Dell Networking Platforms
Security Target
Version 2.9
December 02, 2019
Copyright © 2019 Dell Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. Dell™ and
the Dell logo are trademarks of Dell Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks
of their respective companies.
Dell Networking Platforms
Security Target
2 of 55
Table of Contents
1 SECURITY TARGET INTRODUCTION....................................................................................................... 5
SECURITY TARGET REFERENCE.............................................................................................................. 5
TOE REFERENCE................................................................................................................................... 5
TOE OVERVIEW..................................................................................................................................... 6
1.3.1 TOE Product Type........................................................................................................................... 6
1.3.2 TOE Usage...................................................................................................................................... 6
1.3.3 TOE Security Functionality.............................................................................................................. 6
TOE DESCRIPTION................................................................................................................................. 7
TOE Architecture .......................................................................................................................................... 9
1.4.1 TOE Components.......................................................................................................................... 10
1.4.1.1 Hardware............................................................................................................................................. 10
1.4.1.2 Software .............................................................................................................................................. 10
1.4.1.3 Management Interface(s) .................................................................................................................... 11
1.4.2 Physical Boundary of the TOE ...................................................................................................... 11
1.4.3 Logical Boundary of the TOE ........................................................................................................ 12
1.4.3.1 Security Audit ...................................................................................................................................... 12
1.4.3.2 Cryptographic Support ........................................................................................................................ 12
1.4.3.3 Identification and Authentication.......................................................................................................... 13
1.4.3.4 Security Management ......................................................................................................................... 13
1.4.3.5 Protection of the TSF .......................................................................................................................... 13
1.4.3.6 TOE Access ........................................................................................................................................ 13
1.4.3.7 Trusted Path/Channels........................................................................................................................ 13
1.4.4 Excluded Functionality................................................................................................................... 14
1.4.5 TOE Guidance and Reference Documents................................................................................... 14
2 CONFORMANCE CLAIMS........................................................................................................................ 16
COMMON CRITERIA CONFORMANCE CLAIM............................................................................................ 16
PROTECTION PROFILE CLAIM................................................................................................................ 16
2.2.1 Technical Decisions....................................................................................................................... 16
PACKAGE CLAIM................................................................................................................................... 18
CONFORMANCE RATIONALE.................................................................................................................. 18
3 SECURITY PROBLEM DEFINITION......................................................................................................... 18
THREATS ............................................................................................................................................. 18
ASSUMPTIONS...................................................................................................................................... 20
ORGANIZATIONAL SECURITY POLICIES .................................................................................................. 22
4 SECURITY OBJECTIVES.......................................................................................................................... 23
SECURITY OBJECTIVES FOR THE TOE................................................................................................... 23
SECURITY OBJECTIVES FOR THE OPERATIONAL ENVIRONMENT .............................................................. 23
5 EXTENDED COMPONENTS DEFINITION................................................................................................ 24
EXTENDED SECURITY FUNCTIONAL COMPONENTS ................................................................................. 24
EXTENDED SECURITY FUNCTIONAL COMPONENTS RATIONALE ............................................................... 24
6 SECURITY REQUIREMENTS ................................................................................................................... 25
SECURITY FUNCTIONAL REQUIREMENTS................................................................................................ 25
6.1.1 Security Audit (FAU)...................................................................................................................... 26
6.1.1.1 FAU_GEN.1 Audit Data Generation.................................................................................................... 26
6.1.1.2 FAU_GEN.2 User Identity Association................................................................................................ 28
6.1.1.3 FAU_STG_EXT.1 Protected Audit Event Storage............................................................................... 28
6.1.2 Cryptographic Support (FCS)........................................................................................................ 29
6.1.2.1 FCS_CKM.1 Cryptographic Key Generation (for asymmetric keys).................................................... 29
6.1.2.2 FCS_CKM.2 Cryptographic Key Establishment .................................................................................. 29
6.1.2.3 FCS_CKM.4 Cryptographic Key Destruction....................................................................................... 29
Dell Networking Platforms
Security Target
3 of 55
6.1.2.4 FCS_COP.1/DataEncryption Cryptographic Operation (AES Data Encryption/ Decryption) ............... 30
6.1.2.5 FCS_COP.1/SigGen Cryptographic Operation (Signature Generation and Verification)..................... 30
6.1.2.6 FCS_COP.1/Hash Cryptographic Operation (Hash Algorithm) ........................................................... 30
6.1.2.7 FCS_COP.1/KeyedHash Cryptographic Operation (Keyed Hash Algorithm) ...................................... 30
6.1.2.8 FCS_RBG_EXT.1 Random Bit Generation ......................................................................................... 30
6.1.2.9 FCS_SSHS_EXT.1 SSH Server Protocol ........................................................................................... 31
6.1.2.10 FCS_TLSC_EXT.2 TLS Client Protocol with authentication................................................................ 31
6.1.2.11 FCS_NTP_EXT.1 NTP Protocol.......................................................................................................... 32
6.1.3 Identification and Authentication (FIA) .......................................................................................... 32
6.1.3.1 FIA_AFL.1 Authentication Failure Management.................................................................................. 32
6.1.3.2 FIA_PMG_EXT.1 Password Management .......................................................................................... 32
6.1.3.3 FIA_UIA_EXT.1 User Identification and Authentication....................................................................... 33
6.1.3.4 FIA_UAU_EXT.2 Password-based Authentication Mechanism........................................................... 33
6.1.3.5 FIA_UAU.7 Protected Authentication Feedback.................................................................................. 33
6.1.3.6 FIA_X509_EXT.1 X.509 Certificate Validation .................................................................................... 33
6.1.3.7 FIA_X509_EXT.2 X.509 Certificate Authentication ............................................................................. 34
6.1.3.8 FIA_X509_EXT.3 X.509 Certificate Requests..................................................................................... 34
6.1.4 Security Management (FMT)......................................................................................................... 34
6.1.4.1 FMT_MOF.1/ManualUpdate Management of security functions behavior........................................... 34
6.1.4.2 FMT_MTD.1/CoreData Management of TSF Data.............................................................................. 34
6.1.4.3 FMT_MTD.1/CryptoKeys Management of TSF Data........................................................................... 34
6.1.4.4 FMT_SMF.1 Specification of Management Functions......................................................................... 35
6.1.4.5 FMT_SMR.2 Restrictions on Security Roles ....................................................................................... 35
6.1.5 Protection of the TSF (FPT) .......................................................................................................... 35
6.1.5.1 FPT_SKP_EXT.1 Protection of TSF Data (for reading of all symmetric keys) .................................... 35
6.1.5.2 FPT_APW_EXT.1 Protection of Administrator Passwords.................................................................. 35
6.1.5.3 FPT_TST_EXT.1 TSF Testing ............................................................................................................ 35
6.1.5.4 FPT_TUD_EXT.1 Trusted Update....................................................................................................... 36
6.1.5.5 FPT_STM_EXT.1 Reliable Time Stamps ............................................................................................ 36
6.1.6 TOE Access (FTA) ........................................................................................................................ 36
6.1.6.1 FTA_SSL_EXT.1 TSF-initiated Session Locking................................................................................. 36
6.1.6.2 FTA_SSL.3 TSF-initiated Termination................................................................................................. 36
6.1.6.3 FTA_SSL.4 User-initiated Termination................................................................................................ 36
6.1.6.4 FTA_TAB.1 Default TOE Access Banners .......................................................................................... 37
6.1.7 Trusted Path/Channels (FTP)........................................................................................................ 37
6.1.7.1 FTP_ITC.1 Inter-TSF Trusted Channel ............................................................................................... 37
6.1.7.2 FTP_TRP.1/Admin Trusted Path......................................................................................................... 37
SECURITY ASSURANCE REQUIREMENTS ................................................................................................ 37
6.2.1 Security Assurance Requirements for the TOE ............................................................................ 37
6.2.2 Security Assurance Requirements Rationale................................................................................ 38
RATIONALE .......................................................................................................................................... 38
6.3.1 TOE SFR Dependencies ............................................................................................................... 38
7 TOE SUMMARY SPECIFICATION............................................................................................................ 40
SECURITY AUDIT .................................................................................................................................. 41
CRYPTOGRAPHY .................................................................................................................................. 42
IDENTIFICATION AND AUTHENTICATION .................................................................................................. 48
SECURITY MANAGEMENT...................................................................................................................... 50
PROTECTION OF THE SECURITY FUNCTIONALITY ..................................................................................... 51
TOE ACCESS ....................................................................................................................................... 52
TRUSTED PATH/CHANNELS.................................................................................................................... 53
8 ACRONYMS AND TERMINOLOGY.......................................................................................................... 54
8.1.1 Acronyms....................................................................................................................................... 54
8.1.2 Product Acronyms and Terminology ............................................................................................. 54
Dell Networking Platforms
Security Target
4 of 55
Figures and Tables
FIGURE 1: TOE ARCHITECTURE ............................................................................................................................... 9
FIGURE 2: TOE PHYSICAL BOUNDARY.................................................................................................................... 12
TABLE 1: TOE PLATFORMS AND DEVICES................................................................................................................. 5
TABLE 2: DELL NETWORKING APPLIANCES............................................................................................................... 10
TABLE 3: TOE REFERENCE DOCUMENTS................................................................................................................ 14
TABLE 4: ST REFERENCE DOCUMENTS .................................................................................................................. 14
TABLE 5: TOE THREATS ........................................................................................................................................ 18
TABLE 6: TOE ASSUMPTIONS................................................................................................................................. 20
TABLE 7: ORGANIZATIONAL SECURITY POLICIES...................................................................................................... 22
TABLE 8: SECURITY OBJECTIVES FOR THE OPERATIONAL ENVIRONMENT.................................................................. 23
TABLE 9: EXTENDED COMPONENTS........................................................................................................................ 24
TABLE 10: TOE SECURITY FUNCTIONAL COMPONENTS ........................................................................................... 25
TABLE 11: AUDITABLE EVENTS (TABLE 2 OF THE NDCPP)....................................................................................... 27
TABLE 12: ASSURANCE COMPONENTS.................................................................................................................... 37
TABLE 13: SFR DEPENDENCIES............................................................................................................................. 38
TABLE 14: TOE SECURITY FUNCTIONS................................................................................................................... 40
TABLE 15: DELL NETWORKING PLATFORMS CRYPTOGRAPHY................................................................................... 42
TABLE 16: SCHEME USAGE.................................................................................................................................... 44
TABLE 17: DELL NETWORKING PLATFORMS CSPS .................................................................................................. 45
TABLE 18: ACRONYMS ........................................................................................................................................... 54
TABLE 19: TERMINOLOGY ...................................................................................................................................... 54
Dell Networking Platforms
Security Target
5 of 55
1 Security Target Introduction
Security Target Reference
ST Title: Dell Networking Platforms Security Target
ST Version: v2.9
ST Author: Cygnacom Solutions Inc.
ST Date: 12/02/2019
TOE Reference
TOE Developer: Dell USA L.P.
Evaluation Sponsor: Dell USA L.P.
TOE Identification: Dell Networking Platforms running Dell EMC Networking OS 9.14.1.9
Table 1: TOE Platforms and Devices
Series Platforms Build
Dell Networking S-Series
Top-of-rack switches
S3124*
9.14.1.9
S3148*
S3048-ON
S4048-ON*
S5048F-ON
S6010-ON
S6100-ON
Dell Networking C-Series
Network director and modular switch
C9010
Dell Networking Z-Series
Top-of-rack switch
Z9100-ON
* These platforms include multiple appliances
CC Identification: Common Criteria for Information Technology Security Evaluation,
Version 3.1, Revision 5, April 2017.
PP Identification: collaborative Protection Profile for Network Devices, Version 2.1,
September 2018.
Dell Networking Platforms
Security Target
6 of 55
TOE Overview
1.3.1 TOE Product Type
The Target of Evaluation [TOE] is a Network Device as defined by the collaborative Protection Profile
for Network Devices v2.1 [NDcPP]: “A network device in the context of this cPP is a device
composed of both hardware and software that is connected to the network and has an infrastructure
role within the network”.
1.3.2 TOE Usage
The TOE is the Dell Networking Platforms running Dell EMC Networking OS 9.14(1.9) which in the
evaluated configuration consists of S-Series, C-Series, and Z-Series switches. The TOE provides
layer 2 and 3 network management and interconnectivity functionality by offering non-blocking, line-
rate Ethernet switching with Quality of Service (QoS) and a full complement of IPv4 and IPv6
features. TOE consists of a hardware appliance with embedded software components.
All TOE appliances are shipped ready for immediate access through a Command Line Interface
[CLI], with some basic features enabled by default. However, to ensure secure use the product must
be configured prior to being put into production environment as specified in the user guidance.
1.3.3 TOE Security Functionality
 Security Audit
o Audit record generation for security-relevant events
o Interoperability with a remote audit server
 Cryptographic Support
o Validated cryptographic algorithms
o Destruction of cryptographic keys
 Identification and Authentication
o User access policies
o Password and certificate based authentication
 Security Management
o Local and remote administration
 Protection of the TOE Security Function (TSF)
o Self-testing on power-up
o Trusted update
 TOE Access
o Role-based access control
o Session timeout and lockout
 Trusted Path/Channels
o Secure channel for remote administrators
o Secure channel for authorized IT entities
Dell Networking Platforms
Security Target
7 of 55
TOE Description
The TOE is the Dell Networking Platforms running Dell EMC Networking OS 9.14(1.9) which consist
of S-Series, C-Series, and Z-Series switches and includes the following appliances:
 Dell Networking S-Series S3124
 Dell Networking S-Series S3124P
 Dell Networking S-Series S3124F
 Dell Networking S-Series S3148
 Dell Networking S-Series S3148P
 Dell Networking S-Series S3048-ON
 Dell Networking S-Series S4048-ON
 Dell Networking S-Series S4048T-ON
 Dell Networking S-Series S5048F-ON
 Dell Networking S-Series S6010-ON
 Dell Networking S-Series S6100-ON
 Dell Networking C-Series C9010 and C1048P port extender
 Dell Networking Z-Series Z9100-ON
The TOE consists of both hardware and software components. Each software version is identifiable
by the unique build number. Each hardware profile provides a defined set of performance
characteristics - switching bandwidth, latency, and port density while offering the same level of
security features.
Dell Networking S3100 series
The Dell Networking S3100 series is a power-efficient 1/10GbE top-of-rack switches purpose-built for
office and campus networks. S3124, S3124P, S3124F switches feature a data rate up to 212Gbps
(full duplex) and a forwarding rate up to 158Mpps; S3148 and S3148P support data rate up to
260Gbps and a forwarding rate up to 193Mpps. These switches deliver line-rate switching with
Priority-based Flow Control (PFC), Enhance Transmission Selection (ETS), and network
virtualization features such as VRF-lite. The port and power configuration for individual models listed
below:
 S3124 offers 24x RJ45 10/100/1000Mb auto-sensing ports, 2x SFP+ ports, 2x GbE combo
media ports, and 200W PSU
 S3124F offers 24x 1000-SX (up to 500m distance) or 1000-LX (up to 10km distance) SFP
GbE ports, 2x SFP+ ports, 2x GbE combo media ports, and 200W PSU
 S3124P offers 24x RJ45 10/100/1000Mb PoE+ (up to 30.8W) auto- sensing ports, 2x SFP+
ports, 2x GbE combo media ports, and 715W PSU
 S3148 offers 48x RJ45 10/100/1000Mb auto-sensing ports, 2x SFP+ ports, 2x GbE combo
media ports, and 200W PSU
 S3148P offers 48x RJ45 10/100/1000Mb PoE+ (up to 30.8W) auto- sensing ports, 2x SFP+
ports, 2x GbE combo media ports, and 1100W PSU
Dell Networking S3048-ON
The Dell Networking S3048-ON is a top-of-rack switch built for high-performance, software-defined
data centers. The S3048-ON 1U design provides 48 line-rate 1000BASE-T ports that support
10MB/100MB/1GB and four line-rate 10GbE SFP+ ports. The S3048-ON features non-blocking
switching architecture that supports up to 260GBps (full-duplex) data rate and up to 131Mpps
Dell Networking Platforms
Security Target
8 of 55
forwarding rate and enables VRT-lite sharing of networking infrastructure and provides L3 traffic
isolation across tenants, including support for multicast and IPv6 routing.
Dell Networking S4000 Series
The Dell Networking S4000 series are an ultra-low-latency 10/40GbE top-of-rack switches built for
data center applications. S4000 switches offer data rate up to 1.44Tbps and a forwarding rate up
to1080Mpps that come in two configurations. The S4048-ON 1U design provides 48 x 10GbE SFP+
ports and 6 x 40GbE QSFP+ or 24x10GbE SFP+ ports. The S4048T-ON provides 48 x 10GBaseT
ports and 6 x 40GbE QSFP+ or 24x10GbE SFP+ ports. The S4000 series supports network
virtualization by implementing both network centric virtualization method (VRF-lite) and hypervisor
centric virtualization method (VXLAN).
Dell Networking S5048F-ON
The Dell Networking S-Series S5048F-ON is a top-of-rack switch purpose-built for applications in
high-performance data center, cloud and computing environments. The compact S5048F-ON model
design provides industry-leading density with up to 72 ports of 25GbE or up to 48 ports of 25GbE
SFP28 and 6 ports of 100GbE QSFP28 in a 1RU form factor. The S5048F-ON features 3.6Tbps (full-
duplex) non-blocking switching fabric delivering line-rate performance with PFC, DCBX, ETS and
iSCSI TLV support.
Dell Networking S6010-ON
The Dell Networking S-Series S6010-ON is a top-of-rack switch purpose-built for applications in
high-performance data center and computing environments. The S6010-ON 1U design provides 32
40GbE QSFP+ uplinks. The S6010 features 2.56Tbps (full-duplex) non-blocking, cut-through
switching fabric and delivers line-rate switching with QoS, VLT, DCBX and iSCSI TLV support.
Dell Networking S6100-ON
The Dell Networking S-Series S6100-ON is a top-of-rack modular switch purpose-built for
applications in high-performance data center and computing environments. The S6100-ON 2U
design provides up to 32 100G QSFP+ uplinks and two fixed 10GbE SFP+ ports. The S6100-ON
features 2.56Tbps (full-duplex) non-blocking, cut-through switching fabric and delivers line-rate
switching with PFC, DCBX, and ETS support.
Dell Networking Z9100-ON
The Dell Networking Z-Series Z9100-ON is a 1U top-of-rack core switch purpose-built for
applications in high-performance data centers. The Z9100-ON offers high-density 32 ports of
100GbE and two SFP+. The Z9100-ON features 6.4Tbps (full-duplex) non-blocking, cut-through
switching fabric and implements priority-based flow control (PFC), data center bridge exchange
(DCBX), and enhanced transmission selection (ETS).
Dell Networking C9010
The Dell Networking C-Series C9010 network director and optional C1048P rapid access node is a
network device designed to simplify deployment and management of core switches by collapsing
separate network tiers into a single logical switching tier and eliminating complexity of protocols
running between access and core/aggregation tiers. The C9010 8U platform supports modular slots
for up to 10 line card modules, two route processor modules, three fan modules, and four power
supply modules supporting up to 60 line-rate 40GbE QSFP+ ports. Each C1048P node supports up
to 48-port 1GbE PoE+ ports.
Dell Networking Platforms
Security Target
9 of 55
TOE Architecture
The underlying architecture of each TOE appliance consists of hardware that supports physical
network connections, memory, processor and software that implements routing and switching
functions, configuration information and drivers. While hardware varies between different appliance
models, the software (Dell EMC Networking OS v9.14) is shared across all platforms.
Dell EMC Networking OS v9.14 is composed of subsystems designed to implement operational,
security, management and networking functions. Hardware-specific device drivers that reside in the
kernel provide abstraction of the hardware components. Dedicated cryptographic module is
integrated with protocol libraries that implement secure channel functionality. Control plane
subsystem that includes Internet Protocol (IP) host stack, which can be further subdivided into
protocol and control layers, implements switching and routing functions. System management
subsystem, that includes an Authentication, Authorization and Accounting (AAA) module,
implements administrative interface and maintains configuration information.
The figure below outlines the TOE Architecture and subsystem interactions:
Figure 1: TOE Architecture
Dell Networking Platforms
Security Target
10 of 55
1.4.1 TOE Components
1.4.1.1 Hardware
The TOE consists of the following hardware:
Table 2: Dell networking appliances
Platform Model Processor Form Specs
Dell
Networking
S-Series
Switches
S3124 ARM Cortex A9 1U 24 x 1000BASE-T
S3124P ARM Cortex A9 1U 24 x 1000BASE-T PoE+
S3124F ARM Cortex A9 1U 24 x 1GbE SFP
S3148 ARM Cortex A9 1U 48 x 1000BASE-T
S3148P ARM Cortex A9 1U 48 x 1000BASE-T PoE+
S3048-ON Intel Atom C Series 1U 48 x 100BASE-T
4 x 1-GbE SFP+
S4048-ON Intel Atom C Series 1U 48 x 10GbE SFP+
6 x 40GbE QSFP+
S4048T-ON Intel Atom C Series 1U 48 x 10GBASE-T
6 x 40GbE QSFP+
S5048F-ON Intel Atom C Series 1U 72 x 25GbE
or
48 x 25GbE
6 x 100 GbE
S6010-ON Intel Atom C Series 1U 32 x 40GbE QSFP+
S6100-ON Intel Atom C Series 2U 2 x 10GbE SFP+
4 module bays with:
16 x QSFP+ 40GbE
or
8 x QSFP28 100GbE
Dell
Networking
C-Series
Switches
C9010 Intel Atom C Series 8U 10 module bays with:
24-port 10GbE
10GBASE-T Line Card
or
24-port 10GbE SFP+
or
6-port 40GbE QSFP+
Dell
Networking
Z-Series
Switches
Z9100-ON Intel Atom C Series 1U 32 x 100GbE QSFP28
or
64 x 50GbE QSFP+
or
32 x 40GbE QSFP+
or
128 x 25GbE QSFP+
or
128 x 25GbE QSFP+
2 x 10GbE
1.4.1.2 Software
The TOE runs pre-installed Dell EMC Networking OS v9.14. This software utilizes a common code
base of a modular nature with only the modules applicable to the specific hardware profile initialized
on any given hardware appliance.
Dell Networking Platforms
Security Target
11 of 55
The software, Dell EMC Networking OS v9.14, consists of Dell Operating System and Dell
Application Software. Dell Application Software implements a common code base of a modular
nature with only the modules applicable to the specific hardware loaded. Dell Operating System and
Dell Application Software are assigned a combined uniquely identifiable build number and are not
available separately. Each software build is produced from the same code base and compiled into
binary for the specific hardware architecture.
1.4.1.3 Management Interface(s)
The Dell EMC Networking OS v9.14 is configured and managed via a text-based Command Line
Interface (CLI). The CLI is accessible from a directly- connected terminal or remotely using SSH. The
CLI is structured into different operating modes for security and management purposes. Different
sets of commands are available in each mode, and it is possible to limit access to specific
commands using permissions.
1.4.2 Physical Boundary of the TOE
The physical boundary of the TOE includes:
 The appliance hardware
o RJ-45/RS-232 management ports
o USB port
o Dedicated Ethernet management port
 Embedded software installed on the appliance
o CLI management interface
The Operational Environment of the TOE includes:
 The SSH client that is used to remotely access the management interface
 The management workstation that hosts the SSH client
 External IT servers:
o Audit server for external storage of audit records
o NTP server for synchronizing system time
o Certificate Authority and OCSP servers to support X.509 (optional)
Dell Networking Platforms
Security Target
12 of 55
Figure 2: TOE Physical Boundary
1.4.3 Logical Boundary of the TOE
The logical boundary of the TOE is defined by implemented security functionality as summarized in
the Section 1.3.3 of this document.
1.4.3.1 Security Audit
The TOE generates audit records for all security-relevant events. For each event, the TOE records
the date and time, the type of event, the subject identity, and the outcome of the event logged. The
resulting records can be stored locally or securely sent to a designated audit server for archiving.
Security Administrators using the appropriate CLI commands can also view audit records locally. The
TOE also implements timestamps to ensure reliable audit information produced.
1.4.3.2 Cryptographic Support
The TOE performs the following cryptographic functionality:
 Encryption, decryption, hashing, keyed-hash message authentication, random number
generation, signature generation and verification utilizing dedicated cryptographic library
 Cryptographic functionality is utilized to implement secure channels
o SSLv2
o TLSv1.2
 Entropy is collected and used to support seeding with full entropy
 Critical Security Parameters (CSPs) internally stored and cleared when no longer in use
 X509 Certificate authentication integrated with TLS protocol
Dell Networking Platforms
Security Target
13 of 55
The TOE uses a dedicated cryptographic module to manage CSPs and implements deletion
procedures to mitigate the possibility of disclosure or modification of CSPs. Additionally, the TOE
provides commands to on-demand clear CSPs (e.g. host RSA keys), that can be invoked by a
Security Administrator with appropriate permissions.
1.4.3.3 Identification and Authentication
The TOE supports Role-Based Access Control (RBAC) managed by an AAA module that stores and
manages permissions of all users and their roles. Before any other action, each user is identified with
a login name and authenticated with a password. Each authorized user is associated with assigned
role and specific permissions that determine access to TOE features. The AAA module stores the
assigned role of each user along with all other information required that user to access the TOE.
1.4.3.4 Security Management
The TOE allows remote administration using an SSHv2 session over an out of band LAN
management RJ-45 port and local administration using a console via a separate RJ-45 running RS-
232 signaling/USB port. Both remote and local administration conducted over command-line
interface (CLI) terminal that facilitates access to all management functions used to administer the
TOE.
All of the management functions are restricted to the Security Administrators of the TOE. Security
Administrators can perform the following actions: manage user accounts and roles, reboot and apply
software updates, administer system configuration, and review the audit records.
The term “Security Administrator” is used to refer to any administrative user with the appropriate role
to perform the relevant functions.
1.4.3.5 Protection of the TSF
The TOE implements a number of measures to protect the integrity of its security features.
The TOE protects CSPs, including stored passwords and cryptographic keys, so they are not directly
viewable in plaintext. The TOE also ensures that reliable time information is available for both log
accountability and synchronization with the operating environment.
The TOE employs both dedicated communication channels as well as cryptographic means to
protect communication between itself and other components in the operational environment.
The TOE performs self-tests to detect internal failures and protect itself from malicious updates.
1.4.3.6 TOE Access
The TOE will display a customizable banner when an administrator initiates an interactive local or
remote session. The TOE also enforces an administrator-defined inactivity timeout after which the
inactive session is automatically terminated. Once a session (local or remote) has been terminated,
the TOE requires the user to re-authenticate.
1.4.3.7 Trusted Path/Channels
The TOE protects remote sessions by establishing a trusted path secured using SSH between itself
and the administrator. The TOE prevents disclosure or modification of audit records by establishing a
trusted channel using TLS between itself and the audit server.
Dell Networking Platforms
Security Target
14 of 55
1.4.4 Excluded Functionality
The TOE supports a number of features that are not part of the core functionality. These features are
not included in the scope of the evaluation:
 Any integration and/or communication with authentication servers such as Remote
Authentication Dial-In User Service (RADIUS) and Terminal Access Controller Access-
Control Systems (TACACS) is excluded from the evaluated configuration.
 Any use of HTTP and HTTPS (web interface) or OpenManage Network Manager (ONM) is
excluded and are disabled in the evaluated configuration.
 Routing protocols that integrate authentication or encryption such as Routing Information
Protocol (RIPv1, RIPv2), Open Shortest Path First (OSPFv2), Border Gateway Protocol
(BGP), Intermediate System to Intermediate System (IS-IS), and Virtual Router Redundancy
Protocol (VRRP) are not evaluated. RFC-compliant implementations are unable to satisfy
cryptographic requirements outlined in the PP.
 Use of the FTP server is excluded and it is disabled by default.
 Use of the SNMP management functionality is excluded and it is disabled by default. The use
of SNMPv3 for monitoring is not restricted; however, it is not evaluated.
 Reverse SSH tunnel with syslog is excluded from the evaluated configuration.
1.4.5 TOE Guidance and Reference Documents
The following user guidance documents are provided to customers and are considered part of the
TOE:
Table 3: TOE Reference Documents
Reference Title ID
Dell Configuration Guide for the S6010-ON System 9.14.1.0
Dell Configuration Guide for the S6100-ON System 9.14.1.0
Dell Configuration Guide for the S5048F-ON System 9.14.1.0
Dell Configuration Guide for the S4048-ON System 9.14.1.0
Dell Configuration Guide for the S3100-ON System 9.14.1.0
[ADMIN]
Dell Networking Command Line Reference Guide for the Z9100-ON System 9.14.1.0
Dell Networking Command Line Reference Guide for the C9010 System 9.14.1.0
Dell Networking Command Line Reference Guide for the S3048-ON System 9.14.1.0
Dell Command Line Reference Guide for the S6100-ON System 9.14.1.0
Dell Command Line Reference Guide for the S6010-ON System 9.14.1.0
Dell Command Line Reference Guide for the S5048F-ON System 9.14.1.0
Dell Command Line Reference Guide for the S4048-ON System 9.14.1.0
Dell Command Line Reference Guide for the S3100-ON System 9.14.1.0
[REF]
Configuration for Common Criteria NDcPP version 2.1Dell Networking Platforms
running Dell EMC Networking OS 9.14.1
[CC Addendum]
The documents in the following table were used as reference materials to develop this ST.
Table 4: ST Reference Documents
Reference Title ID
Common Criteria for Information Technology Security Evaluation Part 2: Security
Functional Components, Version 3.1, Revision 5, April 2017, CCMB-2017-04-002
[CC]
Dell Networking Platforms
Security Target
15 of 55
collaborative Protection Profile for Network Devices, Version 2.1, September 2018 [NDcPP]
Dell Networking Platforms
Security Target
16 of 55
2 Conformance Claims
Common Criteria Conformance Claim
This Security Target [ST] and the Target of Evaluation [TOE] are conformant to the following
Common Criteria [CC] specifications:
 Common Criteria for Information Technology Security Evaluation Part 2: Security
Functional Components, Version 3.1, Revision 5, April 2017, CCMB-2017-04-002
o Part 2 Conformant with additional extended functional components as specified by the
protection profile.
 Common Criteria for Information Technology Security Evaluation Part 3: Security
Assurance Components, Version 3.1, Revision 5, April 2017, CCMB-2017-04-003
o Part 3 Conformant with additional assurance activities as specified by the protection
profile.
Protection Profile Claim
The TOE claims exact compliance to collaborative Protection Profile for Network Devices, Version
2.1, September 2018 [NDcPP].
2.2.1 Technical Decisions
 TD0453: NIT Technical Decision for Clarify authentication methods SSH clients can use to
authenticate SSH servers
o Not applicable, clarification of authentication only applies to TOEs implementing SSH
Client.
o Not Applied.
 TD0452: NIT Technical Decision for FCS_(D)TLSC_EXT.X.2 IP addresses in reference
identifiers
o Expansion of the list of acceptable X509 identifiers
o Applied
 TD0451: NIT Technical Decision for ITT Comm UUID Reference Identifier
o Clarification on acceptable reference identifiers
o Applied
 TD0450: NIT Technical Decision for RSA-based ciphers and the Server Key Exchange
message
o Not applicable, clarification on diffie-hellman key agreement parameters only applies
to TOEs implementing TLS servers
o Not Applied.
 TD0449: NIT Technical Decision for Identification of usage of cryptographic schemes
o Additional documentation on key establishment schemes
o Applied
 TD0448: NIT Technical Decision for Documenting Diffie-Hellman 14 groups
o Clarification on claiming Diffie-Hellman group 14
o Applied.
 TD0447 NIT Technical Decision for Using 'diffie-hellman-group-exchange-sha256' in
FCS_SSHC/S_EXT.1.7
Dell Networking Platforms
Security Target
17 of 55
o Clarification on claiming custom diffie-hellman groups
o Applied.
 TD0425 – NIT Technical Decision for Cut-and-paste Error for Guidance AA
o Modifies supporting documentation for FTA_SSL.3.
o Applied.
 TD0424 – NIT Technical Decision for NDcPP v2.1 Clarification - FCS_SSHC/S_EXT1.5
o Modified SFR selection formatting for FCS_SSHC/S_EXT1.5.
o Applied.
 TD0423 – NIT Technical Decision for Clarification about application of RfI#201726rev2
o Clarification of RfI#201726rev2 on the use of TLS server X.509 certificates for
authentication with external IT entities.
o Applied.
 TD0412 – FCS_SSHS_EXT.1.5 SFR and AA discrepancy
o Clarifies FCS_SSHS_EXT.1.5 Test 2 objective.
o Applied.
 TD0411 – FCS_SSHC_EXT.1.5, Test 1 - Server and client side seem to be confused
o Not applicable, the TOE dose not claim FCS_SSHC_EXT.1.5.
o Not Applied.
 TD0410 – Redundant assurance activities associated with FAU_GEN.1
o Modified guidance documentation for FAU_GEN.1.
o Applied.
 TD0409 – FIA_AFL.1 to key-based SSH authentication
o Clarification for FIA_AFL.1 applicability for password based authentication.
o Applied.
 TD0408 – Local vs. Remote administrator accounts
o Modified FIA_UAU_EXT.2, FIA_AFL.1.1 and FIA_AFL.1.2 SFRs, supporting
document and application notes; FMT_SMF.1 supporting document modification.
o Applied.
 TD0407 – handling Certification of Cloud Deployments
o Statement on cloud platforms ineligibility for CC certifications.
o Not Applicable, the TOE does not claim Cloud Platforms
o Not Applied
 TD0402 – RSA-based FCS_CKM.2 Selection
o Modified RSA-based key establishment scheme selection to RSAES-PKCS1-v1_5.
o Applied.
 TD0401 – Reliance on external servers to meet SFRs
o Not applicable, the TOE does not claim integration with external authentication
servers.
o Not Applied.
 TD0400 – FCS_CKM.2 and elliptic curve-based key establishment.
o Modified application note for FCS_CKM1.
o Applied.
 TD0399 – Manual installation of CRL (FIA_X509_EXT.2)
o Not Applicable, the TOE does not claim CRL support.
o Not Applied.
 TD0398 – FCS_SSH*EXT.1.1 RFCs for AES-CTR
o Modified application note for FCS_SSHS_EXT.1.
o Applied.
 TD0397 – Fixing AES-CTR Mode Tests
o Modified AES-CTR Known Answer Test.
Dell Networking Platforms
Security Target
18 of 55
o Applied.
 TD0396 – FCS_TLSC_EXT.2.1, Test 2
o Modified FCS_TLSC_EXT.2.1 Test 2.
o Applied.
 TD0395 – Different Handling of TLS1.1 and TLS1.2
o FCS_TLSS_EXT.2.4 and 2.5 not claimed.
o Not Applied.
Package Claim
The TOE does not claim to be conformant with any pre-defined packages.
Conformance Rationale
This Security Target claims strict conformance to only one PP – the NDcPP and no extended
packages.
The Security Problem Definition (SPD) of this ST is consistent with the statement of the SPD in the
PP, as the ST claims exact conformance to the PP and no other threats, organizational security
policies, or assumptions are added.
The security objectives of this ST are consistent with the statement of the security objectives in the
PP as the ST claims exact conformance to the PP and no other security objectives are added.
The security requirements of this ST are consistent with the statement of the security requirements in
the PP as the ST claims exact conformance to the PP.
3 Security Problem Definition
Threats
This section identifies the threats applicable to the TOE as specified in the PP.
Table 5: TOE Threats
Threat Name Threat Definition
Communications with the Network Device
Dell Networking Platforms
Security Target
19 of 55
Threat Name Threat Definition
T.UNAUTHORIZED_ADMINISTRATOR_ACCESS
Threat agents may attempt to gain administrator
access to the network device by nefarious means
such as masquerading as an administrator to the
device, masquerading as the device to an
administrator, replaying an administrative session
(in its entirety, or selected portions), or performing
man-in-the-middle attacks, which would provide
access to the administrative session, or sessions
between network devices. Successfully gaining
administrator access allows malicious actions that
compromise the security functionality of the device
and the network on which it resides.
T.WEAK_CRYPTOGRAPHY
Threat agents may exploit weak cryptographic
algorithms or perform a cryptographic exhaust
against the key space. Poorly chosen encryption
algorithms, modes, and key sizes will allow
attackers to compromise the algorithms, or brute
force exhaust the key space and give them
unauthorized access allowing them to read,
manipulate and/or control the traffic with minimal
effort.
T.UNTRUSTED_COMMUNICATION_CHANNELS
Threat agents may attempt to target network
devices that do not use standardized secure
tunneling protocols to protect the critical network
traffic. Attackers may take advantage of poorly
designed protocols or poor key management to
successfully perform man-in-the-middle attacks,
replay attacks, etc. Successful attacks will result in
loss of confidentiality and integrity of the critical
network traffic, and potentially could lead to a
compromise of the network device itself.
T.WEAK_AUTHENTICATION_ENDPOINTS
Threat agents may take advantage of secure
protocols that use weak methods to authenticate the
endpoints – e.g., shared password that is guessable
or transported as plaintext. The consequences are
the same as a poorly designed protocol, the attacker
could masquerade as the administrator or another
device, and the attacker could insert themselves into
the network stream and perform a man-in-the-
middle attack. The result is the critical network traffic
is exposed and there could be a loss of
confidentiality and integrity, and potentially the
network device itself could be compromised.
Valid Updates
T.UPDATE_COMPROMISE
Threat agents may attempt to provide a
compromised update of the software or firmware
which undermines the security functionality of the
device. Non-validated updates or updates validated
using non-secure or weak cryptography leave the
update firmware vulnerable to surreptitious
alteration.
Dell Networking Platforms
Security Target
20 of 55
Threat Name Threat Definition
Audited Activity
T.UNDETECTED_ACTIVITY
Threat agents may attempt to access, change,
and/or modify the security functionality of the
network device without administrator awareness.
This could result in the attacker finding an avenue
(e.g., misconfiguration, flaw in the product) to
compromise the device and the administrator would
have no knowledge that the device has been
compromised.
Administrator and Device Credentials and Data
T.SECURITY_FUNCTIONALITY_COMPROMISE
Threat agents may compromise credentials and
device data enabling continued access to the
network device and its critical data. The compromise
of credentials include replacing existing credentials
with an attacker’s credentials, modifying existing
credentials, or obtaining the administrator or device
credentials for use by the attacker.
T.PASSWORD_CRACKING
Threat agents may be able to take advantage of
weak administrative passwords to gain privileged
access to the device. Having privileged access to
the device provides the attacker unfettered access
to the network traffic, and may allow them to take
advantage of any trust relationships with other
network devices.
Device Failure
T.SECURITY_FUNCTIONALITY_FAILURE
An external, unauthorized entity could make use of
failed or compromised security functionality and
might therefore subsequently use or abuse security
functions without prior authentication to access,
change or modify device data, critical network traffic
or security functionality of the device.
Assumptions
This section identifies assumptions applicable to the TOE as specified in the PP.
Table 6: TOE Assumptions
Dell Networking Platforms
Security Target
21 of 55
Assumption Name Assumption Definition
A.PHYSICAL_PROTECTION The network device is assumed to be physically protected in its
operational environment and not subject to physical attacks that
compromise the security and/or interfere with the device’s physical
interconnections and correct operation. This protection is assumed to
be sufficient to protect the device and the data it contains. As a result,
the cPP will not include any requirements on physical tamper
protection or other physical attack mitigations. The cPP will not
expect the product to defend against physical access to the device
that allows unauthorized entities to extract data, bypass other
controls, or otherwise manipulate the device.
A.LIMITED_FUNCTIONALITY The device is assumed to provide networking functionality as its core
function and not provide functionality/ services that could be deemed
as general purpose computing. For example the device should not
provide computing platform for general purpose applications
(unrelated to networking functionality).
A.NO_THRU_TRAFFIC_PROTECTION A standard/generic network device does not provide any assurance
regarding the protection of traffic that traverses it. The intent is for the
network device to protect data that originates on or is destined to the
device itself, to include administrative data and audit data. Traffic that
is traversing the network device, destined for another network entity,
is not covered by the ND cPP. It is assumed that this protection will
be covered by cPPs for particular types of network devices (e.g,
firewall).
A.TRUSTED_ADMINISTRATOR The Security Administrator(s) for the network device are assumed to
be trusted and to act in the best interest of security for the
organization. This includes being appropriately trained, following
policy, and adhering to guidance documentation. Administrators are
trusted to ensure passwords/credentials have sufficient strength and
entropy and to lack malicious intent when administering the device.
The network device is not expected to be capable of defending
against a malicious Administrator that actively works to bypass or
compromise the security of the device.
For TOEs supporting X.509v3 certificate-based authentication, the
Security Administrator(s) are expected to fully validate (e.g. offline
verification) any CA certificate (root CA certificate or intermediate CA
certificate) loaded into the TOE’s trust store (aka 'root store', ' trusted
CA Key Store', or similar) as a trust anchor prior to use (e.g. offline
verification).
A.REGULAR_UPDATES The network device firmware and software is assumed to be updated
by an administrator on a regular basis in response to the release of
product updates due to known vulnerabilities.
A.ADMIN_CREDENTIALS_SECURE The administrator’s credentials (private key) used to access the
network device are protected by the platform on which they reside.
A.RESIDUAL_INFORMATION The Administrator must ensure that there is no unauthorized access
possible for sensitive residual information (e.g. cryptographic keys,
keying material, PINs, passwords etc.) on networking equipment
when the equipment is discarded or removed from its operational
environment.
Dell Networking Platforms
Security Target
22 of 55
Organizational Security Policies
This section identifies the organizational security policies applicable to the TOE as specified in the
PP.
Table 7: Organizational Security Policies
Policy Name Policy Definition
P.ACCESS_BANNER The TOE shall display an initial banner describing restrictions of use, legal
agreements, or any other appropriate information to which users consent
by accessing the TOE.
Dell Networking Platforms
Security Target
23 of 55
4 Security Objectives
This section defines the security objectives of the TOE and its supporting environment. The security
objectives identify the responsibilities of the TOE and its supporting environment in meeting the
security needs.
Security Objectives for the TOE
The collaborative Protection Profile for Network Devices v2.1 does not define any security objectives
for the TOE.
Security Objectives for the Operational Environment
This section identifies the security objectives as applicable to the operational environment as
specified in the PP. These objectives
Table 8: Security Objectives for the Operational Environment
Objective Name Environmental Security Objective Definition
OE.PHYSICAL Physical security, commensurate with the value of the TOE and
the data it contains, is provided by the environment.
OE.NO_GENERAL_PURPOSE There are no general-purpose computing capabilities (e.g.,
compilers or user applications) available on the TOE, other than
those services necessary for the operation, administration and
support of the TOE.
OE.NO_THRU_TRAFFIC_PROTECTION The TOE does not provide any protection of traffic that
traverses it. It is assumed that protection of this traffic will be
covered by other security and assurance measures in the
operational environment.
OE.TRUSTED_ADMIN Security Administrators are trusted to follow and apply all
guidance documentation in a trusted manner.
For TOEs supporting X.509v3 certificate-based authentication,
the Security Administrator(s) are assumed to monitor the
revocation status of all certificates in the TOE's trust store and
to remove any certificate from the TOE’s trust store in case
such certificate can no longer be trusted.
OE.UPDATES The TOE firmware and software is updated by an administrator
on a regular basis in response to the release of product updates
due to known vulnerabilities.
OE.ADMIN_CREDENTIAL_SECURE The administrator’s credentials (private key) used to access the
TOE must be protected on any other platform on which they
reside.
OE.RESIDUAL_INFORMATION The Security Administrator ensures that there is no
unauthorized access possible for sensitive residual information
(e.g. cryptographic keys, keying material, PINs, passwords etc.)
on networking equipment when the equipment is discarded or
removed from its operational environment.
Dell Networking Platforms
Security Target
24 of 55
5 Extended Components Definition
The extended components listed in the Table 9 have been sourced from collaborative Protection
Profile for Network Devices, Version 2.1, September 2018 [NDcPP].
The extended components, as defined in Section 8.3 of Common Criteria for Information Technology
Security Evaluation Part 1: Introduction and general model, Version 3.1, Revision 5, are identified by
“_EXT” in the component name. NDcPP Appendix C contains the definitions for all extended
components.
Extended Security Functional Components
Table 9: Extended Components
Functional Component
1 FAU_STG_EXT.1 Protected Audit Event Storage
2 FCS_RBG_EXT.1 Cryptographic Operation (Random Bit Generation)
3 FCS_SSHS_EXT.1 SSH Server Protocol
4 FCS_TLSC_EXT.2 TLS Client Protocol with authentication
5 FCS_NTP_EXT.1 NTP Protocol
6 FIA_PMG_EXT.1 Password Management
7 FIA_UIA_EXT.1 User Identification and Authentication
8 FIA_UAU_EXT.2 Password-based Authentication Mechanism
9 FIA_X509_EXT.1/Rev X.509 Certificate Validation
10 FIA_X509_EXT.2 X.509 Certificate Authentication
11 FIA_X509_EXT.3 X.509 Certificate Requests
12 FPT_SKP_EXT.1 Protection of TSF Data (for reading of all symmetric keys)
13 FPT_APW_EXT.1 Protection of Administrator Passwords
14 FPT_TST_EXT.1 TSF Testing
15 FPT_STM_EXT.1 Reliable Time Stamps
16 FPT_TUD_EXT.1 Trusted Update
17 FTA_SSL_EXT.1 TSF-initiated Session Locking
Extended Security Functional Components Rationale
All extended security functional components are sourced directly from the NDcPP and applied
verbatim. Exact compliance required by the NDcPP also mandates inclusion of all applicable
extended components defined in the PP.
Dell Networking Platforms
Security Target
25 of 55
6 Security Requirements
Security Functional Requirements
Conventions
The following conventions have been applied in this document:
 Security Functional Requirements – Part 2 of the CC defines the approved set of
operations that may be applied to functional requirements: iteration, assignment,
selection, and refinement.
o Iteration: indicated by adding a string starting with “/” (“FCS_COP.1/Hash”).
o Assignment: allows the specification of an identified parameter. Assignments are
indicated using bold and are surrounded by brackets (e.g., [assignment]).
o Selection: allows the specification of one or more elements from a list. Selections are
indicated using bold italics and are surrounded by brackets (e.g., [selection]).
o Refinement: are identified with "Refinement:" right after the short name. Additions to
the CC text are specified in italicized bold and underlined text.
Note 1: Operations already performed in the NDcPP are not identified in this Security Target.
Note 2: Refinements made by the PP authors will not be identified as refinements in this ST. The
“Refinement” identifier is reserved for identifying any refinements made by the ST author.
 Explicitly stated Security Functional Requirements (i.e., those not found in Part 2 of
the CC) are identified “_EXT” in the component name.)
The TOE security functional requirements are listed in Table 10. All SFRs are based on
requirements defined in Part 2 of the Common Criteria or defined in the collaborative Protection
Profile for Network Devices, Version 2.1, September 2018 [NDcPP].
Table 10: TOE Security Functional Components
Functional Components
1 FAU_GEN.1 Audit Data Generation
2 FAU_GEN.2 User Identity Association
3 FAU_STG_EXT.1 Protected Audit Event Storage
4 FCS_CKM.1 Cryptographic Key Generation
5 FCS_CKM.2 Cryptographic Key Establishment
6 FCS_CKM.4 Cryptographic Key Destruction
7 FCS_COP.1/DataEncryption Cryptographic Operation (AES Data Encryption/Decryption)
8 FCS_COP.1/SigGen Cryptographic Operation (Signature Generation and Verification)
9 FCS_COP.1/Hash Cryptographic Operation (Hash Algorithm)
10 FCS_COP.1/KeyedHash Cryptographic Operation (Keyed Hash Algorithm)
11 FCS_RBG_EXT.1 Cryptographic Operation (Random Bit Generation)
12 FCS_SSHS_EXT.1 SSH Server Protocol
13 FCS_TLSC_EXT.2 TLS Client Protocol with authentication
14 FCS_NTP_EXT.1 NTP Protocol
15 FIA_PMG_EXT.1 Password Management
16 FIA_AFL.1 Authentication Failure Management
17 FIA_UIA_EXT.1 User Identification and Authentication
Dell Networking Platforms
Security Target
26 of 55
Functional Components
18 FIA_UAU_EXT.2 Password-based Authentication Mechanism
19 FIA_UAU.7 Protected Authentication Feedback
20 FIA_X509_EXT.1/Rev X.509 Certificate Validation
21 FIA_X509_EXT.2 X.509 Certificate Authentication
22 FIA_X509_EXT.3 X.509 Certificate Requests
23 FMT_MOF.1/ManualUpdate Trusted Update
24 FMT_MTD.1/CoreData Management of TSF Data
25 FMT_MTD.1/CryptoKeys Management of TSF Data
26 FMT_SMF.1 Specification of Management Functions
27 FMT_SMR.2 Restrictions on Security Roles
28 FPT_SKP_EXT.1 Protection of TSF Data (for reading of all symmetric keys)
29 FPT_APW_EXT.1 Protection of Administrator Passwords
30 FPT_TST_EXT.1 TSF Testing
31 FPT_TUD_EXT.1 Trusted Update
32 FPT_STM_EXT.1 Reliable Time Stamps
33 FTA_SSL_EXT.1 TSF-initiated Session Locking
34 FTA_SSL.3 TSF-initiated Termination
35 FTA_SSL.4 User-initiated Termination
36 FTA_TAB.1 Default TOE Access Banners
37 FTP_ITC.1 Inter-TSF Trusted Channel
38 FTP_TRP.1/Admin Trusted Path
6.1.1 Security Audit (FAU)
6.1.1.1 FAU_GEN.1 Audit Data Generation
FAU_GEN.1.1 The TSF shall be able to generate an audit record of the following auditable
events:
a) Start-up and shut-down of the audit functions;
b) All auditable events for the not specified level of audit; and
c) All administrative actions comprising:
 Administrative login and logout (name of user account shall be logged if individual
user accounts are required for Administrators).
 Changes to TSF data related to configuration changes (in addition to the
information that a change occurred it shall be logged what has been changed).
 Generating/import of, changing, or deleting of cryptographic keys (in addition to
the action itself a unique key name or key reference shall be logged).
 Resetting passwords (name of related user account shall be logged).
 [no other actions]
d) Specifically defined auditable events listed in Table 11.
FAU_GEN.1.2 The TSF shall record within each audit record at least the following
information:
a) Date and time of the event, type of event, subject identity, and the outcome (success or
failure) of the event; and
b) For each audit event type, based on the auditable event definitions of the functional
components included in the PP/ST, information specified in column three of Table 11.
Dell Networking Platforms
Security Target
27 of 55
Table 11: Auditable Events (Table 2 of the NDcPP)
Requirement Auditable Events Additional Audit Record Contents
FAU_GEN.1 None. None.
FAU_GEN.2 None. None.
FAU_STG_EXT.1 None. None.
FCS_CKM.1 None. None.
FCS_CKM.2 None. None.
FCS_CKM.4 None. None.
FCS_COP.1/DataEncryption None. None.
FCS_COP.1/SigGen None. None.
FCS_COP.1/Hash None. None.
FCS_COP.1/KeyedHash None. None.
FCS_RBG_EXT.1 None. None.
FCS_NTP_EXT.1 Configuration of a new time
server
Removal of configured time
server
Identity if new/removed time server
FIA_AFL.1 Unsuccessful login attempts
limit is met or exceeded.
Origin of the attempt (e.g., IP address).
FCS_SSHS_EXT.1 Failure to establish an SSH
session
Reason for failure
FCS_TLSC_EXT.2 Failure to establish a TLS
Session
Reason for failure
FIA_PMG_EXT.1 None. None.
FIA_UIA_EXT.1 All use of the identification
and authentication
mechanism.
Provided user identity, origin of the attempt
(e.g., IP address).
FIA_UAU_EXT.2 All use of the identification
and authentication
mechanism.
Origin of the attempt (e.g., IP address).
FIA_UAU.7 None. None.
FIA_X509_EXT.1/Rev Unsuccessful attempt to
validate a certificate
Any addition, replacement or
removal of trust anchors in
the TOE's trust store
Reason for failure of certificate validation
Identification of certificates added,
replaced or removed as trust anchor in the
TOE's trust store
FIA_X509_EXT.2 None. None.
FIA_X509_EXT.3 None. None.
FMT_MOF.1/ManualUpdate Any attempt to initiate a
manual update
None.
FMT_MTD.1/CoreData None None.
FMT_MTD.1/CryptoKeys None None.
FMT_SMF.1 All management activities of
TSF data.
None.
FMT_SMR.2 None. None.
FPT_SKP_EXT.1 None. None.
FPT_APW_EXT.1 None. None.
FPT_TST_EXT.1 None. None.
FPT_TUD_EXT.1 Initiation of update; result of
the update attempt (success
or failure).
None.
Dell Networking Platforms
Security Target
28 of 55
6.1.1.2 FAU_GEN.2 User Identity Association
FAU_GEN.2.1 For audit events resulting from actions of identified users, the TSF shall be
able to associate each auditable event with the identity of the user that caused
the event.
6.1.1.3 FAU_STG_EXT.1 Protected Audit Event Storage
FAU_STG_EXT.1.1 The TSF shall be able to transmit the generated audit data to an external IT
entity using a trusted channel according to FTP_ITC.1
FAU_STG_EXT.1.2 The TSF shall be able to store generated audit data on the TOE itself.
[
 TOE shall consist of a single standalone component that stores audit data locally.
]
FAU_STG_EXT.1.3 The TSF shall [overwrite previous audit records according to the
following rule: [the oldest message is overwritten first]] when the local
storage space for audit data is full.
FPT_STM_EXT.1 Discontinuous changes to
time - either Administrator
actuated or changed via an
automated process. (Note
that no continuous changes
to time need to be logged.
See also application note on
FPT_STM_EXT.1)
For discontinuous changes to time: The
old and new values for the time.
Origin of the attempt to change time for
success and failure (e.g., IP address).
FTA_SSL_EXT.1 (if “terminate
the session” is selected)
The termination of a local
session by the session
locking mechanism.
None.
FTA_SSL.3 The termination of a remote
session by the session
locking mechanism.
None.
FTA_SSL.4 The termination of an
interactive session.
None.
FTA_TAB.1 None. None.
FTP_ITC.1 Initiation of the trusted
channel.
Identification of the initiator and target of
failed trusted channels establishment
attempt.
Termination of the trusted
channel.
Failure of the trusted
channel functions.
FTP_TRP.1/Admin Initiation of the trusted path. None.
Termination of the trusted
path.
Failures of the trusted path
functions.
Dell Networking Platforms
Security Target
29 of 55
6.1.2 Cryptographic Support (FCS)
6.1.2.1 FCS_CKM.1 Cryptographic Key Generation (for asymmetric keys)
FCS_CKM.1.1 The TSF shall generate asymmetric cryptographic keys in accordance with a
specified cryptographic key generation algorithm:
[
 RSA schemes using cryptographic key sizes of 2048-bit or greater that meet the
following: FIPS PUB 186-4, “Digital Signature Standard (DSS)”, Appendix B.3;
 FFC Schemes using Diffie-Hellman group 14 that meet the following: RFC 3526, Section
3;]
and specified cryptographic key sizes [assignment: cryptographic key sizes] that meet
the following: [assignment: list of standards].
6.1.2.2 FCS_CKM.2 Cryptographic Key Establishment
FCS_CKM.2.1 The TSF shall perform cryptographic key establishment in accordance with
a specified cryptographic key establishment method:
[
 RSA-based key establishment schemes that meet the following: RSAES-PKCS1-v1_5 as
specified in Section 7.2 of RFC 3447, “Public-Key Cryptography Standards (PKCS) #1: RSA
Cryptography Specifications Version 2.1”;
 Key establishment scheme using Diffie-Hellman group 14 that meets the following:
RFC 3526, Section 3;]
that meets the following: [assignment: list of standards].
6.1.2.3 FCS_CKM.4 Cryptographic Key Destruction
FCS_CKM.4.1 The TSF shall destroy cryptographic keys in accordance with a specified
cryptographic key destruction method
 For plaintext keys in volatile storage, the destruction shall be executed by a [single
overwrite consisting of [zeroes]];
 For plaintext keys in non-volatile storage, the destruction shall be executed by the invocation
of an interface provided by a part of the TSF that
[logically addresses the storage location of the key and performs a [single], overwrite
consisting of [zeroes]];
that meets the following: No Standard.
Dell Networking Platforms
Security Target
30 of 55
6.1.2.4 FCS_COP.1/DataEncryption Cryptographic Operation (AES Data Encryption/
Decryption)
FCS_COP.1.1/DataEncryption The TSF shall perform encryption/decryption in accordance
with a specified cryptographic algorithm AES used in [CBC]
mode and cryptographic key sizes [128 bits, 192 bits, 256
bits] that meet the following: AES as specified in ISO 18033-3,
[CBC as specified in ISO 10116].
6.1.2.5 FCS_COP.1/SigGen Cryptographic Operation (Signature Generation and
Verification)
FCS_COP.1.1/SigGen The TSF shall perform cryptographic signature services
(generation and verification) in accordance with a specified
cryptographic algorithm
 [RSA Digital Signature Algorithm (rDSA) with a key size (modulus) [2048 bits,
3072 bits]]
that meet the following:
 [For RSA schemes: FIPS PUB 186-4, “Digital Signature Standard (DSS)”,
Section 5.5, using PKCS #1 v2.1 Signature Schemes RSASSA-PSS and/or
RSASSA-PKCS1v1_5; ISO/IEC 9796-2, Digital signature scheme 2 or Digital
Signature scheme 3].
6.1.2.6 FCS_COP.1/Hash Cryptographic Operation (Hash Algorithm)
FCS_COP.1.1/Hash The TSF shall perform cryptographic hashing services in
accordance with a specified cryptographic algorithm [SHA-1,
SHA-256, SHA-512] and cryptographic key sizes [assignment:
cryptographic key sizes] and message digest sizes [160, 256,
512] bits that meet the following: ISO/IEC 10118-3:2004.
6.1.2.7 FCS_COP.1/KeyedHash Cryptographic Operation (Keyed Hash Algorithm)
FCS_COP.1.1/KeyedHash The TSF shall perform keyed-hash message authentication in
accordance with a specified cryptographic algorithm [HMAC-
SHA-1, HMAC-SHA-256] and cryptographic key sizes [160-bit,
256-bit] and message digest sizes [160, 256] bits that meet
the following: ISO/IEC 9797-2:2011, Section 7 “MAC Algorithm
2”.
6.1.2.8 FCS_RBG_EXT.1 Random Bit Generation
FCS_RBG_EXT.1.1 The TSF shall perform all deterministic random bit generation services in
accordance with ISO/IEC 18031:2011 using [CTR_DRBG (AES)].
FCS_RBG_EXT.1.2 The deterministic RBG shall be seeded by at least one entropy source that
accumulates entropy from [[two] software-based noise sources] with a
minimum of [256 bits] of entropy at least equal to the greatest security
strength, according to ISO/IEC 18031:2011 Table C.1.
Dell Networking Platforms
Security Target
31 of 55
6.1.2.9 FCS_SSHS_EXT.1 SSH Server Protocol
FCS_SSHS_EXT.1.1 The TSF shall implement the SSH protocol that complies with RFC(s) [4251,
4252, 4253, 4254, 6668].
FCS_SSHS_EXT.1.2 The TSF shall ensure that the SSH protocol implementation supports the
following authentication methods as described in RFC 4252: public key-based,
[password-based].
FCS_SSHS_EXT.1.3 The TSF shall ensure that, as described in RFC 4253, packets greater than
[256k] bytes in an SSH transport connection are dropped.
FCS_SSHS_EXT.1.4 The TSF shall ensure that the SSH transport implementation uses the
following encryption algorithms and rejects all other encryption algorithms:
[aes128-cbc, aes256-cbc].
FCS_SSHS_EXT.1.5 The TSF shall ensure that the SSH public-key based authentication
implementation uses [ssh-rsa, rsa-sha2-256, rsa-sha2-512] as its public key
algorithm(s) and rejects all other public key algorithms.
FCS_SSHS_EXT.1.6 The TSF shall ensure that the SSH transport implementation uses [hmac-
sha1, hmac-sha1-96, hmac-sha2-256] as its MAC algorithm(s) and rejects all
other MAC algorithm(s).
FCS_SSHS_EXT.1.7 The TSF shall ensure that [diffie-hellman-group14-sha1] and [no other
methods] are the only allowed key exchange methods used for the SSH
protocol.
FCS_SSHS_EXT.1.8 The TSF shall ensure that within SSH connections the same session keys are
used for a threshold of no longer than one hour, and no more than one
gigabyte of transmitted data. After either of the thresholds are reached a rekey
needs to be performed.
6.1.2.10 FCS_TLSC_EXT.2 TLS Client Protocol with authentication
FCS_TLSC_EXT.2.1 The TSF shall implement [TLS 1.2 (RFC 5246)] and reject all other TLS and
SSL versions. The TLS implementation will support the following ciphersuites:
[
 TLS_RSA_WITH_AES_128_CBC_SHA as defined in RFC 3268
 TLS_RSA_WITH_AES_256_CBC_SHA as defined in RFC 3268
 TLS_DHE_RSA_WITH_AES_256_CBC_SHA as defined in RFC 3268
 TLS_DHE_RSA_WITH_AES_128_CBC_SHA as defined in RFC 3268
 TLS_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246
 TLS_RSA_WITH_AES_256_CBC_ SHA256 as defined in RFC 5246
 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 as defined in RFC 5246
 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246
].
Dell Networking Platforms
Security Target
32 of 55
FCS_TLSC_EXT.2.2 The TSF shall verify that the presented identifiers of the following types:
[identifiers defined in RFC 6125, IPv4 address in SAN] are matched to
reference identifiers.
FCS_TLSC_EXT.2.3 When establishing a trusted channel, by default the TSF shall not establish a
trusted channel if the server certificate is invalid. The TSF shall also:
[
 require administrator authorization to establish the connection if the TSF fails to
[determine the revocation status] of the presented server certificate
].
FCS_TLSC_EXT.2.4 The TSF shall [not present the Supported Elliptic Curves Extension] in the
Client Hello.
FCS_TLSC_EXT.2.5 The TSF shall support mutual authentication using X.509v3 certificates.
6.1.2.11 FCS_NTP_EXT.1 NTP Protocol
FCS_NTP_EXT.1.1 The TSF shall use only the following NTP version(s) [NTP v4 (RFC 5905)].
FCS_NTP_EXT.1.2 The TSF shall update its system time using [
 Authentication using [SHA1] as the message digest algorithm(s);
].
FCS_NTP_EXT.1.3 The TSF shall not update NTP timestamp from broadcast and/or multicast
addresses.
FCS_NTP_EXT.1.4 The TSF shall support configuration of at least three (3) NTP time sources.
6.1.3 Identification and Authentication (FIA)
6.1.3.1 FIA_AFL.1 Authentication Failure Management
FIA_AFL.1.1 The TSF shall detect when an Administrator configurable positive integer
within [1-16] unsuccessful authentication attempts occur related to
Administrators attempting to authenticate using a password.
FIA_AFL.1.2 When the defined number of unsuccessful authentication attempts has been
met, the TSF shall [prevent the offending Administrator from successfully
establishing remote session using any authentication method that
involves a password until an Administrator defined time period has
elapsed].
6.1.3.2 FIA_PMG_EXT.1 Password Management
FIA_PMG_EXT.1.1 The TSF shall provide the following password management capabilities for
administrative passwords:
Dell Networking Platforms
Security Target
33 of 55
a) Passwords shall be able to be composed of any combination of upper and lower case letters,
numbers, and the following special characters: [ “!”, “@”, “#”, “$”, “%”, “^”, “&”, “*”, “(”,
“)”, [ “'”, “+”, “,”, “-”, “.”, “/”, “:”, “;”, “<”, “=”, “>”, “[”, “\”, “]”, “_”, “`”, “{”, and “}” ]];
b) Minimum password length shall be configurable to between [0] and [32] characters.
6.1.3.3 FIA_UIA_EXT.1 User Identification and Authentication
FIA_UIA_EXT.1.1 The TSF shall allow the following actions prior to requiring the non-TOE entity
to initiate the identification and authentication process:
 Display the warning banner in accordance with FTA_TAB.1;
 [no other actions]
FIA_UIA_EXT.1.2 The TSF shall require each administrative user to be successfully identified
and authenticated before allowing any other TSF-mediated actions on behalf
of that administrative user.
6.1.3.4 FIA_UAU_EXT.2 Password-based Authentication Mechanism
FIA_UAU_EXT.2.1 The TSF shall provide a local [password-based] authentication mechanism to
perform local administrative user authentication.
6.1.3.5 FIA_UAU.7 Protected Authentication Feedback
FIA_UAU.7.1 The TSF shall provide only obscured feedback to the administrative user while
the authentication is in progress at the local console.
6.1.3.6 FIA_X509_EXT.1 X.509 Certificate Validation
FIA_X509_EXT.1.1/Rev The TSF shall validate certificates in accordance with the following
rules:
 RFC 5280 certificate validation and certificate path validation supporting a
minimum path length of three certificates.
 The certificate path must terminate with a trusted CA certificate designated as a
trust anchor.
 The TSF shall validate a certification path by ensuring that all CA certificates in
the certification path contain the basicConstraints extension with the CA flag set to
TRUE.
 The TSF shall validate the revocation status of the certificate using [the Online
Certificate Status Protocol (OCSP) as specified in RFC 6960].
 The TSF shall validate the extendedKeyUsage field according to the following
rules:
o Certificates used for trusted updates and executable code integrity
verification shall have the Code Signing purpose (id-kp 3 with OID
1.3.6.1.5.5.7.3.3) in the extendedKeyUsage field.
Dell Networking Platforms
Security Target
34 of 55
o Server certificates presented for TLS shall have the Server Authentication
purpose (id-kp 1 with OID 1.3.6.1.5.5.7.3.1) in the extendedKeyUsage
field.
o Client certificates presented for TLS shall have the Client Authentication
purpose (id-kp 2 with OID 1.3.6.1.5.5.7.3.2) in the extendedKeyUsage
field.
o OCSP certificates presented for OCSP responses shall have the OCSP
Signing purpose (id-kp 9 with OID 1.3.6.1.5.5.7.3.9) in the
extendedKeyUsage field.
FIA_X509_EXT.1.2/Rev The TSF shall only treat a certificate as a CA certificate if the
basicConstraints extension is present and the CA flag is set to TRUE.
6.1.3.7 FIA_X509_EXT.2 X.509 Certificate Authentication
FIA_X509_EXT.2.1 The TSF shall use X.509v3 certificates as defined by RFC 5280 to support
authentication for [TLS], and [no additional uses].
FIA_X509_EXT.2.2 When the TSF cannot establish a connection to determine the validity of a
certificate, the TSF shall [allow the Administrator to choose whether to
accept the certificate in these cases].
6.1.3.8 FIA_X509_EXT.3 X.509 Certificate Requests
FIA_X509_EXT.3.1 The TSF shall generate a Certificate Request Message as specified by RFC
2986 and be able to provide the following information in the request: public key
and [Common Name, Organization, Organizational Unit, Country].
FIA_X509_EXT.3.2 The TSF shall validate the chain of certificates from the Root CA upon
receiving the CA Certificate Response.
6.1.4 Security Management (FMT)
6.1.4.1 FMT_MOF.1/ManualUpdate Management of security functions behavior
FMT_MOF.1.1/ManualUpdate The TSF shall restrict the ability to enable the functions to
perform manual update to Security Administrators.
6.1.4.2 FMT_MTD.1/CoreData Management of TSF Data
FMT_MTD.1.1/CoreData The TSF shall restrict the ability to manage the TSF data to
Security Administrators.
6.1.4.3 FMT_MTD.1/CryptoKeys Management of TSF Data
FMT_MTD.1.1/CryptoKeys The TSF shall restrict the ability to manage the cryptographic
keys to Security Administrators.
Dell Networking Platforms
Security Target
35 of 55
6.1.4.4 FMT_SMF.1 Specification of Management Functions
FMT_SMF.1.1 The TSF shall be capable of performing the following management functions:
 Ability to administer the TOE locally and remotely;
 Ability to configure the access banner;
 Ability to configure the session inactivity time before session termination or locking;
 Ability to update the TOE, and to verify the updates using [hash comparison] capability
prior to installing those updates;
 Ability to configure the authentication failure parameters for FIA_AFL.1;
 [
o Ability to manage the cryptographic keys;
o Ability to configure the cryptographic functionality;
o Ability to set the time which is used for time-stamps;
o Ability to configure NTP;
o Ability to manage the TOE's trust store and designate X509.v3 certificates as
trust anchors;
o Ability to import X.509v3 certificates to the TOE's trust store;
]
6.1.4.5 FMT_SMR.2 Restrictions on Security Roles
FMT_SMR.2.1 The TSF shall maintain the roles:
o Security Administrator.
FMT_SMR.2.2 The TSF shall be able to associate users with roles.
FMT_SMR.2.3 The TSF shall ensure that the conditions:
 The Security Administrator role shall be able to administer the TOE locally;
 The Security Administrator role shall be able to administer the TOE remotely;
are satisfied.
6.1.5 Protection of the TSF (FPT)
6.1.5.1 FPT_SKP_EXT.1 Protection of TSF Data (for reading of all symmetric keys)
FPT_SKP_EXT.1.1 The TSF shall prevent reading of all pre-shared keys, symmetric keys, and
private keys.
6.1.5.2 FPT_APW_EXT.1 Protection of Administrator Passwords
FPT_APW_EXT.1.1 The TSF shall store passwords in non-plaintext form.
FPT_APW_EXT.1.2 The TSF shall prevent the reading of plaintext passwords.
6.1.5.3 FPT_TST_EXT.1 TSF Testing
FPT_TST_EXT.1.1 The TSF shall run a suite of the following self-tests [during initial start-up
(on power on), at the conditions [as specified by FIPS PUB 140-2 Section
Dell Networking Platforms
Security Target
36 of 55
4.9.2]] to demonstrate the correct operation of the TSF: [
Power-up self-tests:
Integrity check of the cryptographic module
Known Answer Tests (KAT) of cryptographic primitives
Conditional self-tests:
Key generation pairwise consistency tests
Continuous random number generator testing
].
6.1.5.4 FPT_TUD_EXT.1 Trusted Update
FPT_TUD_EXT.1.1 The TSF shall provide Security Administrators the ability to query the currently
executing version of the TOE firmware/software and [the most recently
installed version of the TOE firmware/software].
FPT_TUD_EXT.1.2 The TSF shall provide Security Administrators the ability to manually initiate
updates to TOE firmware/software and [no other update mechanism].
FPT_TUD_EXT.1.3 The TSF shall provide means to authenticate firmware/software updates to the
TOE using a [published hash] prior to installing those updates.
6.1.5.5 FPT_STM_EXT.1 Reliable Time Stamps
FPT_STM_EXT.1.1 The TSF shall be able to provide reliable time stamps for its own use.
FPT_STM_EXT.1.2 The TSF shall [allow the Security Administrator to set the time,
synchronize time with an NTP server].
6.1.6 TOE Access (FTA)
6.1.6.1 FTA_SSL_EXT.1 TSF-initiated Session Locking
FTA_SSL_EXT.1.1 The TSF shall, for local interactive sessions,
 [terminate the session]
after a Security Administrator-specified time period of inactivity.
6.1.6.2 FTA_SSL.3 TSF-initiated Termination
FTA_SSL.3.1 The TSF shall terminate a remote interactive session after a Security
Administrator-configurable time interval of session inactivity.
6.1.6.3 FTA_SSL.4 User-initiated Termination
FTA_SSL.4.1 The TSF shall allow Administrator-initiated termination of the Administrator’s
own interactive session.
Dell Networking Platforms
Security Target
37 of 55
6.1.6.4 FTA_TAB.1 Default TOE Access Banners
FTA_TAB.1.1 Before establishing an administrative user session the TSF shall display a
Security Administrator-specified advisory notice and consent warning
message regarding use of the TOE.
6.1.7 Trusted Path/Channels (FTP)
6.1.7.1 FTP_ITC.1 Inter-TSF Trusted Channel
FTP_ITC.1.1 The TSF shall be capable of using [TLS] to provide a trusted communication
channel between itself and authorized IT entities supporting the following
capabilities: audit server, [no other capabilities] that is logically distinct from
other communication channels and provides assured identification of its end
points and protection of the channel data from disclosure and detection of
modification of the channel data.
FTP_ITC.1.2 The TSF shall permit the TSF, or the authorized IT entities to initiate
communication via the trusted channel.
FTP_ITC.1.3 The TSF shall initiate communication via the trusted channel for [transmitting
audit records to an audit server].
6.1.7.2 FTP_TRP.1/Admin Trusted Path
FTP_TRP.1.1/Admin The TSF shall be capable of using [SSH] to provide a communication path
between itself and authorized remote administrators that is logically distinct
from other communication paths and provides assured identification of its end
points and protection of the communicated data from disclosure and provides
detection of modification of the channel data.
FTP_TRP.1.2/Admin The TSF shall permit remote administrators to initiate communication via the
trusted path.
FTP_TRP.1.3/Admin The TSF shall require the use of the trusted path for initial administrator
authentication and all remote administration actions.
Security Assurance Requirements
6.2.1 Security Assurance Requirements for the TOE
This section defines the assurance requirements for the TOE. The assurance activities to be
performed by the evaluator are defined in Sections 6 of the collaborative Protection Profile for
Network Devices v2.1 [NDcPP] and are derived from Common Criteria Version 3.1, Revision 5. The
assurance requirements are summarized in the table below.
Table 12: Assurance Components
Assurance Class Assurance Components
Security Target (ASE)
ASE_CCL.1 Conformance claims
ASE_ECD.1 Extended components definition
ASE_INT.1 ST introduction
Dell Networking Platforms
Security Target
38 of 55
Assurance Class Assurance Components
ASE_OBJ.1 Security objectives for the operational environment
ASE_REQ.1 Stated security requirements
ASE_SPD.1 Security Problem Definition
ASE_TSS.1 TOE Summary Specification
Development ADV_FSP.1 Basic Functional Specification
Guidance documents
AGD_OPE.1 Operational User guidance
AGD_PRE.1 Preparative User guidance
Life cycle support
ALC_CMC.1 Labeling of the TOE
ALC_CMS.1 TOE CM coverage
Tests ATE_IND.1 Independent testing - conformance
Vulnerability assessment AVA_VAN.1 Vulnerability Survey
6.2.2 Security Assurance Requirements Rationale
This ST conforms to the [NDcPP], which draws from the CC Security Assurance Requirements
(SARs) to frame the extent to which the evaluator assesses the documentation applicable for the
evaluation and performs independent testing.
Rationale
This ST claims Exact Compliance to the collaborative Protection Profile for Network Devices v2.1
[NDcPP]. Therefore:
 All secure usage assumptions, organizational security policies, and threats are
completely covered by security objectives.
 Each objective counters or addresses at least one assumption, organizational security
policy, or threat.
 The set of components (requirements) in the ST are internally consistent and complete.
6.3.1 TOE SFR Dependencies
The following table provides SFR dependency mapping. All SFRs were drawn from the [NDcPP]. For
extended components that were derived from SFRs from CC Part 2 dependencies were based on
unmodified SFRs, for all other extended components dependencies were determined based on
Appendix C Extended Component Definitions.
Table 13: SFR Dependencies
SFR Dependency Satisfied by
FAU_GEN.1 FPT_STM.1 FPT_STM_EXT.1
FAU_GEN.2 FAU_GEN.1
FAU_UID.1
FAU_GEN.1
FIA_UIA_EXT.1
FAU_STG_EXT.1 FAU_GEN.1
FTP_ITC.1
FAU_GEN.1
FTP_ITC.1
FCS_CKM.1 FCS_CKM.2
FCS_CKM.4
FCS_CKM.2
FCS_CKM.4
FCS_CKM.2 FCS_CKM.1
FCS_CKM.4
FCS_CKM.1
FCS_CKM.4
Dell Networking Platforms
Security Target
39 of 55
FCS_CKM.4 FCS_CKM.1 FCS_CKM.1
FCS_COP.1/DataEncryption FCS_CKM.1
FCS_CKM.4
FCS_CKM.1
FCS_CKM.4
FCS_COP.1/SigGen FCS_CKM.1
FCS_CKM.4
FCS_CKM.1
FCS_CKM.4
FCS_COP.1/Hash FCS_CKM.1
FCS_CKM.4
FCS_CKM.1
FCS_CKM.4
FCS_COP.1/KeyedHash FCS_CKM.1
FCS_CKM.4
FCS_CKM.1
FCS_CKM.4
FCS_RBG_EXT.1 None.
FIA_AFL.1 FIA_UAU.1 FIA_UIA_EXT.1
FCS_SSHS_EXT.1 FCS_CKM.1
FCS_CKM.2
FCS_COP.1/DataEncryption
on
FCS_COP.1/SigGen
FCS_COP.1/Hash
FCS_COP.1/KeyedHash
FCS_RBG_EXT.1
FCS_CKM.1
FCS_CKM.2
FCS_COP.1/DataEncryption
on
FCS_COP.1/SigGen
FCS_COP.1/Hash
FCS_COP.1/KeyedHash
FCS_RBG_EXT.1
FCS_TLSC_EXT.2 FCS_CKM.1
FCS_CKM.2
FCS_COP.1/DataEncryption
on
FCS_COP.1/SigGen
FCS_COP.1/Hash
FCS_COP.1/KeyedHash
FCS_RBG_EXT.1
FCS_CKM.1
FCS_CKM.2
FCS_COP.1/DataEncryption
on
FCS_COP.1/SigGen
FCS_COP.1/Hash
FCS_COP.1/KeyedHash
FCS_RBG_EXT.1
FCS_NTP_EXT.1 FCS_COP.1
FCS_IPSEC_EXT.1
FCS_DTLSC_EXT.1
FCS_COP.1/DataEncryption
FCS_COP.1/Hash
FIA_PMG_EXT.1 None.
FIA_UIA_EXT.1 FTA_TAB.1 FTA_TAB.1
FIA_UAU_EXT.2 None.
FIA_UAU.7 FIA_UAU.1 FIA_UIA_EXT.1
FIA_X509_EXT.1/Rev FIA_X509_EXT.2 FIA_X509_EXT.2
FIA_X509_EXT.2 FIA_X509_EXT.1 FIA_X509_EXT.1
FIA_X509_EXT.3 FCS_CKM.1
FIA_X509_EXT.1
FCS_CKM.1
FIA_X509_EXT.1
FMT_MOF.1/ManualUpdate FMT_SMR.1
FMT_SMF.1
FMT_SMR.2
FMT_SMF.1
FMT_MTD.1/CoreData FMT_SMR.1
FMT_SMF.1
FMT_SMR.2
FMT_SMF.1
FMT_SMF.1 None.
FMT_SMR.2 FIA_UID.1 FIA_UIA_EXT.1
Dell Networking Platforms
Security Target
40 of 55
FPT_SKP_EXT.1 None.
FPT_APW_EXT.1 None.
FPT_TST_EXT.1 None.
FPT_TUD_EXT.1 FCS_COP.1/SigGen
FCS_COP.1/Hash
FCS_COP.1/SigGen
FCS_COP.1/Hash
FPT_STM_EXT.1 None.
FTA_SSL_EXT.1 FIA_UAU.1 FIA_UIA_EXT.1
FTA_SSL.3 None.
FTA_SSL.4 None.
FTA_TAB.1 None.
FTP_ITC.1 None.
FTP_TRP.1/Admin None.
7 TOE Summary Specification
This chapter describes the security functions:
Table 14: TOE Security Functions
Security Objectives SFR
7.1 Security Audit FAU_GEN.1
FAU_GEN.2
FAU_STG_EXT.1
7.2 Cryptography FCS_CKM.1
FCS_CKM.2
FCS_CKM.4
FCS_COP.1
FCS_RBG_EXT.1
FCS_SSHS_EXT.1
FCS_TLSC_EXT.2
FCS_NTP_EXT.1
7.3 Identification and Authentication FIA_AFL.1
FIA_PMG_EXT.1
FIA_UIA_EXT.1
FIA_UAU_EXT.2
FIA_UAU.7
FIA_X509_EXT.1/Rev
FIA_X509_EXT.2
FIA_X509_EXT.3
Dell Networking Platforms
Security Target
41 of 55
Security Objectives SFR
7.4 Security Management FMT_MOF.1/ManualUpdate
FMT_MTD.1/CoreData
FMT_SMF.1
FMT_SMR.2
7.5 Protection of the security functionality FPT_SKP_EXT.1
FPT_APW_EXT.1
FPT_TST_EXT.1
FPT_TUD_EXT.1
FPT_STM_EXT.1
7.6 TOE access FTA_SSL_EXT.1
FTA_SSL.3
FTA_SSL.4
FTA_TAB.1
7.7 Trusted path/channels FTP_ITC.1
FTP_TRP.1/Admin
Security Audit
FAU_GEN.1, FAU_GEN.2, FAU_STG_EXT.1
The TOE generates syslog-conformant audit record whenever a security-relevant event occurs. The
audit records reflect a wide range of circumstances, including warnings about the state of device and
a variety of security relevant events. The TOE supports eight levels of events: emergencies, alerts,
critical, errors, warnings, notifications, informational, and debugging. Emergencies are level 0 and
debugging is level 7. The Security Administrator must set/ensure the level of the audit logging is set
to 7 to be compliant with the CC evaluated configuration.
For each audited event, the date and time, the type of event, the subject identity (e.g. IP address or
UserID), and the outcome are logged. The audit records may also contain event-specific content.
The security-relevant events that are logged include starting and stopping of the audit functions,
TOE configuration changes, as well as all the events specified by the ‘Audit Data Generation’
functional requirement.
The TOE generates audit records for the following administrative tasks related to cryptographic keys:
 Generation and destruction of a public and associated private key used to authenticate TOE’s
SSH server. These are unique and identified in the audit records by purpose (i.e. “RSA key
generated for SSH”).
 Installation and removal of a trusted root or intermediate authority certificate which are
identified in the audit records by CN.
 Generation of CSR and import of a signed certificate used to authenticate TOE’s TLS client.
These are unique and identified in the audit records by purpose. (i.e. “FIPS-mode host
certificate”).
Dell Networking Platforms
Security Target
42 of 55
 Association of a public RSA key with an administrative identity. These keys are used to verify
identity of SSH clients connecting to the TOE. These keys are identified in the audit records
by a SHA-1 hash of the keys.
The audit trail consists of individual audit records, with a unique audit record generated for each
event that occurred. Up to 512 audit records can be stored locally on the appliance, or all logs can
be sent to an external audit server. On-device audit records exist in a circular buffer; when the buffer
gets full, the oldest message is overwritten first. The viewing and clearing of the local audit trail is
restricted to authorized administrators with access to show logging and clear logging
auditlog commands. Clearing local audit trail wipes all audit records. In this way, the audit records
are protected against unauthorized access and deletion.
The TOE is designed to securely forward audit records to a designated audit server over a persistent
trusted channel. This trusted channel is implemented with a mutually authenticated TLS tunnel.
When configured, the TOE uploads audit records in syslog (RFC 5424) format as they are generated
without any delay. If the connection to the external audit server is lost, the TOE continues to save
local audit logs so there is no loss of audit. However, when the connection to the audit server is
restored the TOE only forwards the newly generated audit records. There is no automated log
reconciliation process (syncing) between the locally stored records with the external audit server
upon the re-establishment of the connection. However, the TOE supports multiple simultaneous
audit servers enabling high-availability setup.
The TOE implements a hardware clock. This system clock is used to generate time stamps that are
part of the audit records, the audit trail can be shown with the actual date and time of the system.
Cryptography
FCS_CKM.1, FCS_CKM.2, FCS_CKM.4, FCS_COP.1 (1-4), FCS_RBG_EXT.1, FCS_SSHS_EXT.1,
FCS_TLSC_EXT.2, FCS_NTP_EXT.1
The TOE’s Dell EMC Networking OS v9.14 exclusively relies on the Dell OpenSSL Cryptographic
Library Version 2.4 operating in FIPS mode to implement all cryptographic security functionality. Dell
OpenSSL Cryptographic Library Version 2.4 validated according to FIPS 140-2 as a level 1 software
cryptographic module, CMVP certificate #2496 covering RSA, AES, SHA, HMAC and DRBG
functionality. This module does not include key establishment functionality. The following
Cryptographic Algorithm Validation Program (CAVP) certificates also applicable to the TOE:
Table 15: Dell Networking Platforms Cryptography
Requireme
nt Class
Requirement
Component
Dell Networking Platforms Implementation Certificate #
FCS:
Cryptographi
c Support
FCS_CKM.1
Cryptographic Key
Generation
Generating 2048-bit and 3072-bit RSA keypairs
validated conforming to FIPS186-4.
RSA # C213
Dell Networking Platforms
Security Target
43 of 55
FCS_CKM.2
Cryptographic Key
Establishment
RSA-based key establishment schemes that meet
the following: RSAES-PKCS1-v1_5 as specified in
Section 7.2 of RFC 3447, “Public-Key Cryptography
Standards (PKCS) #1: RSA Cryptography
Specifications Version 2.1”.
Hashing using SHA-1, SHA-256, SHA-512 validated
conforming to FIPS 180-3, Secure Hash Standard
(SHS).
CTR_DRBG (AES-256) random bit generation
validated conforming to NIST SP PUB 800-90.
2048-bit and 3072-bit RSA keypairs validated
conforming to FIPS186-4.
SHS # C213
DRBG #
C213
RSA # C213
Finite field-based key establishment schemes using
Diffie-Hellman group 14 that meet the following: RFC
3526, Section 3.
CVL # 1047
FCS_CKM.4
Cryptographic Key
Destruction
Destruction of all keys is performed by single direct
overwrite followed by a read-verify action.
n/a
FCS_COP.1/DataEnc
ryption Cryptographic
Operation (AES Data
Encryption/Decryptio
n)
AES encryption and decryption used in CBC mode
with 128-bit, 192-bit, and 256-bit key sizes validated
conforming to FIPS PUB 197.
AES # C213
FCS_COP.1/SigGen
Cryptographic
Operation (Signature
Generation and
Verification)
RSA signature generation and verification according
to RSASSA-PKCS1v1_5 with 2048-bit and 3072-bit
key sizes utilizing SHA-1 (protocol only), SHA-256,
SHA-512.
RSA signature generation and verification according
to RSASSA-PSS with 2048-bit and 3072-bit key
sizes SHA-1 (protocol only), SHA-256, SHA-512 and
salt.
RSA # C213
FCS_COP.1/Hash
Cryptographic
Operation (Hash
Algorithm)
Hashing using SHA-1, SHA-256, SHA-512 validated
conforming to FIPS 180-3, Secure Hash Standard
(SHS).
SHS # C213
FCS_COP.1/KeyedH
ash Cryptographic
Operation (Keyed
Hash Algorithm)
Keyed hash HMAC-SHA1, HMAC-SHA256, validated
conforming to FIPS 198, Keyed-Hash Message
Authentication Code (HMAC).
Supported cryptographic key sizes: 160, 256 bits and
message digest sizes: 160, 256 bits.
Keyed hash use matches validated hash algorithms
implemented by the module.
HMAC #
C213
Dell Networking Platforms
Security Target
44 of 55
FCS_RBG_EXT.1
Cryptographic
Operation (Random
Bit Generation)
CTR_DRBG (AES-256) random bit generation
validated conforming to NIST SP PUB 800-90.
DRBG #
C213
FCS_SSHS_EXT.1
SSH Server Protocol
TOE implements SSHv2 protocol and supports
password-based authentication with following
ciphers:
 AES-CBC-128, AES-CBC-256 for data
encryption
 SSH_RSA, RSA-SHA2-256, RSA-SHA2-512
for public-key authentication
 HMAC-SHA1, HMAC-SHA1-96, HMAC-
SHA2-256 for data integrity
 diffie-hellman-group14-sha1 for key
exchange
SSH KDF conformant to SP 800-135
CVL# 1047
FCS_TLSC_EXT.2
TLS Client Protocol
TOE implements TLS 1.2 and supports certificate-
based authentication with the following ciphers:
 TLS_RSA_WITH_AES_128_CBC_SHA
 TLS_RSA_WITH_AES_256_CBC_SHA
 TLS_RSA_WITH_AES_128_CBC_SHA2
56
 TLS_RSA_WITH_AES_256_CBC_
SHA256
 TLS_DHE_RSA_WITH_AES_128_CBC
_SHA
 TLS_DHE_RSA_WITH_AES_256_CBC
_SHA
 TLS_DHE_RSA_WITH_AES_128_CBC
_SHA256
 TLS_DHE_RSA_WITH_AES_256_CBC
_SHA256
TLS KDF conformant to SP 800-135
CVL# 1047
Table 16: Scheme Usage
Scheme Protocol Service
RSA SSH Server Admin Authentication
Diffie-Hellman SSH Server SSH Key Establishment
Dell Networking Platforms
Security Target
45 of 55
RSA TLS Client TOE Authentication, Syslog authentication
RSA TLS Client TLS Key Establishment
TOE cryptographic library is capable of supporting other encryption algorithms, key-hash methods,
and key exchange algorithms but they are disabled in the evaluated configuration.
The TOE uses a software-based random bit generator (DRBG) that complies with NIST SP 800-90
for all cryptographic operations. Each DRBG instance is seeded with full entropy sourced from a
Linux Kernel Random Number Generator (LKRNG) operating in a blocking mode (/dev/random) with
a minimum of 256-bits of entropy. All entropy is extracted, processed, and accumulated by LKRNG
from multiple software-based noise sources. The following noise sources are used: timing of inter-
process communications events, CPU jitter. Accumulated entropy is not preserved across system
reboots.
The TOE follows recommendations outlined in the RSAES-PKCS1-v1_5 as specified in Section 7.2
of RFC 8017, “Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications
Version 2.1 requirements as part of RSA-based key establishment. However, to support RFC-
compliant secure channel protocols the TOE implements NIST SP 800-135 TLS and SSH key
derivation functions (KDF). TOE acts as a sender of secret keying material for RSA key
establishment. The TOE uses standard 2048-bit MODP group that is described in RFC 3526 Section
3. Diffie-Hellman group 14 is used as part of SSH and TLS implementations.
To mitigate the possibility of disclosure, the TOE is designed to destroy Critical Security Parameters
(CSPs) when it is no longer required. Both volatile and non-volatile CSPs are present in the TOE. At
various times during TOE operation (e.g. an active SSH session) volatile CSPs are present in RAM
in plaintext which when no longer needed (e.g. on SSH session termination) are de-allocated and
cleared from memory. Few CSPs are also stored in NVRAM as non-plaintext. These are protected
and cleared by an on-demand command. The CSPs in the NVRAM are protected by strict access
control through internal APIs which are never exposed. It is only touched when executing specific
commands (by system administrator) and not accessible directly in any other way. The on-demand
commands clear specific CSPs (e.g. private RSA keys) and can only be invoked by a Security
Administrator with a sufficient privilege level. For volatile memory and non-volatile flash memories,
the zeroization is executed by a Single direct overwrite consisting of zeros followed by a read-verify
action.
The following table identifies applicable CSPs and summarizes zeroization procedure:
Table 17: Dell Networking Platforms CSPs
Identifier Name Generation /
Algorithm
Purpose Storage
Location
Zeroization Summary
CSP1 Private Key PKCS1v1_5 /
RSA
RSA private key
used for public-
key based
authentication
NVRAM,
RAM
Single direct overwrite
consisting of zeros
followed by a read-verify
action.
Dell Networking Platforms
Security Target
46 of 55
Identifier Name Generation /
Algorithm
Purpose Storage
Location
Zeroization Summary
CSP2 Private Key PKCS1v1_5 /
RSA
X509 private
key used for
certificate-based
authentication
NVRAM,
RAM
Single direct overwrite
consisting of zeros
followed by a read-verify
action.
CSP3 SSH Session
Keys
Generated
using SSH
KDF
SSH keys –
server to client,
client to server
RAM Single direct overwrite
consisting of zeros
followed by a read-verify
action.
CSP4 Diffie-Hellman
Key Pair
DH Key agreement
for SSH
sessions
RAM Cleared when device is
powered down or as
part of session
termination.
Overwritten by new
value or loss of
capacitor charge in the
memory cell.
CSP5 TLS Pre-
master Secret
RSA or DH,
generated
using DRBG
Key agreement
for TLS
RAM Cleared when device is
powered down or as
part of session
termination.
Overwritten by new
value or loss of
capacitor charge in the
memory cell.
CSP6 TLS Session
Keys
Generated
using TLS KDF
Symmetric keys
for TLS
RAM Cleared when device is
powered down or as
part of session
termination.
Overwritten by new
value or loss of
capacitor charge in the
memory cell.
CSP7 Administrative
Passwords
SHA256 Credentials
used to
authenticate the
administrator
login.
FLASH Hashed passwords exist
locally in a startup
configuration file and
replaced when that file
is edited and saved.
The passwords are
stored in the hashed
form only.
Overwritten with new
data.
Dell Networking Platforms
Security Target
47 of 55
Identifier Name Generation /
Algorithm
Purpose Storage
Location
Zeroization Summary
RAM Passwords in RAM are
zeroized when creating /
resetting the password.
Both clear text and
encrypted forms are
stored in RAM.
Overwritten by new
value or loss of
capacitor charge in the
memory cell.
CSP8 PRNG Seed
key
/dev/random Seed key for
PRNG
RAM Cleared when device is
powered down or during
reboot by the new seed.
Overwritten by new
value or loss of
capacitor charge in the
memory cell.
The TOE implements the SSHv2 secure communication protocol that complies with RFCs 4251,
4252, 4253, 4254, 6668. The SSHv2 implemented with AES128-CBC or AES256-CBC encryption
algorithms in combination with HMAC-SHA1, HMAC-SHA1-96 or HMAC-SHA2-256 data integrity
algorithms, and diffie-hellman-group14-sha1 for key exchange method and ssh-rsa, rsa-sha2-256,
rsa-sha2-512 for public-key authentication. The TOE utilizes SSHv2 for secure remote administration
over CLI interface with password-based authentication and optionally with a RSA public key. SSH
packets that exceed 256K in length size are dropped at the application layer per RFC 4253. The
SSH connection is automatically rekeyed by default after 60 minutes or 1 GB of data with both of
these thresholds being administrator-configurable.
The TOE exclusively supports TLS v1.2 secure communication protocol that complies with RFC
5246. The TOE supports mutual X509v3 certificate-based authentication and the following ciphers:
 TLS_RSA_WITH_AES_128_CBC_SHA
 TLS_RSA_WITH_AES_256_CBC_SHA
 TLS_RSA_WITH_AES_128_CBC_SHA256
 TLS_RSA_WITH_AES_256_CBC_ SHA256
 TLS_DHE_RSA_WITH_AES_128_CBC_SHA
 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
The TOE implements reference identifier matching according to RFC 6125 and also supports IP
addresses as reference identifiers. The reference identifier specified during configuration of TLS
connection with an external audit server. Supported reference identifiers are canonical formatted
IPv4 addresses in SAN or DNS names in SAN or Common Name (CN). As part of negotiating TLS
connection, the TOE will verify that peer certificate Subject Alternative Name (SAN) or CN contains
expected identifier. CN is checked only if SAN is absent to offer support for legacy applications. The
Dell Networking Platforms
Security Target
48 of 55
TOE is also capable of parsing DNS identifiers that include wildcards, but their use is discouraged.
The TOE only establishes connection if the peer certificate is valid, trusted, and has a matching
reference identifier. The TOE does not implement certificate pinning and does not support Elliptic
Curve keys or signatures in the certificates.
The TOE implements NTPv4 to synchronize time with NTP timeserver. NTP authentication and the
corresponding trusted key provide for reliable means of exchanging NTP packets with trusted time
sources. NTP authentication begins when the first NTP packet is created following the configuration
of keys, which utilizes SHA 1 as the message digest algorithm.
Identification and Authentication
FIA_PMG_EXT.1, FIA_AFL.1, FIA_UIA_EXT.1, FIA_UAU_EXT.2, FIA_UAU.7,
FIA_X509_EXT.1/Rev, FIA_X509_EXT.2, FIA_X509_EXT.3
The TOE functionality can be logically divided into following categories: Data Plane and Control
Plane. The Control Plane is associated with the management port and facilitates TOE’s
administrative functionality; the Data Plane is primarily associated with various data ports and
facilitates TOE switching functionality. The TOE allows unauthenticated network traffic and routing
services to utilize Data Plane functionality as part of its core functionality. This unauthenticated traffic
does not include any management or configuration traffic and does not directly interface with the
Control Plane.
The TOE requires any user to be identified and authenticated before any management action. The
warning banner is displayed before login prompt on any of the management access points (local
console or remote CLI sessions). In the evaluated configuration, the TOE does not allow
unauthenticated configuration of the TOE’s network routing/switching services and does not allow
any unauthenticated management action.
The TOE permits an administrator to configure the number of unsuccessful authentication attempts
within a range of 1 to 16 as well as time allowed before a retry is permitted from 1 to 1440 minutes
during which, the authenticating user is locked out. The TOE ensures that authentication failures by
remote administrators cannot lead to a situation where no administrator access is available, by
distinguishing between local and remote login attempts.
A requesting user will be prompted to enter a user name and password upon establishing successful
connection. The TOE will then compare entered credentials against the known user database. If the
combinations match, the TOE will then attribute (bind) the administratively assigned role
(predetermined group of privileges that dictate access to TOE functions) to that user for the duration
of the management session.
For a local administrative session, password character entries are not echoed to the screen. For a
remote administrative session, credentials are protected by a secure channel.
Administrative (management) roles are created with specific job functions in mind. Through these
roles, users acquire the permissions to perform their associated job function. If a user’s role matches
one of the allowed roles for a specific command, then command authorization is granted. Multiple
users can be assigned the same role, but each user can be assigned only a single role. Default
command permissions are based on CLI mode, any specific command settings, and the permissions
allowed by the role commands.
Dell Networking Platforms
Security Target
49 of 55
By default, TOE provides four system-defined administrator roles:
 Network Operator (netoperator) - This user role has no privilege to modify any configuration
on the switch, but can access Exec mode (monitoring) to view the current configuration and
status information.
 Network Administrator (netadmin): This user role can configure, display, and debug the
network operations on the switch. Netadmin can access all of the commands that are
available from the network operator role. This role does not have access to the commands
that are available to the system security administrator for cryptography operations, AAA, or
the commands reserved solely for the system administrator.
 Security Administrator (secadmin): This user role can control the security policy across the
systems that are within a domain or network topology. The security administrator commands
include FIPS mode enablement, password policies, inactivity timeouts, banner establishment,
and cryptographic key operations for secure access paths.
 System Administrator (sysadmin). This role has full access to all the commands in the
system, exclusive access to commands that manipulate the file system formatting, and
access to the system shell. This role can also create user IDs and define other user roles.
For remote administration, implemented as a CLI over SSH, the TOE can be configured to
authenticate using public key mechanism (RSA), or password-based, or both. For local
administration, only password-based authentication is supported. When RSA authentication is used,
the TOE checks presented public key against authorized keys database and verifies possession of a
private key by negotiating secure channel using this public key. When both password and certificate
are presented, the TOE use public key during handshake negotiation followed by a password
verification
Upon successful authentication, the TOE assigns administratively defined role to that user for the
duration of the session. The TOE facilitates all administrative actions through the CLI. Successful
login is indicated by TOE offering a CLI command prompt.
The TOE supports having a minimum of 15 character password length and supports the utilization of
upper and lower case, numeric, and special character combinations for password construction.
The TOE supports the use of X.509v3 certificates as defined by RFC 5280 to authenticate
connections with authorized IT entities. When certificate based authentication is used, the TOE
validates presented server certificate, checks chain of trust against the internal trusted store, and
performs certificate revocation check. Certificate validation includes path validation (including
checking CA certificates) certificate processing (including validating extendedKeyUsage field) and
extension processing (including checking BasicConstraints extension). The extendedKeyUsage field
has Code Signing, Server Authentication, Client Authentication and OCSP Signing as acceptable
values with corresponding object identifiers (OID’s) as defined in RFC 5280. Verifying chain of trust
includes validating each certificate in the chain, verifying that certificate path consist of trusted CA
certificates, and performing revocation checks on all certificates in the path. Revocation checking is
implemented using OCSP and with the exception of the host certificate it’s performed on
intermediate CA and leaf certificates. Regardless if a full chain or only identity certificates are
presented, revocation is performed on the full chain, as long as the TOE has all necessary CA’s to
determine the trust. Otherwise, the certificate is rejected as untrusted at an earlier stage of certificate
Dell Networking Platforms
Security Target
50 of 55
validation process. If any part of authentication fails, connection is terminated at the handshake
stage. Specifically, the TOE implements mutually authenticated secure channel using TLSv1.2 to a
trusted audit server.
The TOE supports the following methods to load a Certificate Signing Request (CSR) from a trusted
CA:
 Manually import certificates in PEM format from an external server over SFTP
 Manually import certificates using a removable media
The TOE performs revocation checking on signed CSR by an external CA and all intermediate CAs
at the time of loading to the trusted store.
The CA certificate is checked for the following requirements prior to adding it to an existing list of
trusted certificates:
 Digital signature check
 Basic constrains extension with the CA flag set to true
 Key usage extension with the “keyCertSign” bit is set
 Certificate is not expired
All certificates are stored in a private, persistent location on the TOE. There is no direct access to
stored certificates using regular interfaces.
The TOE is capable of generating Certificate Signing Requests (CSR) and authenticating with both
CA-signed and self-signed certificates. The CSR is created using the cryptographic library operating
in FIPS mode and uses RSA 2048-bit or greater modulus and SHA-256 digest algorithm.
When an X509 server certificate is presented during the TLS handshake, the TOE identifies the
presented server certificate using the reference identifier (identifiers defined in RFC 6125, IPv4
address in SAN) and validates the certificate by the entire trust chain using the CA certificate(s) in
the TOE’s trusted store along with the revocation checks. The revocation check is performed by
sending an OCSP request to a trusted OCSP responder and verifying signed response received
from the responder. If connection to OCSP server cannot be established, the administrator can
configure default behavior and determine whether to accept the certificate in such cases.
The TOE supports mutual authentication for TLS handshake, in which the TOE client certificate is
sent to the external authorized IT entities based on the DN requests sent by the server. If the server
doesn’t send the supported DN(s), the default TOE client certificate that was installed on the device
by the Security Administrator is sent for the client authentication. The TOE is configured with only
one client certificate for the mutual authentication at any given time.
The TOE uses the Authority Information Access extension of the certificate(s) to derive the OCSP
responder URI to use for the revocation checking.
Security Management
FMT_MTD.1, FMT_SMF.1, FMT_SMR.1, FMT_MOF.1
The TOE allows remote administration via SSHv2 session over an out of band LAN management
RJ-45 port and local administration via a directly connected console cable. Both remote and local
Dell Networking Platforms
Security Target
51 of 55
administration utilizes command-line interface (CLI). The CLI provides access to all management
functions used to administer the TOE. The TOE requires each user to be successfully authenticated
before allowing any other action on behalf of that user. All other remote management interfaces (e.g.
Secure HTTP) are not evaluated and disabled in the evaluated configuration.
By default, CLI implements three main modes:
 EXEC mode: This mode allows the user to view settings and enter EXEC Privilege mode,
which is used to configure the device.
 EXEC Privilege mode: This mode allows the user to access all the commands accessible in
EXEC mode plus commands to view configurations, clear counters, manage configuration
files, run diagnostics, and enable or disable debug operations.
In addition, the user can enter the CONFIGURATION mode to configure interfaces, routes
and protocols on the switch.
 CONFIGURATION mode: This mode allows the user to configure security features, time
settings, set logging and SNMP functions, configure static ARP and MAC addresses, and set
line cards on the system. Configuration of specific features or interfaces are subsets of the
CONFIGURATION mode.
All TOE commands assigned permissions that can be customized and associated with specific user
roles. Permissions for user roles are non-hierarchical, and this allows finer granularity in managing
access to the system.
The TOE supports RBAC. Using RBAC, access and authorization is controlled based on a user’s
role. All of the management functions are restricted to the Security Administrators of the TOE.
Security Administrators with sufficient privilege can perform the following actions: manage
administrative accounts, manage the TOE’s trust store, start and shut down TOE, administer system
configuration, and review the audit records. The full list of security-relevant management functions is
specified in the 6.1.4.4 FMT_SMF.1 ‘Specification of Management Functions’.
The term “Security Administrator” is used to refer to any administrative user with the appropriate role
sufficient privilege to perform all relevant functions. The privilege level determines the functions the
user can perform such as EXEC Privilege Mode when managing the TOE trust store. It is understood
that not all administrators will have sufficient permissions assigned to them to perform each
administrative function discussed in this document. Specifically, the TOE restricts the ability to
perform manual update to System Administrator.
Protection of the security functionality
FPT_SKP_EXT.1, FPT_APW_EXT.1, FPT_TST_EXT.1, FPT_STM_EXT.1, FPT_TUD_EXT.1,
The TOE is a standalone appliance designed to function independently, as a result, both security
functionality and measures to protect security functionality are focused on self-protection.
The TOE employs both a dedicated communication channels (i.e. separate physical RJ-45 LAN
connection for management) as well as cryptographic means (i.e. encrypted secure channels) to
protect remote administration.
Dell Networking Platforms
Security Target
52 of 55
The TOE protects critical security parameters (CSP) such as stored passwords and cryptographic
keys so they are not directly accessible via normal administrative interfaces. Locally stored
password information is obscured by use of hashing (SHA256). Additionally, when login-related
configuration information is accessed through regular TOE interfaces it is obfuscated by substituting
hashed passwords with a series of asterisks.
The TOE is a hardware appliance that implements hardware-based real-time clock managed by
embedded OS, which also controls the exposure of administrative functions. This clock is used to
produce reliable timestamps that are available for audit trail generation, synchronization with the
operational environment, session inactivity checks, and certificate expiration validation.
The TOE performs diagnostic self-tests during start-up and generates audit records to document
failure. Some low-level critical failure modes can prevent TOE start-up and as a result will not
generate audit records. In such cases, TOE appliance will enter failure mode displaying error codes,
typically displayed on the console. The TOE can be configured to reboot or to stop with errors
displayed when non-critical errors are encountered. The cryptographic module performs self-tests
during startup; the messages are displayed on the console and audit records generated for both
successful and failed tests. Self-tests comply with the FIPS 140-2 requirements for self-testing. The
module performs known-answer algorithm testing, integrity testing, and conditional self-testing.
Failure of any of the FIPS mode tests during boot process will stop start-up process and prompt the
user to reload. For all start-up tests, successful completion is indicated by reaching operational
status. The diagnostic self-tests monitor the TOE against a set of anticipated faults, therefore outside
of failure mode induced by failing self-tests, the TSF is assumed to operate correctly.
Upgrading the TOE is a multi-step process performed by a Security Administrator. An authorized
user must authenticate to the secure Dell Support website where the software downloads are
available. The downloaded image must be transferred to the appliance using a secure method such
as Secure Copy or SFTP. The image file, now located on the appliance, is then verified using the
“verify” CLI command that produces a SHA-256 hash value. The administrator must then visually
compare the results to the published hash value on the Dell website with the produced value. Upon
successful comparison, the administrator can then initiate the upgrade. The TOE also implements
“show version” CLI command that displays information about firmware version running on the
TOE.
TOE access
FTA_SSL_EXT.1, FTA_SSL.3, FTA-SSL.4, FTA_TAB.1
The TOE implements remote and local administrative access via command line interface (CLI).
Security Administrator can configure a time period to be used to automatically terminate
administrative session after inactivity. For local and remote administrative session, the TSF
terminates the session after this period of inactivity. To facilitate this, an internal timer is started for
the session after successful authentication of Security Administrator. If the Security Administrator
does not provide input for a duration of configured inactivity period, the TSF terminates the
administrative session. Once a session (local or remote) has been terminated, the TOE requires the
user to re-authenticate.
The TSF provides the means for the Security Administrator to manually terminate their own
interactive sessions with the TOE for both the local and remote administrative sessions. For this, the
Security Administrator can issue the “exit” command to terminate their own session.
Dell Networking Platforms
Security Target
53 of 55
Before establishing an administrative user session to the TSF, the TSF displays a Security
Administrator-specified advisory notice and consent warning message (banner). The banner is
presented prior to human user authentication on each of the TOE’s administrative interfaces. The
banner can be configured via any one of the following administrative interfaces: Local console (serial
port), and remote console (SSH).
Trusted path/channels
FTP_ITC.1, FTP_TRP.1
The TOE protects remote management sessions by establishing a trusted path (using SSH) between
itself and the administrator connected to a dedicated RJ-45 LAN management port. When a client
attempts to connect using SSHv2, the TOE and the client will negotiate the most secure algorithms
available at both ends to protect the session. If the session cannot be negotiated, or the protocols
cannot be agreed on, the connection is dropped. After initial connection, protocol negotiation, and
key exchange, diffie-hellman‐group14‐sha1 key exchange algorithm produces a shared secret that is
used to derive the AES and the HMAC keys. After that point, all traffic between the TOE and the
external entity is encrypted using AES‐CBC-128 or AES-CBC-256 symmetric encryption algorithm.
Authentication is encapsulated in this encrypted channel. For public key-based authentication, RSA
host key pair generated by the TOE or generated elsewhere and imported into the TOE. Client RSA
public keys have to be generated elsewhere, imported into the TOE, and added to the authorized
keys database.
The TOE protects communications with the audit server by establishing a trusted channel between
itself and the audit server. To implement trusted channel, the TOE uses TLS v1.2 protocol with
certificate-based authentication. For certificate-based authentication, presented certificate (x.509v3)
is first validated and then compared to the authorized certificates database.
Dell Networking Platforms
Security Target
54 of 55
8 Acronyms and Terminology
8.1.1 Acronyms
The following table defines CC and Product specific acronyms used within this Security Target.
Table 18: Acronyms
Acronym Definition
CC Common Criteria
CSP Critical Security Parameter
FIPS Federal Information Processing Standard
IT Information Technology
NIST National Institute of Standards and Technology
OE Operational Environment
OS Operating System
OSP Organizational Security Policy
PP Protection Profile
RFC Request for Comment
SAR Security Assurance Requirement
SFR Security Functional Requirement
ST Security Target
TOE Target of Evaluation
TSF TOE Security Function
8.1.2 Product Acronyms and Terminology
The following table defines the CC and Product-specific terminology used within this Security Target.
Table 19: Terminology
Terminology Definition
AAA Authentication, Authorization, and Accounting (AAA). A security architecture for
distributing systems for controlling remote access to services.
RADIUS Remote Authentication Dial-In User Service (RADIUS) protocol that includes
authentication and authorization.
RSA Ron Rivest, Adi Shamir, Leonard Adleman. Public-key cryptosystem algorithm.
Routing Protocol A routing protocol is a means whereby network devices exchange information
about the state of the network and used to make decision about the best path for
packets to the destination.
TACACS+ Terminal Access Controller Access-Control System Plus, an access control
network protocol.
HTTP Hypertext Transfer Protocol
IP Internet Protocol
SSH Secure Shell
Dell Networking Platforms
Security Target
55 of 55
Terminology Definition
TLS Transport Layer Security