1
Acumen Security, LLC.
Apple iOS 11 Safari Security Target
2
Table of Contents
1. Security Target Introduction.................................................................................................................5
1.1. Security Target and TOE Reference ..............................................................................................5
1.2. TOE Overview................................................................................................................................5
1.3. TOE Description.............................................................................................................................5
1.4. TOE Architecture...........................................................................................................................6
1.4.1. Physical Boundaries ..............................................................................................................6
1.4.2. Security Functions provided by the TOE...............................................................................6
1.4.2.1. Cryptographic Support......................................................................................................6
1.4.2.2. User Data Protection.........................................................................................................6
1.4.2.3. Identification and Authentication.....................................................................................7
1.4.2.4. Security Management.......................................................................................................7
1.4.2.5. Privacy...............................................................................................................................7
1.4.2.6. Protection of the TSF ........................................................................................................7
1.4.2.7. Trusted Path/Channels......................................................................................................7
1.4.3. TOE Documentation..............................................................................................................7
1.4.4. Other References..................................................................................................................7
2. Conformance Claims.............................................................................................................................8
2.1. CC Conformance ...........................................................................................................................8
2.2. Protection Profile Conformance ...................................................................................................8
2.3. Conformance Rationale ................................................................................................................8
2.3.1. Technical Decisions...............................................................................................................8
3. Security Problem Definition................................................................................................................10
3.1. Threats ........................................................................................................................................10
3.2. Assumptions................................................................................................................................11
3.3. Organizational Security Policies..................................................................................................11
4. Security Objectives..............................................................................................................................12
4.1. Security Objectives for the TOE ..................................................................................................12
4.2. Security Objectives for the Operational Environment................................................................13
5. Security Requirements........................................................................................................................14
5.1. Conventions ................................................................................................................................14
5.2. Security Functional requirements...............................................................................................15
5.2.1. Cryptographic Support (FCS)...............................................................................................15
5.2.2. User Data Protection (FDP).................................................................................................16
3
5.2.3. Identification and Authentication (FIA) ..............................................................................17
5.2.4. Security Management (FMT) ..............................................................................................18
5.2.5. Privacy (FPR)........................................................................................................................19
5.2.6. Protection of TSF (FPT)........................................................................................................20
5.2.7. Trusted Path/Channel (FTP)................................................................................................21
5.3. TOE SFR Dependencies Rationale for SFRs .................................................................................21
5.4. Security Assurance Requirements ..............................................................................................21
5.5. Rationale for Security Assurance Requirements ........................................................................22
5.6. Assurance Measures...................................................................................................................22
6. TOE Summary Specification................................................................................................................24
4
Revision History
Version Date Description
1.0 November 2018 Initial Release
5
1. Security Target Introduction
1.1. Security Target and TOE Reference
This section provides information needed to identify and control this ST and its TOE.
Category Identifier
ST Title Apple iOS 11 Safari Security Target
ST Version 1.0
ST Date November 2018
ST Author Acumen Security, LLC.
TOE Identifier Apple iOS 11 Safari on iPhone and iPad
Note: The TOE is the Safari browser software only. The Apple iOS operating system
has been separately validated (VID 10851).
TOE Software Version 11
TOE Developer Apple Inc.
Key Words Application, Mobility, Browser
Table 1 TOE/ST Identification
1.2. TOE Overview
The TOE is the Apple iOS Safari application which runs on iPad and iPhone devices. The product provides
access to HTTPS/TLS connections via a browser for user connectivity.
Note: The TOE is the Safari software only. The Apple iOS operating system has been separately validated
(VID 10851).
1.3. TOE Description
The TOE is an application on a mobile operating system. The TOE is the Safari browser application only.
The Apple iOS operating system has been separately validated (VID 10851). The mobile operating system
and hardware platforms are part of the TOE environment. The evaluated version of the TOE is version 11.
As evaluated, the TOE software runs on the following devices,
Device Name Model Processor WiFi Bluetooth
iPhone X A1901
A1902
A1865
A11 802.11a/b/g/n/ac
802.11a/b/g/n/ac
802.11a/b/g/n/ac
5.0
iPhone 8 Plus/
iPhone 8
A1864, A1897, A1898, A1899/
A1863, A1905, A1906, A1907
A11 802.11a/b/g/n/ac
802.11a/b/g/n/ac
5.0
iPhone 7 Plus/ iPhone 7 A1661, A1784, A1785, A1786/
A1660, A1778, A1779, A1780
A10 802.11a/b/g/n/ac
802.11a/b/g/n/ac
4.2
4.2
iPhone 6S Plus/ iPhone
6S
A1634, A1687, A1690, A1699/
A1633, A1688, A1691, A1700
A9 802.11a/b/g/n/ac
802.11a/b/g/n/ac
4.2
4.2
iPhone SE A1662
A1723
A1724
A9 802.11a/b/g/n/ac
802.11a/b/g/n/ac
802.11a/b/g/n/ac
4.2
iPhone 6 Plus/ iPhone 6 A1522, A1524, A1593/
A1549, A1586, A1589
A8 802.11a/b/g/n/ac
802.11a/b/g/n/ac
802.11a/b/g/n/ac
4.0
4.0
4.0
iPhone 5s A1453
A1457
A7 802.11a/b/g/n
802.11a/b/g/n
4.0
4.0
6
Device Name Model Processor WiFi Bluetooth
A1518
A1528
A1530
A1533
802.11a/b/g/n
802.11a/b/g/n
802.11a/b/g/n
802.11a/b/g/n
4.0
4.0
4.0
4.0
iPad mini 3 A1599
A1600
A1601
A7 802.11a/b/g/n
802.11a/b/g/n
802.11a/b/g/n
4.0
4.0
4.0
iPad mini 4 A1538
A1550
A8 802.11a/b/g/n
802.11a/b/g/n
4.2
4.2
iPad Air 2 A1566
A1567
A8X 802.11a/b/g/n/ac
802.11a/b/g/n/ac
4.2
4.2
iPad (5th gen) A1822
A1823
A9X 802.11a/b/g/n/ac
802.11a/b/g/n/ac
4.2
4.2
iPad Pro 12.9”
(1st Gen)
A1584
A1652
A9X 802.11a/b/g/n/ac
802.11a/b/g/n/ac
4.2
4.2
iPad Pro 9.7” A1673
A1674
A9X 802.11a/b/g/n/ac
802.11a/b/g/n/ac
4.2
4.2
iPad Pro 12.9” (2nd
Gen)
A1670
A1671
A10X 802.11a/b/g/n/ac
802.11a/b/g/n/ac
4.2
4.2
iPad Pro 10.5” A1701
A1709
A10X 802.11a/b/g/n/ac
802.11a/b/g/n/ac
4.2
4.2
iPad 9.7” A1893
A1954
A10 802.11a/b/g/n/ac 4.2
Table 2 Devices Covered by the Evaluation
The Operating System on which the TOE is running is Apple iOS version 11. This is the same version of iOS
which has undergone Common Criteria evaluation against the Protection Profile for Mobile Device
Fundamentals Version 3.1.
1.4. TOE Architecture
1.4.1. Physical Boundaries
The TOE is a software application running on a mobile device (as listed above). The mobile device platform
provides a host Operating System, controls that limit application behavior, and wireless connectivity.
Note: The Apple iOS operating system has been separately validated.
1.4.2. Security Functions provided by the TOE
The TOE provides the security functionality required by [SWAPP] and [WEBBROWSEREP].
1.4.2.1. Cryptographic Support
The iOS platform provides TLS/HTTPS connectivity for users attempting to communicate with secure URLs.
The TOE does not directly perform any cryptographic functions. The TOE invokes the iOS platform
cryptography for secure credential storage.
1.4.2.2. User Data Protection
The TOE requests access to network connectivity, camera, microphone, location services, and address
book, and communicates with the wireless network when invoked by the user. The TOE runs inside of a
sandbox where each browser tab is isolated. In addition, the TOE supports blocking of third party cookies
and the ‘secure’ attribute.
7
1.4.2.3. Identification and Authentication
All validation of X.509 certificates is performed by the iOS platform that the TOE is running on.
1.4.2.4. Security Management
The iOS platform provides the ability to configure the TOE. No credentials are installed by default.
1.4.2.5. Privacy
If the user logs into iCloud Account on two or more devices, two devices within Bluetooth range of each
other have the ability to automatically “continue” browsing with the same URL provided via iCloud.
Examples of this include the use of “allow sending diagnostic and usage data to Apple” or “Allow modifying
diagnostic settings”. This does not send PII, but can be misunderstood as sending identifiable data.
1.4.2.6. Protection of the TSF
The TOE does not permit automatic downloads. All downloads are at the request of a user and require
approval. The TOE does not support add-ons. The only supported mobile code is signed JavaScript. No
third party libraries are leveraged by the TOE. The TOE platform verifies all software updates via digital
signature.
1.4.2.7. Trusted Path/Channels
The TOE is a software application. The TOE leverages the iOS platform to establish HTTPS/TLS protected
communications.
1.4.3. TOE Documentation
 Apple iOS 11 Safari Security Target, Version 1.0 [ST]
 Apple iOS 11 Safari on iPhone and iPad Common Criteria Configuration Guide, Version 1.2 [AGD]
1.4.4. Other References
 Protection Profile for Application Software, version 1.2, dated 22 April 2016 [SWAPP]
 Application Software Extended Package for Web Browsers, version 2.0, dated 16 June 2015
[WEBBROWSEREP]
8
2. Conformance Claims
2.1. CC Conformance
This TOE is conformant to:
 Common Criteria for Information Technology Security Evaluations Part 1, Version 3.1, Revision 4,
September 2012
 Common Criteria for Information Technology Security Evaluations Part 2, Version 3.1, Revision 4,
September 2012: Part 2 extended
 Common Criteria for Information Technology Security Evaluations Part 2, Version 3.1, Revision 4,
September 2012: Part 3 extended
2.2. Protection Profile Conformance
This TOE is conformant to:
 Protection Profile for Application Software, version 1.2, dated 22 April 2016 [SWAPP]
 Application Software Extended Package for Web Browsers, version 2.0, dated 16 June 2015
[WEBBROWSEREP]
2.3. Conformance Rationale
This Security Target provides exact conformance to Version 1.2 of the Protection Profile for Application
Software with version 2.0 of the Extended Package for Web Browsers. The security problem definition,
security objectives and security requirements in this Security Target are all taken from the Protection
Profile performing only operations defined there.
2.3.1. Technical Decisions
All NIAP Technical Decisions (TDs) issued to date that are applicable to [SWAPP] have been addressed.
The following table identifies all applicable TD:
Identifier Applicable? Exclusion Rationale (if applicable)
0358 - Cipher Suites for TLS in SWApp v1.2 Yes
0349 - Update to FPT_MCD_EXT.1.2 Yes
0327 – Default file permissions for
FMT_CFG_EXT.1.2
Yes
0326 – RSA-based key establishment schemes No This TD addresses FCS_CKM.1, FCS_CKM.2,
and FCS_TLSS_EXT.1.3. The TOE does not
include any of these SFRs.
0305 – Handling of TLS connections with and
without mutual authentication
No This TD address the Assurance Activities
associated with FCS_TLSC_EXT.2. The TOE
does not include FCS_TLSC_EXT.2.
0304 – Update to FCS_TLSC_EXT.1.2 Yes
0300 – Sensitive Data in FDP_DAR_EXT.1 Yes
0296 – Update to FCS_HTTPS_EXT.1.3 Yes
0295 – Update to FPT_AEX_EXT.1.3 Assurance
Activities
No This TD modifies the Assurance Activity for
Android/Windows Platforms. The TOE runs
on iOS.
0293 – Update to FCS_CKM.1(1) No This TD addresses FCS_CKM.1. The TOE does
not include FCS_CKM.1. Additionally, this TD
has been archived.
0283 – Cipher Suites for TLS in SWApp v1.2 Yes
9
Identifier Applicable? Exclusion Rationale (if applicable)
0358 - Cipher Suites for TLS in SWApp v1.2 Yes
0349 - Update to FPT_MCD_EXT.1.2 Yes
0269 – Update to FPT_AEX_EXT.1.3 Assurance
Activity
No This TD modifies the Assurance Activity for
Windows Platforms. The TOE runs on iOS.
Additionally, the TD has been archived.
0268 – FMT_MEC_EXT.1 Clarification Yes
0267 – TLSS testing - Empty Certificate
Authorities list
No This TD addresses the Assurance Activity for
FCS_TLSS_EXT.1. The TOE does not include
FCS_TLSS_EXT.1.
0244 – FCS_TLSC_EXT - TLS Client Curves
Allowed
Yes
0241 – Removal of Test 4.1 in FCS_TLSS_EXT.1.1 No This TD addresses the Assurance Activity for
FCS_TLSS_EXT.1. The TOE does not include
FCS_TLSS_EXT.1.
0238 – User-modifiable files FPT_AEX_EXT.1.4 Yes
0221 – FMT_SMF.1.1 - Assignments moved to
Selections
No This TD addresses the SWFE EP. The TOE is
not claiming conformance to the SWFE EP.
0218 – Update to FPT_AEX_EXT.1.3 Assurance
Activity
No This TD modifies the Assurance Activity for
Windows Platforms. The TOE runs on iOS.
Additionally, the TD has been archived.
0217 – Compliance to RFC5759 and RFC5280 for
using CRLs
Yes
0215 – Update to FCS_HTTPS_EXT.1.2 Yes
0192 – Update to FCS_STO_EXT.1 Application
Note
Yes
0178 – Integrity for installation tests in AppSW
PP
Yes
0177 – FCS_TLSS_EXT.1 Application Note
Update
No This TD addresses the usage of
FCS_TLSS_EXT.1 as it related to
FTP_DIT_EXT.1. The TOE does not include
FCS_TLSS_EXT.1.
0174 – Optional Ciphersuites for TLS No Superseded by TD283
0172 – Additional APIs added to
FCS_RBG_EXT.1.1
No This TD modifies the Assurance Activity for
Windows Platforms. The TOE runs on iOS.
0163 – Update to FCS_TLSC_EXT.1.1 Test 5.4
and FCS_TLSS_EXT.1.1 Test
No This TD is only needed when DHE or ECDHE
is not supported.
0131 – Update to FCS_TLSS_EXT.1.1 Test 4.5 No This TD addresses the Assurance Activity for
FCS_TLSS_EXT.1. The TOE does not include
FCS_TLSS_EXT.1.
0122 – FMT_SMF.1.1 Assignments moved to
Selections
No This TD addresses the SWFE EP. The TOE is
not claiming conformance to the SWFE EP.
Additionally, the TD has been archived.
0121 – FMT_MEC_EXT.1.1 Configuration
Options
No This TD addresses the SWFE EP. The TOE is
not claiming conformance to the SWFE EP.
0119 – FCS_STO_EXT.1.1 in PP_APP_v1.2 Yes
0107 – FCS_CKM - ANSI X9.31-1998, Section
4.1.for Cryptographic Key Generation
No This TD address key generation
(FCS_CKM.1). The TOE does not include key
generation.
Table 3 TDs
10
3. Security Problem Definition
The security problem definition has been taken from [SWAPP] and [WEBBROWSEREP] and is reproduced
here for the convenience of the reader. The security problem is described in terms of the threats that the
TOE is expected to address, assumptions about the operational environment, and any organizational
security policies that the TOE is expected to enforce.
3.1. Threats
The following threats are drawn directly from the [SWAPP] and [WEBBROWSEREP].
ID Threat
T.NETWORK_ATTACK An attacker is positioned on a communications channel or elsewhere on the
network infrastructure. Attackers may engage in communications with the
application software or alter communications between the application software
and other endpoints in order to compromise it.
T.NETWORK_EAVESDROP An attacker is positioned on a communications channel or elsewhere on the
network infrastructure. Attackers may monitor and gain access to data exchanged
between the application and other endpoints.
T.LOCAL_ATTACK An attacker can act through unprivileged software on the same computing
platform on which the application executes. Attackers may provide maliciously
formatted input to the application in the form of files or other local
communications.
T.PHYSICAL_ACCESS An attacker may try to access sensitive data at rest.
T.FLAWED_ADDON Web browser functionality can be extended through the integration of third-party
utilities and tools. Malicious or vulnerable add-ons could result in attacks against
the system. Such attacks can allow unauthorized access to sensitive information
in the browser, unauthorized access to the platform's file system, or even
privilege escalation that enables unauthorized access to other applications or the
operating system.
T.SAME-ORIGIN_VIOLATION Violating the same-origin policy is a specialized type of network attack (covered
generally as T.NETWORK_ATTACK in the App PP) which involves web content
violating access control policies enforced by a web browser to separate the
content of different web domains. It is specifically identified as a threat to web
browsers, since they implement the access control policies that are violated in
these attacks.
Attacks which involve same origin violations include:
 Insufficient protection of session tokens can lead to session hijacking,
where a token is captured and reused in order to gain the privileges of
the user who initiated the session.
 Cross-site scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks
are methods used to compromise user credentials (usually by stealing
the user's session token) to a web site. These attacks are more likely a
result of server security problems, but some browsers incorporate
technologies that try to detect the attacks.
 Inadequate sandboxing of browser windows/tabs or a faulty cross
domain communications model can lead to leakage of content from one
domain in one window/tab to a different domain in a different
window/tab. Such attacks leverage the ability of browsers to display
content from multiple domains simultaneously.
Table 4 Threats
11
3.2. Assumptions
The following assumptions are drawn directly from the [SWAPP] and [WEBBROWSEREP].
ID Assumption
A.PLATFORM The TOE relies upon a trustworthy computing platform for its execution. This
includes the underlying platform and whatever runtime environment it provides to
the TOE.
A.PROPER_USER The user of the application software is not willfully negligent or hostile, and uses
the software in compliance with the applied enterprise security policy.
A.PROPER_ADMIN The administrator of the application software is not careless, willfully negligent or
hostile, and administers the software within compliance of the applied enterprise
security policy.
Table 5 OSPs
3.3. Organizational Security Policies
There are no OSPs for the TOE.
12
4. Security Objectives
The security objectives have been taken from [SWAPP] and [WEBBROWSEREP] and are reproduced here
for the convenience of the reader.
4.1. Security Objectives for the TOE
The following security objectives for the TOE were drawn directly from the [SWAPP] and
[WEBBROWSEREP].
ID TOE Objective
O.INTEGRITY Conformant TOEs ensure the integrity of their installation and update packages, and
also leverage execution environment based mitigations. Software is seldom if ever
shipped without errors, and the ability to deploy patches and updates to fielded
software with integrity is critical to enterprise network security. Processor
manufacturers, compiler developers, execution environment vendors, and
operating system vendors have developed execution environment based
mitigations that increase the cost to attackers by adding complexity to the task of
compromising systems. Application software can often take advantage of these
mechanisms by using APIs provided by the runtime environment or by enabling the
mechanism through compiler or linker options.
Addressed by: FDP_DEC_EXT.1, FMT_CFG_EXT.1, FPT_AEX_EXT.1, FPT_TUD_EXT.1,
FPT_DNL_EXT.1, FPT_MCD_EXT.1
O.QUALITY To ensure quality of implementation, conformant TOEs leverage services and APIs
provided by the runtime environment rather than implementing their own versions
of these services and APIs. This is especially important for cryptographic services
and other complex operations such as file and media parsing. Leveraging this
platform behavior relies upon using only documented and supported APIs.
Addressed by: FMT_MEC_EXT.1, FPT_API_EXT.1, FPT_LIB_EXT.1
O.MANAGEMENT To facilitate management by users and the enterprise, conformant TOEs provide
consistent and supported interfaces for their security relevant configuration and
maintenance. This includes the deployment of applications and application updates
through the use of platform supported deployment mechanisms and formats, as
well as providing mechanisms for configuration. This also includes providing control
to the user regarding disclosure of any PII.
Addressed by: FMT_SMF.1, FPT_IDV_EXT.1, FPT_TUD_EXT.1.5, FPR_ANO_EXT.1,
FDP_TRK_EXT.1, FMT_MOF_EXT.1
O.PROTECTED_STORAGE To address the issue of loss of confidentiality of user data in the event of loss of
physical control of the storage medium, conformant TOEs will use data at rest
protection. This involves encrypting data and keys stored by the TOE in order to
prevent unauthorized access to this data. This also includes unnecessary network
communications whose consequence may be the loss of data.
Addressed by: FDP_DAR_EXT.1, FCS_STO_EXT.1, FCS_RBG_EXT.1
O.PROTECTED_COMMS To address both passive (eavesdropping) and active (packet modification) network
attack threats, conformant TOEs will use a trusted channel for sensitive data.
Sensitive data includes cryptographic keys, passwords, and any other data specific
to the application that should not be exposed outside of the application.
Addressed by: FTP_DIT_EXT.1, FCS_TLSC_EXT.1, FCS_DTLS_EXT.1, FCS_RBG_EXT.1,
FDP_STR_EXT.1
O.DOMAIN_ISOLATION To address the network attack associated with content leakage between different
web domains, the browser must ensure that content originating from different
domains (e.g., in a tab or iFrame) is properly isolated.
13
Addressed by: FDP_ACF_EXT.1.1, FDP_SBX_EXT.1, FDP_SOP_EXT.1
O.ADDON_INTEGRITY To address issues associated with malicious or flawed add-ons, conformant
browsers implement mechanisms to ensure their integrity. This includes verification
and validation at installation time and update.
Addressed by: FPT_AON_EXT.1
Table 6 Objectives for the TOE
4.2. Security Objectives for the Operational Environment
The following security objectives for the operational environment assist the TOE in correctly providing its
security functionality. These track with the assumptions about the environment.
ID Objective for the Operation Environment
OE.PLATFORM The TOE relies upon a trustworthy computing platform for its execution. This includes the
underlying operating system and any discrete execution environment provided to the
TOE.
OE.PROPER_USER The user of the application software is not willfully negligent or hostile, and uses the
software within compliance of the applied enterprise security policy.
OE.PROPER_ADMIN The administrator of the application software is not careless, willfully negligent or hostile,
and administers the software within compliance of the applied enterprise security policy.
Table 7 Objectives for the environment
14
5. Security Requirements
This section identifies the Security Functional Requirements for the TOE and/or Platform. The Security
Functional Requirements included in this section are derived from Part 2 of the Common Criteria for
Information Technology Security Evaluation, Version 3.1, Revision 4 and all international interpretations.
Requirement Auditable Event
FCS_HTTPS_EXT.1 HTTPS Protocol
FCS_RBG_EXT.1 Random Bit Generation Services
FCS_STO_EXT.1 Storage of Secrets
FCS_TLSC_EXT.1 TLS Client Protocol
FCS_TLSC_EXT.4 TLS Client Protocol
FDP_ACF_EXT.1 Local and Session Storage Separation
FDP_COO_EXT.1 Cookie Blocking
FDP_SBX_EXT.1 Sandboxing of Rendering Processes
FDP_SOP_EXT.1 Same Origin Policy
FDP_STR_EXT.1 Secure Transmission of Cookie Data
FDP_TRK_EXT.1 Tracking Information Collection
FDP_DAR_EXT.1 Encryption Of Sensitive Application Data
FDP_DEC_EXT.1 Access to Platform Resources
FDP_NET_EXT.1 Network Communications
FIA_X509_EXT.1 X.509 Certificate Validation
FIA_X509_EXT.2 X.509 Certificate Authentication
FMT_CFG_EXT.1 Secure by Default Configuration
FMT_MOF_EXT.1 Management of Functions Behavior
FMT_MEC_EXT.1 Supported Configuration Mechanism
FMT_SMF.1 Specification of Management Functions
FPR_ANO_EXT.1 User Consent for Transmission of Personally Identifiable Info
FPT_AON_EXT.1 Support for Only Trusted Addons
FPT_DNL_EXT.1 File Downloads
FPT_MCD_EXT.1 Mobile Code
FPT_AEX_EXT.1 AntiExploitation Capabilities
FPT_API_EXT.1 Use of Supported Services and APIs
FPT_LIB_EXT.1 Use of Third Party Libraries
FPT_TUD_EXT.1 Integrity for Installation and Update
FTP_DIT_EXT.1 Protection of Data in Transit
Table 8 SFRs
5.1. Conventions
The CC defines operations on Security Functional Requirements: assignments, selections, assignments
within selections and refinements. This document uses the following font conventions to identify the
operations defined by the CC:
 Assignment: Indicated with italicized text;
 Refinement: Indicated with bold text;
 Selection: Indicated with underlined text;
 Iteration: Indicated by appending the iteration number in parenthesis, e.g., (1), (2), (3).
 Where operations were completed in the PP itself, the formatting used in the PP has been
retained.
15
Explicitly stated SFRs are identified by having a label ‘EXT’ after the requirement name for TOE SFRs.
Formatting conventions outside of operations matches the formatting specified within the PP.
5.2. Security Functional requirements
5.2.1. Cryptographic Support (FCS)
FCS_HTTPS_EXT.1 HTTPS Protocol
FCS_HTTPS_EXT.1.1
The application shall implement the HTTPS protocol that complies with RFC 2818.
FCS_ HTTPS _EXT.1.2
The application shall implement HTTPS using TLS in accordance with [FCS_TLSC_EXT.1].
FCS_ HTTPS _EXT.1.3
The application shall [notify the user and request authorization to establish the connection] if the peer certificate is
deemed invalid.
FCS_RBG_EXT.1 Random Bit Generation Services
FCS_RBG_EXT.1.1
The application shall [invoke platform-provided DRBG functionality] for its cryptographic operations.
FCS_STO_EXT.1 Storage of Secrets
FCS_STO_EXT.1.1
The application shall [not store any credentials] to non-volatile memory.
FCS_TLSC_EXT.1 TLS Client Protocol
FCS_TLSC_EXT.1.1
The application shall [invoke platform-provided TLS 1.2] supporting the following ciphersuites:
[
 TLS_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246
 TLS_RSA_WITH_AES_256_CBC_SHA256 as defined in RFC 5246
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289
 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5289
 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 as defined in RFC 5289
 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289
 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289]
FCS_TLSC_EXT.1.2
The application shall verify that the presented identifier matches the reference identifier according to RFC
6125.
FCS_TLSC_EXT.1.3
The application shall only establish a trusted channel if the peer certificate is valid.
FCS_TLSC_EXT.4 TLS Client Protocol
FCS_TLSC_EXT.4.1
The application shall present the supported Elliptic Curves Extension in the Client Hello with the following
NIST curves: [secp256r1, secp384r1].
16
5.2.2. User Data Protection (FDP)
FDP_ACF_EXT.1 Local and Session Storage Separation
FDP_ACF_EXT.1.1
The browser shall separate local (permanent) and session (ephemeral) storage based on domain, protocol
and port:
 Session storage shall be accessible only from the originating window/tab;
 Local storage shall only be accessible from windows/tabs running the same web application.
FDP_COO_EXT.1 Cookie Blocking
FDP_COO_EXT.1.1
The browser shall provide the capability to block the storage of third party cookies by websites.
FDP_DEC_EXT.1 Access to Platform Resources
FDP_DEC_EXT.1.1
The application shall restrict its access to [network connectivity, camera, microphone, and location
services].
FDP_DEC_EXT.1.2
The application shall restrict its access to [no sensitive information repositories].
FDP_NET_EXT.1 Network Communications
FDP_NET_EXT.1.1
The application shall restrict network communication to [user-initiated communication for [accessing
websites]].
FDP_DAR_EXT.1 Encryption of Sensitive Application Data
FDP_DAR_EXT.1.1
The application shall [leverage platform-provided functionality to encrypt sensitive data] in non-volatile
memory.
FDP_SBX_EXT.1 Sandboxing of Rendering Processes
FDP_SBX_EXT.1.1
The browser shall ensure that web page rendering is performed in a process that is restricted in the
following manner:
The rendering process can only directly access the area of the file system dedicated to the browser.
 The rendering process can only directly access the area of the file system dedicated to the
browser.
 The rendering process can only directly invoke inter-process communication mechanisms with its
own browser processes.
 The rendering process has reduced privilege with respect to other browser processes [in no other
ways]
17
FDP_SOP_EXT.1 Same Origin Policy
FDP_SOP_EXT.1.1
The browser shall only permit scripts contained in one web page to access data in a second web page if
both pages are from the same origin.
FDP_SOP_EXT.1.2
The browser shall enforce the same origin policy for all domains.
FDP_STR_EXT.1 Secure Transmission of Cookie Data
FDP_STR_EXT.1.1
The browser shall ensure that cookies containing the secure attribute in the set-cookie header are sent
over HTTPS.
FDP_TRK_EXT.1 Tracking Information Collection
FDP_TRK_EXT.1.1
The browser shall provide notification to the user when tracking information for [:
 geolocation
] is requested by a website.
5.2.3. Identification and Authentication (FIA)
FIA_X509_EXT.1 X.509 Certificate Validation
FIA_X509_EXT.1.1
The application shall [invoked platform-provided functionality] to validate certificates in accordance with
the following rules:
 RFC 5280 certificate validation and certificate path validation.
 The certificate path must terminate with a trusted CA certificate.
 The application shall validate a certificate path by ensuring the presence of the basicConstraints
extension and that the CA flag is set to TRUE for all CA certificates.
 The application shall validate the revocation status of the certificate using [the Online Certificate
Status Protocol (OCSP) as specified in RFC 2560].
 The application shall validate the extendedKeyUsage field according to the following rules:
o Certificates used for trusted updates and executable code integrity verification shall have
the Code Signing purpose (idkp 3 with OID 1.3.6.1.5.5.7.3.3) in the extendedKeyUsage
field.
o Server certificates presented for TLS shall have the Server Authentication purpose (idkp 1
with OID 1.3.6.1.5.5.7.3.1) in the extendedKeyUsage field.
o Client certificates presented for TLS shall have the Client Authentication purpose (idkp 2
with OID 1.3.6.1.5.5.7.3.2) in the extendedKeyUsage field.
o S/MIME certificates presented for email encryption and signature shall have the Email
Protection purpose (idkp 4 with OID 1.3.6.1.5.5.7.3.4) in the extendedKeyUsage field.
18
o OCSP certificates presented for OCSP responses shall have the OCSP Signing purpose (idkp
9 with OID 1.3.6.1.5.5.7.3.9) in the extendedKeyUsage field.
o Server certificates presented for EST shall have the CMC Registration Authority (RA)
purpose (idkpcmcRA with OID 1.3.6.1.5.5.7.3.28) in the extendedKeyUsage field.
FIA_X509_EXT.1.2
The application shall only treat a certificate as a CA certificate if the basicConstraints extension is present
and the CA flag is set to TRUE.
FIA_X509_EXT.2 X.509 Certificate Authentication
FIA_X509_EXT.2.1
The application shall use X.509v3 certificates as defined by RFC 5280 to support authentication for [HTTPS,
TLS].
FIA_X509_EXT.2.2
When the application cannot establish a connection to determine the validity of a certificate, the
application shall [not accept the certificate].
5.2.4. Security Management (FMT)
FMT_CFG_EXT.1 Secure by Default Configuration
FMT_CFG_EXT.1.1
The application shall only provide enough functionality to set new credentials when configured with
default credentials or no credentials.
FMT_CFG_EXT.1.2
The application shall be configured by default with file permissions which protect the application's
binaries and data files from modification by normal unprivileged user.
FMT_MEC_EXT.1 Supported Configuration Mechanism
FMT_MEC_EXT.1.1
The application shall invoke the mechanisms recommended by the platform vendor for storing and setting
configuration options.
FMT_MOF_EXT.1 Management of Functions Behavior
FMT_MOF_EXT.1.1
The browser shall be capable of performing the following management functions, controlled by the
administrator or user as shown:
 X = Mandatory
 O = Optional
Management Function Administrator User
Enable/disable storage of third party cookies O, N X, I
Enable/disable use of OCSP for obtaining the revocation status of X.509
certificates
O, N O, N
Configure inclusion of user-agent information in HTTP headers O, N O, N
19
Enable/disable ability for websites to collect tracking information about the
user through [[Cookies, Do Not Track requests, location services]]
O, N O, I
Enable/disable deletion of stored browsing data (cache, web form
information)
O, N X, I
Enable/disable storage of sensitive information (e.g., auto-fill, auto-
complete) in persistent storage
O, N O, N
Configure size of cookie cache O, N O, N
Configure size of cache O, N O, N
Enable/disable interaction with Graphic Processing Units (GPUs) O, N O, N
Configure the ability to advance to a web site with an invalid or unvalidated
X.509 certificate
O, N O, N
Enable/disable establishment of a trusted channel if the browser cannot
establish a connection to determine the validity of a certificate
O, N O, N
Configure the use of an application reputation service to detect malicious
applications prior to download
O, N O, I
Configure the use of a URL reputation service to detect sites that contain
malware or phishing content
O, N O, I
Enable/disable automatic installation of software updates and patches O, N O, N
Enable/disable ability for websites to register protocol handlers O, N O, N
Enable/disable display notification when unsigned, untrusted or unverified
mobile code is encountered
O, N O, N
Enable/disable user's ability to select default actions upon download of a file
(e.g., always open, or always save, a downloaded file)
O, N O, N
Enable/disable launching of downloaded files outside the browser O, N O, N
Enable/disable JavaScript X, I X, I
Enable/disable [no mobile code types] O, N O, N
Enable/disable support for addons O, N O, N
Enable/disable individual addons O, N O, N
Enable/disable HSTS mode O, N O, N
Application Note: Implementation of the optional functionality above has been identified as either
implemented with an “I” or not implemented with an “N”
FMT_SMF.1 Specification of Management Functions
FMT_SMF.1.1
The TSF shall be capable of performing the following management functions [management functions
defined in FMT_MOF_EXT.1].
5.2.5. Privacy (FPR)
FPR_ANO_EXT.1 User Consent for Transmission of Personally Identifiable Information
FPR_ANO_EXT.1
The application shall [not transmit PII over a network].
20
5.2.6. Protection of TSF (FPT)
FPT_API_EXT.1 Use of Supported Services and APIs
FPT_API_EXT.1.1
The application shall only use documented platform APIs.
FPT_AEX_EXT.1 AntiExploitation Capabilities
FPT_AEX_EXT.1.1
The application shall not request to map memory at an explicit address except for [none].
FPT_AEX_EXT.1.2
The application shall [not allocate any memory region with both write and execute permissions].
FPT_AEX_EXT.1.3
The application shall be compatible with security features provided by the platform vendor.
FPT_AEX_EXT.1.4
The application shall not write user modifiable files to directories that contain executable files unless
explicitly directed by the user to do so.
FPT_AEX_EXT.1.5
The application shall be compiled with stack-based buffer overflow protection enabled.
FPT_DNL_EXT.1 File Downloads
FPT_DNL_EXT.1.1
The browser shall prevent downloaded content from launching automatically.
FPT_DNL_EXT.1.2
The browser shall present the user with the option to either save or discard downloaded files.
FPT_MCD_EXT.1 Mobile Code
FPT_MCD_EXT.1.1
The browser shall support the capability to execute signed [JavaScript] mobile code.
FPT_MCD_EXT.1.2
The browser shall [automatically discard] unsigned, untrusted or unverified [JavaScript] mobile code
without executing it.
FPT_AON_EXT.1 Support for Only Trusted Add-ons
FPT_AON_EXT.1.1
The browser shall include the capability to load [no add-ons].
FPT_TUD_EXT.1 Integrity for Installation and Update
FPT_TUD_EXT.1.1
The application shall [leverage the platform] to check for updates and patches to the application software.
FPT_TUD_EXT.1.2
The application shall be distributed using the format of the platform supported package manager.
21
FPT_TUD_EXT.1.3
The application shall be packaged such that its removal results in the deletion of all traces of the
application, with the exception of configuration settings, output files, and audit/log events.
FPT_TUD_EXT.1.4
The application shall not download, modify, replace or update its own binary code.
FPT_TUD_EXT.1.5
The application shall [leverage the platform] to query the current version of the application software.
FPT_TUD_EXT.1.6
The application installation package and its updates shall be digitally signed such that its platform can
cryptographically verify them prior to installation.
FPT_LIB_EXT.1 Use of Third Party Libraries
FPT_LIB_EXT.1.1
The application shall be packaged with only [none].
5.2.7. Trusted Path/Channel (FTP)
FTP_DIT_EXT.1 Protection of Data in Transit
FTP_DIT_EXT.1.1
The application shall [encrypt all transmitted data with [HTTPS, TLS]] between itself and another trusted
IT product.
5.3. TOE SFR Dependencies Rationale for SFRs
The Protection Profile for Application Software contains all the requirements claimed in this Security
Target. As such, the dependencies are not applicable since the PP has been approved.
5.4. Security Assurance Requirements
The TOE assurance requirements for this ST are taken directly from the Protection Profile for Application
Software which are derived from Common Criteria Version 3.1, Revision 4. The assurance requirements
are summarized in the table below.
Assurance Class Components Components Description
Development ADV_FSP.1 Basic Functional Specification
Guidance Documents AGD_OPE.1 Operational User Guidance
AGD_PRE.1 Preparative User Guidance
Life Cycle Support ALC_CMC.1 Labeling of the TOE
ALC_CMS.1 TOE CM Coverage
ALC_TSU_EXT.1 Timely Security Updates
Tests ATE_IND.1 Independent Testing – Conformance
22
Assurance Class Components Components Description
Vulnerability Assessment AVA_VAN.1 Vulnerability Analysis
Table 9 Security Assurance Requirements
5.5. Rationale for Security Assurance Requirements
The functional specification describes the external interfaces of the TOE; such as the means for a user to
invoke a service and the corresponding response of those services. The description includes the
interface(s) that enforces a security functional requirement, the interface(s) that supports the
enforcement of a security functional requirement, and the interface(s) that does not enforce any security
functional requirements. The interfaces are described in terms of their purpose (general goal of the
interface), method of use (how the interface is to be used), parameters (explicit inputs to and outputs
from an interface that control the behavior of that interface), parameter descriptions (tells what the
parameter is in some meaningful way), and error messages (identifies the condition that generated it,
what the message is, and the meaning of any error codes). The development evidence also contains a
tracing of the interfaces to the SFRs described in this ST.
5.6. Assurance Measures
The TOE satisfies the identified assurance requirements. This section identifies the Assurance Measures
applied by Apple to satisfy the assurance requirements. The table below lists the details.
SAR Component How the SAR will be met
ADV_FSP.1 The functional specification describes the external interfaces of the TOE; such as the means
for a user to invoke a service and the corresponding response of those services. The
description includes the interface(s) that enforces a security functional requirement, the
interface(s) that supports the enforcement of a security functional requirement, and the
interface(s) that does not enforce any security functional requirements. The interfaces are
described in terms of their purpose (general goal of the interface), method of use (how the
interface is to be used), parameters (explicit inputs to and outputs from an interface that
control the behavior of that interface), parameter descriptions (tells what the parameter is in
some meaningful way), and error messages (identifies the condition that generated it, what
the message is, and the meaning of any error codes).
AGD_OPE.1 The Administrative Guide provides the descriptions of the processes and procedures of how
the administrative users of the TOE can securely administer the TOE using the interfaces that
provide the features and functions detailed in the guidance.
AGD_PRE.1 The Installation Guide describes the installation, generation, and startup procedures so that
the users of the TOE can put the components of the TOE in the evaluated configuration.
ALC_CMC.1 The Configuration Management (CM) documents describe how the consumer identifies the
evaluated TOE. The CM documents identify the configuration items, how those configuration
items are uniquely identified, and the adequacy of the procedures that are used to control
and track changes that are made to the TOE. This includes details on what changes are
tracked and how potential changes are incorporated.
ALC_CMS.1
ALC_TSU_EXT.1 To report security or privacy issues that affect Apple products or web servers, should contact
product-security@apple.com. Submissions can use Apple's Product Security PGP key
(https://support.apple.com/en-us/HT201214) to encrypt sensitive information that is sent by
email. When the email is received, Apple will send an automatic email as acknowledgment. If
this email is not received, please check the email address and send again. For the protection
23
SAR Component How the SAR will be met
of our customers, Apple generally does not disclose, discuss, or confirm security issues until
a full investigation is complete and any necessary patches or releases are available. Apple
distributes information about security issues in its products through security advisories.
Users can also receive Apple security advisories through the security-announce mailing list.
ATE_IND.1 Apple will provide the TOE for testing.
AVA_VAN.1 Apple will provide the TOE for testing.
Table 10 TOE Security Assurance Measures
24
6. TOE Summary Specification
This chapter identifies and describes how the Security Functional Requirements and Security Assurance
Requirements identified above are met by the TOE.
TOE SFR Rationale
FCS_HTTPS_EXT.1 The TOE implements RFC 2818 and leverages TLS 1.2 for establishing a secure connection. If
the TOE fails to validate a server certificate, the user receives a notification and must
authorize the connection before it is established.
FCS_RBG_EXT.1 The TOE leverages the platform provided SecRandomCopyBytes to for random bit services.
Specifically, the TOE uses the random bits to auto-generate user requested information for
websites (e.g., auto-fill).
FCS_STO_EXT.1 The Safari application does not use any credentials.
FCS_TLSC_EXT.1
FCS_TLSC_EXT.4
The TOE implements TLS 1.2 for use in establishing secure connections to external IT
entities. By default, TLS 1.0, TLS 1.1, SSL 2.0 and SSL 3.0 connections are denied.
The TOE supports the following encryption algorithms for use with TLS connections:
 TLS_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246
 TLS_RSA_WITH_AES_256_CBC_SHA256 as defined in RFC 5246
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289
 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5289
 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 as defined in RFC 5289
 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 as defined in RFC 5289
 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 as defined in RFC 5289
During establishment of the TLS 1.2 session, the TOE platform will perform verification of
the presented identifier in the peer certificate to ensure that it is a valid reference
identifier. This ensures that the reference identifier is conformant with RFC 6125. When
the TOE uses the APIs provided by the platform to attempt to establish a trusted channel,
the TOE will compare the DN contained within the peer certificate (specifically the Subject
CN, as well as any Subject Alternative Name fields, IP Address, or Wildcard certificate if
applicable) to the DN of the requested server. If the DN in the certificate does not match
the expected DN for the peer, then the application cannot establish the connection.
The TOE supports IP address and wildcards (via the TOE platform). Certificate pinning is not
supported. The TOE, when acting as a client, provides responses to the server with a list of
its supported curves, including, secp256r1 and secp384r1. These elliptic curves are
supported by default and no configuration is required.
FDP_DAR_EXT.1 During operation of the TOE, any sensitive information stored securely is protected by
platform-provided functionality to encrypt the sensitive data. All user requested browser
information (autofill information) stored on the platform is stored under Class C (Protected
Until First User Authentication- NSFileProtectionComplete). No other files are stored by the
application.
FDP_DEC_EXT.1 The TOE requests only access to the following components:
 Network connectivity
 Camera
 Microphone
 Location services
FDP_NET_EXT.1 The TOE communicates on the network (accessing external websites) based upon user-
initiated actions.
FDP_ACF_EXT.1 The TOE runs in a sandbox environment within the underlying platform OS. The TOE has not
25
TOE SFR Rationale
access to storage outside of the implemented sandbox. The storage used by the TOE is
isolated from the underlying platform.
FDP_COO_EXT.1 The TOE can be configured through setting to block all cookies via communication with the
underlying platforms settings menu. When configured, the TOE will reject any attempts from
a website to use third-party cookies.
FDP_SBX_EXT.1 The TOE is a first-party application provided as part of the underlying platform. When
requests to render HTML or interpret JavaScript are done by a website, the TOE process itself
will process the request underlying platform’s libraries. The TOE runs in a dedicated sandbox
environment on the platform. This completely isolates the requests from accessing the
platform’s file system. The TOE has no access to the underlying file system. This functionality
is enabled by default with no user intervention required.
FDP_SOP_EXT.1 Each Browser tab/window is individually isolated from the other open tabs and does not
allow data to flow between or exceptions made due to state, condition, or origin of another
tab. Each tab/window requires appropriate adherence to the authentication requirements
and restrictions. No sharing occurs between tabs/windows. The TOE is fully compliant with
RFC 6454 in that the policy is applied to all web browser tab/windows independently, there
is not situation where conformation is relaxed in anyway.
FDP_STR_EXT.1 In accordance with RFC 6265, the TOE supports the use of the ‘secure’ attribute within the
set-cookie header. Cookies that are sent over HTTPS are required to contain this attribute
within the header.
FDP_TRK_EXT.1 The TOE provides notifications to users when a request for geolocation is sent from a website
is needed. The request is displayed as a pop-up to the user and offers the option to allow or
deny the request.
FIA_X509_EXT.1
The TOE leverages X.509 certificate validation services provided by the TOE platform to
validate certificates presented by its TLS connections.
The X.509 certificates are validated using the certificate path validation algorithm defined
in RFC 5280, which can be summarized as follows:
 the public key algorithm and parameters are checked
 the current date/time is checked against the validity period
 revocation status is checked
 issuer name of X matches the subject name of X+1
 name constraints are checked
 policy OIDs are checked
 policy constraints are checked; issuers are ensured to have CA signing bits
 path length is checked
 critical extensions are processed
In order to verify the revocation status of the presented certificates Online Certificate Status
Protocol (OCSP) is used. Certificate processing is completely provided by the TOE platform.
FIA_X509_EXT.2
X.509v3 certificates are supported for authentication for TLS connections.
The certificate used for TLS connection are loaded as all other configuration information is
loaded, via an .xml configuration file. The TOE will only use the configured certificates for TLS
connections.
The TOE receives its peer X.509 certificate during the initial establishment of a TLS
connection. If during the revocation check of this certificate, the OCSP server cannot be
contacted, the connection will not be established. If the certificate is deemed to be invalid
via a revocation check, the communication will cease immediately and a connection will not
be established.
26
TOE SFR Rationale
FMT_CFG_EXT.1 The TOE does not come with any default credentials. The user must configure an account
first before accessing the TOE and underlying platform.
FMT_MEC_EXT.1/
FMT_MOF_EXT.1/
FMT_SMF.1
The TOE supports several managements functions including,
 Enabling and disabling storage of cookies
 Enabling and disabling the ability for websites to collect tracking information
 Deletion of stored browsing data
 Enabling and disabling storage of auto-fill and auto-complete data
 Configuring the use of an application reputation service to detect malicious
applications prior to download
 Configuring the use of a URL reputation service to detect sites that contain malware
or phishing content
 Enabling and disabling JavaScript
Of these configurations, enabling and disabling JavaScript and enabling and disabling storage
of auto-fill and auto-complete data can be configured via uploaded profiles. When configured
via an uploaded profile, the user of the TOE is not able to change the settings.
Each of these settings is provided through the underlying Platform. The TOE does not provide
a separate configuration interface. Each of these settings are stored in the user defaults
system by the underlying platform.
FPR_ANO_EXT.1 The TOE does not specifically request PII from the user. Any information provided by the user
is entered without prompting from the TOE.
FPT_DNL_EXT.1 The TOE does not permit automatic downloading of from a website. The content user must
approve a request before the download begins or discard the download request. Only after
the request is approved will the content be downloaded.
FPT_MCD_EXT.1 The TOE supports the user of signed JavaScript mobile code. No other mobile code is
supported by the TOE. All incorrectly signed JavaScript is discarded by the TOE.
FPT_AON_EXT.1 The TOE does not support the use of add-ons.
FPT_AEX_EXT.1 The TOE is compiled with ASLR enabled (achieved by compiling with the –fPIE flag) and does
not make any calls to mmap or mprotect. Stack-based buffer overflow protection is provided
by being compiled with the –fstack-protector-all flag.
FPT_API_EXT.1 The following API frameworks are used by Safari:
 Accounts.framework
 AddressBook.framework
 AppKit.framework
 AppSupport.framework
 AssistantServices.framework
 Contacts.framework
 ContactsDonation.framework
 CoreData.framework
 CoreFoundation.framework
 CoreGraphics.framework
 CoreSpotlight.framework
 CoreSuggestions.framework
 CoreText.framework
 DataAccessExpress.framework
 Foundation.framework
 IntlPreferences.framework
 PhoneNumber.framework
 Security.framework
27
TOE SFR Rationale
 TCC.framework
FPT_LIB_EXT.1 The TOE does not leverage any third-party libraries. It is a 1st
part application that is provided
on the underlying platform by the vendor.
FPT_TUD_EXT.1 The TOE is provided within the underlying OS image and packaged as an IPA file signed by
Apple. Updates to the TOE are provided through system updates and current versions of the
TOE can be checked through the Settings of the underlying platform.
FTP_DIT_EXT.1 All application data is transmitted securely via HTTPS and TLS.
Table 11 TOE Summary Specification SFR Description
TOE SFR Rationale
ALC_TSU_EXT.1 To report security or privacy issues that affect Apple products or web servers, should contact
product-security@apple.com. Submissions can use Apple's Product Security PGP key
(https://support.apple.com/en-us/HT201214) to encrypt sensitive information that is sent by
email. When the email is received, Apple will send an automatic email as acknowledgment.
If this email is not received, please check the email address and send again. For the protection
of our customers, Apple generally does not disclose, discuss, or confirm security issues until
a full investigation is complete and any necessary patches or releases are available. Apple
distributes information about security issues in its products through security advisories. Users
can also receive Apple security advisories through the security-announce mailing list.
Table 12 TOE Summary Specification SAR Description
28
---End of Document---