall include both inoperability and visual evidence on the cryptomodule itself. Inoperability may include situations where an attempt to operate the cryptomodule requires a significantly greater physical effort than normal (e.g., a PC Card or smart card that cannot be easily placed (or fits too loosely) in its slot or reader/writer.).

5.6 Key loader physical security requirements at Level 3

Question/Problem

Resolution

VE05.20.01 states that "the circuitry shall be operational whenever plaintext cryptographic key, or other unprotected critical security parameters, are contained within the module."; this is done even when the module is not powered up (e.g., circuitry operated using battery power).

Additional Comments

5.7 Tamper response/zeroization circuitry on removable covers and doors for embedded and standalone modules

Question/Problem

Resolution

(11/21/97)
The tester must determine if Level 3 physical security requirements are met. If fasteners (e.g., rivets, press-fittings, etc.) are used to hold a cover/enclosure in place, and the fasteners are visible to the tester (clearly delineating a mechanism for removal), then it is acceptable for a tester to drill out these fasteners, in order to test the removal of the cover/enclosure for tamper response. Note that drilling can only be performed on the fasteners, and not on the enclosure itself.

In situations where a tester can disable the tamper response mechanism by "removing" the cover/door (as described above) and inserting a physical probe, then the applicable test is failed. If one can use a probe in this manner before zeroization takes place, then it is very likely that a probe could also be used to obtain plaintext critical security parameters. Assertions AS05.11 and AS05.21 address modules that have ventilation slits, and require that these slits be protected to prevent undetected probing. Likewise, the creation of any type of slit or hole during cover/door partial "removal" should also have a similar type of protection to prevent undetected probing (i.e., this protection is the tamper response mechanism).

(11/21/97)
Note that any existing opening revealed by the removal of a fastener may be probed by a tester.

Additional Comments

Section 6 - Software Security

Section 7 - Operating System Security

7.1 Authentication of cryptographic software within a cryptomodule

Question/Problem

Resolution

Additional Comments

7.2 Level 2 O/S Requirements - Use of TCSEC, ITSEC, and CTCPEC Evaluations

Question/Problem

Resolution

An O/S can be considered as "evaluated" if it appears on the appropriate Evaluated Products List (EPL) from any one of the following countries: United States, Canada, United Kingdom, Germany, France, and The Netherlands. EPLs can be obtained as follows:

Additional Comments