HPColor LaserJet Enterprise 5700,
HPColor LaserJet Enterprise 6700/6701,
HPColor LaserJet Enterprise X55745,
HPColor LaserJet Enterprise X65455/X65465
Security Target
Version: 1.0
Status: Final
Last Update: 2024-05-22
Classification: Public
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 2 of 144
Trademarks
The following terms are trademarks of Hewlett-Packard Development Company, L.P. in the United States, other
countries, or both.
• HP®
• LaserJet®
The following terms are trademarks of Arm Holdings plc in the United States, other countries, or both.
• Arm®
• Cortex®
The following term is a trademark of Massachusetts Institute of Technology (MIT) in the United States, other
countries, or both.
• Kerberos™
The following terms are trademarks of Microsoft Corporation in the United States, other countries, or both.
• Microsoft®
• Windows®
• Authenticode®
The following term is a trademark of INSIDE Secure in the United States, other countries, or both.
• INSIDE Secure®
• QuickSec®
The following terms are trademarks of the Seagate Technology LLC in the United States, other countries, or both.
• Seagate®
• Seagate Secure®
The following term is a trademark of the Trusted Computing Group in the United States, other countries, or both.
• Trusted Computing Group®
Other company, product, and service names may be trademarks or service marks of others.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 3 of 144
Legal Notices
This document is provided AS IS with no express or implied warranties. Use the information in this document at
your own risk.
This document may be reproduced or distributed in any form without prior permission provided the copyright notice
is retained on all copies. Modified versions of this document may be freely distributed provided that they are clearly
identified as such, and this copyright is included intact.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 4 of 144
Revision History
Version Date Author(s) Description
1.0 2024-05-22 HP Inc. Public version for evaluation.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 5 of 144
Table of Contents
1 Introduction.......................................................................................................................................11
1.1 Security Target Identification.....................................................................................................................11
1.2 TOE Identification .....................................................................................................................................11
1.3 TOE Type...................................................................................................................................................11
1.4 TOE Overview...........................................................................................................................................11
1.4.1 Required and Optional Hardware, Software, and Firmware..................................................................12
1.4.2 Intended Method of Use ........................................................................................................................13
1.5 TOE Description ........................................................................................................................................13
1.5.1 TOE Models and Firmware Versions ....................................................................................................13
1.5.2 TOE Architecture...................................................................................................................................15
1.5.3 TOE Security Functionality (TSF) Summary ........................................................................................17
Auditing ........................................................................................................................................17
Data Encryption (a.k.a. cryptography)..........................................................................................18
Identification, Authentication, and Authorization to Use HCD Functions ...................................19
Access Control..............................................................................................................................22
Image Overwrite ...........................................................................................................................22
Trusted Communications ..............................................................................................................22
Administrative Roles.....................................................................................................................22
Trusted Operation .........................................................................................................................23
1.5.4 TOE Boundaries ....................................................................................................................................23
Physical Boundary ........................................................................................................................23
Logical Boundary..........................................................................................................................23
Evaluated Configuration ...............................................................................................................24
2 CC Conformance Claim...................................................................................................................26
2.1 Protection Profile Tailoring and Additions ................................................................................................26
2.1.1 Protection Profile for Hardcopy Devices; IPA, NIAP, and the MFP Technical Community ([HCDPP])
26
3 Security Problem Definition.............................................................................................................28
3.1 Threat Environment ...................................................................................................................................28
3.1.1 Threats Countered by the TOE ..............................................................................................................28
3.2 Assumptions...............................................................................................................................................29
3.2.1 Environment of Use of the TOE ............................................................................................................29
Physical.........................................................................................................................................29
Personnel.......................................................................................................................................29
Connectivity..................................................................................................................................29
3.3 Organizational Security Policies ................................................................................................................30
4 Security Objectives ...........................................................................................................................31
4.1 Objectives for the TOE ..............................................................................................................................31
4.2 Objectives for the Operational Environment..............................................................................................32
4.3 Security Objectives Rationale ....................................................................................................................32
4.3.1 Coverage................................................................................................................................................32
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 6 of 144
4.3.2 Sufficiency.............................................................................................................................................33
5 Extended Components Definition....................................................................................................36
5.1 Class FAU: Security Audit.........................................................................................................................36
5.1.1 Extended: External Audit Trail Storage (FAU_STG)............................................................................36
FAU_STG_EXT.1 - Extended: Protected Audit Trail Storage .....................................................36
5.2 Class FCS: Cryptographic Support ............................................................................................................37
5.2.1 Cryptographic Key Management (FCS_CKM) .....................................................................................37
FCS_CKM_EXT.4 - Extended: Cryptographic Key Material Destruction...................................37
5.2.2 Extended: IPsec selected (FCS_IPSEC) ................................................................................................37
FCS_IPSEC_EXT.1 – Extended: IPsec selected ..........................................................................38
5.2.3 Extended: Cryptographic Operation (Key Chaining) (FCS_KYC) .......................................................39
FCS_KYC_EXT.1 – Extended: Key Chaining .............................................................................39
5.2.4 Extended: Cryptographic Operation (Random Bit Generation) (FCS_RBG)........................................40
FCS_RBG_EXT.1 – Extended: Random Bit Generation..............................................................40
5.3 Class FDP: User Data Protection ...............................................................................................................41
5.3.1 Extended: Protection of Data on Disk (FDP_DSK)...............................................................................41
FDP_DSK_EXT.1 – Extended: Protection of Data on Disk.........................................................41
5.4 Class FIA: Identification and Authentication.............................................................................................42
5.4.1 Extended: Password Management (FIA_PMG).....................................................................................42
FIA_PMG_EXT.1 – Extended: Password Management...............................................................42
5.4.2 Extended: Pre-Shared Key Composition (FIA_PSK)............................................................................43
FIA_PSK_EXT.1 – Extended: Pre-Shared Key Composition ......................................................43
5.5 Class FPT: Protection of the TSF...............................................................................................................44
5.5.1 Extended: Protection of Key and Key Material (FPT_KYP).................................................................44
FPT_KYP_EXT.1 – Extended: Protection of Key and Key Material...........................................44
5.5.2 Extended: Protection of TSF Data (FPT_SKP) .....................................................................................44
FPT_SKP_EXT.1 – Extended: Protection of TSF Data................................................................45
5.5.3 Extended: TSF Testing (FPT_TST).......................................................................................................45
FPT_TST_EXT.1 – Extended: TSF Testing .................................................................................46
5.5.4 Extended: Trusted Update (FPT_TUD).................................................................................................46
FPT_TUD_EXT.1 – Extended: Trusted Update...........................................................................46
6 Security Requirements .....................................................................................................................48
6.1 TOE Security Functional Requirements.....................................................................................................48
6.1.1 Security audit (FAU) .............................................................................................................................51
Audit data generation (FAU_GEN.1) ...........................................................................................51
User identity association (FAU_GEN.2) ......................................................................................52
Extended: Audit Trail Storage (FAU_STG_EXT.1).....................................................................52
6.1.2 Cryptographic support (FCS).................................................................................................................52
Cryptographic key generation (asymmetric keys) (FCS_CKM.1(a)) ...........................................52
Cryptographic key generation (symmetric keys) (FCS_CKM.1(b)) .............................................53
Extended: Cryptographic key material destruction (FCS_CKM_EXT.4).....................................53
Cryptographic key destruction (FCS_CKM.4) .............................................................................53
Cryptographic Operation (Symmetric encryption/decryption) (FCS_COP.1(a))..........................53
Cryptographic Operation (for signature generation/verification) (FCS_COP.1(b))......................54
Cryptographic operation (Hash algorithm) (FCS_COP.1(c)) .......................................................55
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 7 of 144
Cryptographic operation (for keyed-hash message authentication) (FCS_COP.1(g)) ..................55
Extended: IPsec selected (FCS_IPSEC_EXT.1)...........................................................................56
Extended: Key chaining (FCS_KYC_EXT.1) ..............................................................................57
Extended: Cryptographic Operation (Random Bit Generation) (FCS_RBG_EXT.1) ..................57
6.1.3 User data protection (FDP)....................................................................................................................58
Subset access control (FDP_ACC.1) ............................................................................................58
Security attribute based access control (FDP_ACF.1)..................................................................58
Extended: Protection of Data on Disk (FDP_DSK_EXT.1) .........................................................60
Subset residual information protection (FDP_RIP.1(a))...............................................................60
6.1.4 Identification and authentication (FIA)..................................................................................................60
Authentication failure handling (FIA_AFL.1) ..............................................................................60
User attribute definition (FIA_ATD.1) .........................................................................................60
Extended: Password Management (FIA_PMG_EXT.1) ...............................................................61
Extended: Pre-shared key composition (FIA_PSK_EXT.1).........................................................61
Timing of authentication (FIA_UAU.1) .......................................................................................62
Protected authentication feedback (FIA_UAU.7).........................................................................62
Timing of identification (FIA_UID.1) ..........................................................................................63
User-subject binding (FIA_USB.1)...............................................................................................63
6.1.5 Security management (FMT).................................................................................................................65
Management of security functions behaviour (FMT_MOF.1)......................................................65
Management of security attributes (FMT_MSA.1).......................................................................66
Static attribute initialisation (FMT_MSA.3).................................................................................67
Management of TSF data (FMT_MTD.1) ....................................................................................67
Specification of Management Functions (FMT_SMF.1) ..............................................................68
Security roles (FMT_SMR.1) .......................................................................................................69
6.1.6 Protection of the TSF (FPT) ..................................................................................................................69
Extended: Protection of Key and Material (FPT_KYP_EXT.1)...................................................69
Extended: Protection of TSF data (FPT_SKP_EXT.1).................................................................69
Reliable time stamps (FPT_STM.1)..............................................................................................69
Extended: TSF testing (FPT_TST_EXT.1)...................................................................................69
Extended: Trusted Update (FPT_TUD_EXT.1) ...........................................................................69
6.1.7 TOE access (FTA) .................................................................................................................................70
TSF-initiated termination (FTA_SSL.3).......................................................................................70
6.1.8 Trusted path/channels (FTP)..................................................................................................................70
Inter-TSF trusted channel (FTP_ITC.1)........................................................................................70
Trusted path (for Administrators) (FTP_TRP.1(a)) ......................................................................70
Trusted path (for Non-administrators) (FTP_TRP.1(b))...............................................................71
6.2 Security Functional Requirements Rationale .............................................................................................71
6.2.1 Coverage................................................................................................................................................71
6.2.2 Sufficiency.............................................................................................................................................73
6.2.3 Security requirements dependency analysis ..........................................................................................78
6.2.4 HCDPP SFR reconciliation ...................................................................................................................83
6.3 Security Assurance Requirements..............................................................................................................85
6.4 Security Assurance Requirements Rationale..............................................................................................85
7 TOE Summary Specification ...........................................................................................................86
7.1 TOE Security Functionality .......................................................................................................................86
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 8 of 144
7.1.1 TOE SFR compliance rationale .............................................................................................................86
8 Abbreviations, Terminology and References ...............................................................................136
8.1 Abbreviations...........................................................................................................................................136
8.2 Terminology.............................................................................................................................................139
8.3 References................................................................................................................................................140
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 9 of 144
List of Tables
Table 1: TOE hardware and firmware reference .........................................................................................................14
Table 2: TOE English-guidance documentation reference..........................................................................................14
Table 3: TOE OS and processor ..................................................................................................................................14
Table 4: TOE cryptographic implementations.............................................................................................................18
Table 5: TOE authentication mechanisms and their supported interfaces...................................................................19
Table 6: NIAP TDs......................................................................................................................................................26
Table 7: Threats countered by the TOE.......................................................................................................................28
Table 8: Physical assumptions.....................................................................................................................................29
Table 9: Personnel assumptions...................................................................................................................................29
Table 10: Connectivity assumptions............................................................................................................................29
Table 11: Organizational security policies ..................................................................................................................30
Table 12: Security objectives for the TOE ..................................................................................................................31
Table 13: Security objectives for the operational environment ...................................................................................32
Table 14: Mapping of security objectives to threats and policies................................................................................32
Table 15: Mapping of security objectives for the Operational ....................................................................................33
Table 16: Sufficiency of objectives countering threats................................................................................................33
Table 17: Sufficiency of objectives holding assumptions ...........................................................................................34
Table 18: Sufficiency of objectives enforcing Organizational Security Policies.........................................................34
Table 19: Security functional requirements for the TOE.............................................................................................48
Table 20: Auditable events..........................................................................................................................................51
Table 21: Asymmetric key generation.........................................................................................................................52
Table 22: Symmetric key generation...........................................................................................................................53
Table 23: AES encryption/decryption algorithms .......................................................................................................53
Table 24: Asymmetric algorithms for signature generation/verification.....................................................................54
Table 25: Hash algorithms...........................................................................................................................................55
Table 26: HMAC algorithms.......................................................................................................................................56
Table 27: DRBG algorithms........................................................................................................................................57
Table 28: D.USER.DOC Access Control SFP.............................................................................................................58
Table 29: D.USER.JOB Access Control SFP..............................................................................................................59
Table 30: Management of functions ............................................................................................................................65
Table 31: Management of security attributes...............................................................................................................66
Table 32: Management of TSF Data............................................................................................................................67
Table 33: Specification of management functions.......................................................................................................68
Table 34: Mapping of security functional requirements to security objectives ...........................................................71
Table 35: Security objectives for the TOE rationale....................................................................................................73
Table 36: TOE SFR dependency analysis ...................................................................................................................78
Table 37: HCDPP SFRs excluded from the ST...........................................................................................................83
Table 38: Security assurance requirements..................................................................................................................85
Table 39: TSS index ....................................................................................................................................................86
Table 40: TOE SFR compliance rationale...................................................................................................................86
Table 41: TOE audit records........................................................................................................................................87
Table 42: Asymmetric key generation.........................................................................................................................94
Table 43: Symmetric key generation...........................................................................................................................94
Table 44: TOE key destruction....................................................................................................................................96
Table 45: AES algorithms ...........................................................................................................................................97
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 10 of 144
Table 46: Asymmetric algorithms for signature generation/verification .....................................................................98
Table 47: SHS algorithms..........................................................................................................................................100
Table 48: HMAC algorithms.....................................................................................................................................102
Table 49: DRBG algorithms......................................................................................................................................107
Table 50: IPsec client interfaces................................................................................................................................117
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 11 of 144
1 Introduction
1.1 Security Target Identification
Title: HP Color LaserJet Enterprise 5700,
HP Color LaserJet Enterprise 6700/6701,
HP Color LaserJet Enterprise X55745,
HP Color LaserJet Enterprise X65455/X65465
Security Target
Version: 1.0
Status: Final
Date: 2024-05-22
Sponsor: HP Inc.
Developer: HP Inc.
Certification Body: CSEC
Certification ID: CSEC2024001
Keywords: Common Criteria, HCD, HCDPP, Hardcopy Device, Color LaserJet, Color LaserJet
Enterprise, Color LaserJet Managed, 5700, 6700, 6701, X55745, X65455, X65465
1.2 TOE Identification
The TOE is the HP Color LaserJet Enterprise 5700, HP Color LaserJet Enterprise 6700/6701, HP Color LaserJet
Enterprise X55745, and HP Color LaserJet Enterprise X65455/X65465 printers with HP FutureSmart 5.7.1.1
Firmware. The complete list of models and firmware versions is provided in Table 1.
1.3 TOE Type
The TOE type is a hardcopy device (HCD) also known as a single-function printer (SFP).
1.4 TOE Overview
This document is the Common Criteria (CC) Security Target (ST) for the HP Inc. products listed in Section 1.2
evaluated as HCDs in compliance with the Protection Profile for Hardcopy Devices Version 1.0, dated September
10, 2015 [HCDPP].
The TOE is an HCD including internal firmware, but exclusive of non-security relevant options such as finishers.
The TOE also includes the English-language guidance documentation.
The following firmware modules are included in the TOE.
• System firmware
• Jetdirect Inside firmware
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 12 of 144
Both firmware modules run on top of the same Linux 4.9.230 operating system.
The System firmware controls all functionality except for the network-related functionality and functionality
implemented by the operating system. The Jetdirect Inside firmware controls the network-related functionality from
Ethernet to Internet Key Exchange (IKE). These firmware modules and the operating system are bundled into a
single installation bundle.
Several models of HCDs are included in this evaluation. Physically speaking, all models use the same ASIC and
processor. All models contain one field-replaceable, nonvolatile storage device. They all have a Control Panel for
operating the HCD locally and Ethernet network capability for connecting to a network. They all support the
submission of print jobs over the network and remote administration over the network. The main physical
differences between models are the number and size of paper feeders, print speed, the number of output bins, and
whether they contain a stapler/stacker.
A complete list of TOE models and firmware versions is provided in Section 1.5.1.
As per [HCDPP] Section 1.5, the major security functions in this evaluation are as follows.
• Identification, authentication, and authorization to use HCD functions
• Access control
• Data encryption (a.k.a. cryptography)
• Trusted communications
• Administrative roles
• Auditing
• Trusted operation
• Image overwrite
1.4.1 Required and Optional Hardware, Software, and Firmware
The following required components are part of the Operational Environment.
• A Domain Name System (DNS) server
• A Network Time Service (NTS) server
• One administrative client computer network connected to the TOE in the role of an Administrative
Computer. It must contain a web browser.
• One or both of the following:
o A Lightweight Directory Access Protocol (LDAP) server
o A Windows domain controller/Kerberos server
• A Syslog server
• A Windows Internet Name Service (WINS) server
The following optional components are part of the Operational Environment.
• Client computers network connected to the TOE in a non-administrative computer role
• HP Print Drivers, including the HP Universal Print Driver, for client computers (for submitting print job
requests from client computers)
• The following remote file systems:
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 13 of 144
o Server Message Block (SMB)
• A Simple Mail Transfer Protocol (SMTP) gateway
1.4.2 Intended Method of Use
This evaluation covers an information processing environment in which a basic level of document security, network
security, and security assurance are required.
The TOE is intended to be used in non-hostile, networked environments where TOE users have direct physical
access to the HCDs for storing and printing documents. The physical environment should be reasonably controlled
and/or monitored where physical tampering of the HCDs would be evident and noticed.
The TOE can be connected to multiple client computers via a local area network using the HCD’s Jetdirect Inside in
the evaluated configuration. The evaluated configuration uses secure network mechanisms for communication
between the network computers and the TOE. The TOE is managed by one designated administrative computer. The
TOE is not intended be connected to the Internet.
The following list contains the use cases found in [HCDPP] Section 1.4 "Security Use Cases of the HCD" supported
by the TOE.
• Required use cases
o Printing
o Configuration
o Auditing
o Verifying software updates
o Verifying HCD function
• Conditionally mandatory use cases
o Storing and retrieving documents
o Field-replaceable nonvolatile storage devices
• Optional use cases
o Image overwrite
1.5 TOE Description
This section contains a more detailed description of the TOE.
1.5.1 TOE Models and Firmware Versions
Table 1 shows the HCD models included in this evaluation. All HCD models require the installation of the HP
500GB CCC, FIPS Hard Disk Drive accessory (HP part #: 9EQ11A) prior to deployment. This accessory replaces
the field-replaceable nonvolatile storage drive with a field-replaceable, disk-based, self-encrypting drive (SED) that
is CC certified.
HP offers some printers as Configure to Order. One of the options within Configure to Order is the HP 500GB CCC,
FIPS Hard Disk Drive (HP part #: 4K3V7AV). If your printer was Configure to Order and included the HP 500GB
CCC, FIPS Hard Disk Drive, you do not need to purchase the 9EQ11A accessory.
All TOE models use the same Jetdirect Inside firmware version.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 14 of 144
1. JOL25077219
The TOE includes the following System firmware versions.
1. 2507252_046154
2. 2507252_046165
Table 1 includes a mapping of the System firmware versions to the TOE models.
Table 1: TOE hardware and firmware reference
Product model name Product
number
Speed
licenses
Product model name (Name
displayed in the EWS)
Option
codes
Qty of part
# 9EQ11A
required
System firmware
version
HP Color LaserJet
Enterprise 5700dn
6QN28A HP Color LaserJet 5700 All codes 1 2507252_046154
HP Color LaserJet
Enterprise X55745dn
6QP97A HP Color LaserJet X55745 All codes 1
HP Color LaserJet
Enterprise 6700dn
6QN33A HP Color LaserJet 6700 All codes 1 2507252_046165
HP Color LaserJet
Enterprise 6701dn
58M42A HP Color LaserJet 6701 All codes 1
HP Color LaserJet
Enterprise X654dn
6QQ00A HP Color LaserJet X65455 All codes 1
49L06AAE HP Color LaserJet X65465 All codes 1
Table 2 contains the TOE's English-guidance documentation reference.
Table 2: TOE English-guidance documentation reference
Models Title Reference
All models Common Criteria Evaluated Configuration Guide for HP Single-
function Printers
HP Color LaserJet Enterprise 5700,
HP Color LaserJet Enterprise 6700/6701,
HP Color LaserJet Enterprise X55745,
HP Color LaserJet Enterprise X65455/X65465
Edition 1, 6/2024
[CCECG]
Table 3 shows the operating system and processor used by all TOE models.
Table 3: TOE OS and processor
Item Type
OS Linux 4.9.230
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 15 of 144
Item Type
Processor ARM Cortex-A53
1.5.2 TOE Architecture
The TOE is designed to be shared by many client computers and human users. It performs the functions of printing
and storing of documents. It can be connected to a local network through the embedded Jetdirect Inside's built-in
Ethernet, or to a USB device using its USB port (but the use of which must be disabled in the evaluated
configuration except when the administrator performs trusted update via the USB).
[HCDPP] defines the TOE's physical boundary as the entire HCD product with the possible exclusion of physical
options and add-ons that are not security relevant. These exclusions include paper/media trays and feeders,
document feeders, output bins, and printer stands.
Operating system and processor
The TOE's operating system is Linux 4.9.230 running on an ARM Cortex-A53 processor.
Networking
The TOE supports Local Area Network (LAN) capabilities. The LAN is used to communicate with client
computers, the administrative computer, and several trusted IT entities. Some TOE models include support for
Wireless LAN (WLAN), but the WLAN must be disabled in the evaluated configuration.
The Linux operating system implements IPsec using its XFRM framework. The Jetdirect Inside firmware
implements Internet Key Exchange version 1 (IKEv1) and supports both pre-shared key (PSK) authentication and
X.509v3 certificate-based authentication. The TOE supports both Internet Protocol version 4 (IPv4) and Internet
Protocol version 6 (IPv6).
Administrative Computer and administrative interfaces
The Administrative Computer connects to the TOE using IPsec. This computer can administer the TOE using the
following interfaces over the IPsec connection.
• Embedded Web Server (EWS)
• Representational state transfer (REST) Web Services
EWS
The HTTP-based EWS administrative interface allows administrators to remotely manage the features of the TOE
using a web browser. This interface is protected using IPsec.
REST Web Services
The Web Services (WS) interfaces allow administrators to externally manage the TOE. The evaluated configuration
only supports the REST Web Services interface. The REST Web Services interface is protected using IPsec.
Administrative Computer and Network Client Computers
For design reasons, only one computer can be used as the Administrative Computer for the TOE in the evaluated
configuration. This computer is used for administration of the TOE. All other client computers connecting to the
TOE to perform non-administrative tasks are known as Network Client Computers in this ST.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 16 of 144
Network Client Computers connect to the TOE to submit print jobs to the TOE using the Printer Job Language (PJL)
interface. They can also receive job status from the TOE using PJL. The PJL interface connection is protected using
IPsec.
The [CCECG] section IPsec describes how to properly configure the TOE to allow a single Administrative
Computer and one or more Network Client Computers.
PJL
The PJL interface is used by unauthenticated users via Network Client Computers to submit print jobs and receive
job status (e.g., view the print queue). The unauthenticated users use PJL over an IPsec connection. It is also used in
a non-administrative capacity by the Administrative Computer. The Administrative Computer uses PJL over IPsec
to send print jobs to the TOE as well as to receive job status. In general, PJL supports password-protected
administrative commands, but in the evaluated configuration, these commands are disabled. For the purposes of this
Security Target, we define the PJL interface as PJL data sent to port 9100.
SMB
The TOE supports a remote file system for storing and retrieving backup files during Back up and Restore
operations. The TOE uses IPsec to protect the communication to the remote file system. For remote file system
connectivity, the TOE supports the SMB protocol.
SMTP mail server
The TOE can send email alert messages to administrator-specified email addresses, mobile devices, or to a website.
The TOE supports protected communications between itself and Simple Mail Transfer Protocol (SMTP) gateways.
It uses IPsec to protect the communication with the SMTP gateway. The TOE can only protect unencrypted email up
to the SMTP gateway. It is the responsibility of the Operational Environment to protect emails from the SMTP
gateway to the email’s destination. Also, the TOE can only send emails; it does not accept inbound emails.
Audit Server (syslog server)
The TOE supports the auditing of security-relevant functions by generating and forwarding audit records to an
external syslog server. It supports both internal and external storage of audit records. The TOE uses IPsec to protect
the communications between itself and the syslog server.
DNS, NTS, and WINS servers
The TOE requires a DNS server, an NTS server, and a WINS server in the Operational Environment. The TOE
connects to them over an IPsec connection.
Control Panel
Each HCD contains a user interface (UI) called the Control Panel. The Control Panel consists of a touchscreen LCD.
The Control Panel is the physical interface that a user uses to communicate with the TOE when physically using the
HCD. The LCD screen displays information such as menus and status to the user. It also provides virtual buttons to
the user such as an alphanumeric keypad for entering usernames and passwords. Both administrative and non-
administrative users can access the Control Panel.
Internal and External Authentication
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 17 of 144
Note: The terms Internal Authentication and External Authentication start with a capitalized first character to match
the [HCDPP] usage of these terms.
The TOE supports the following Internal Authentication mechanisms in the evaluated configuration.
• Local Device Sign In
The TOE supports the following External Authentication mechanisms in the evaluated configuration.
• LDAP Sign In
• Windows Sign In (i.e., Kerberos)
The TOE's guidance documents and firmware refer to the following mechanisms as sign-in methods: Local Device
Sign In, LDAP Sign In, and Windows Sign In. The Local Device Sign In method maintains the account information
within the TOE. Only the Device Administrator account, which is an administrative account, is supported through
this method in the evaluated configuration. The LDAP Sign In method supports the use of an external LDAP server
for authentication. The Windows Sign In method supports the use of an external Windows Domain server for
authentication.
Section 1.5.3.3 provides a mapping of authentication mechanisms to TOE interfaces.
Nonvolatile Storage
All TOE models contain one field-replaceable nonvolatile storage device. This storage device is a disk-based self-
encrypting drive (SED).
The disk drive contains a section called Job Storage which is a user-visible file system where user document data,
such as stored print, are located.
Firmware Components
The Jetdirect Inside firmware and System firmware components comprise the firmware on the system. Both of these
firmware components share the same operating system (Linux 4.9.230). These firmware components and the
operating system work together to provide the security functionality defined in this document for the TOE.
The Jetdirect Inside firmware provides the network connectivity and network device drivers used by the System
firmware. The Jetdirect Inside firmware includes IKE and the management functions for managing these network-
related features. It also provides the network stack and drivers controlling the TOE's embedded Ethernet interface.
The System firmware controls the overall functions of the TOE from the Control Panel to the storage drive to the
print jobs.
The operating system implements dm-verity, IPsec, and contains the HP FutureSmart Firmware Linux Kernel
Crypto API which implements cryptographic algorithms relied upon by TOE security functionality (i.e., IPsec).
1.5.3 TOE Security Functionality (TSF) Summary
Auditing
The TOE supports both internal and external storage of audit records. The evaluated configuration requires the use
of an external syslog server for external audit record storage. The connection between the TOE and the syslog server
is protected using IPsec. No unauthorized access to the audit records is allowed by the TOE.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 18 of 144
Data Encryption (a.k.a. cryptography)
1.5.3.2.1 IPsec
The TOE's IPsec supports both pre-shared keys (PSKs) and X.509v3 certificates for authentication, the
Encapsulating Security Payload (ESP), Internet Security Association and Key Management Protocol (ISAKMP),
Internet Key Exchange version 1 (IKEv1) protocol, and the following cryptographic algorithms: Diffie-Hellman
(DH), Digital Signature Algorithm (DSA), Rivest-Shamir-Adleman (RSA), Advanced Encryption Standard-Cipher
Block Chaining (AES-CBC), Advanced Encryption Standard-Electronic Code Book (AES-ECB), Secure Hash
Algorithm-based (SHA-based) Hashed Message Authentication Codes (HMACs), Public-Key Cryptography
Standards (PKCS) #1 v1.5 signature generation and verification, counter mode deterministic random bit generator
using AES (CTR_DRBG(AES)) for IKE negotiations, and HMAC_DRBG(HMAC-SHA2-256) deterministic
random bit generator for IPsec ESP.
It supports multiple DH groups, transport mode, and uses Main Mode for Phase 1 exchanges in IKEv1. The IKEv1
uses the DH ephemeral (dhEphem) scheme to implement the key agreement scheme finite field cryptography (KAS
FFC) algorithm when establishing a protected communication channel. DSA key generation is a prerequisite for
KAS FFC when using DH ephemeral. IKEv1 uses imported RSA-based X.509v3 certificates to authenticate the
connections. The RSA authentication is accomplished using the IKEv1 digital signature authentication method.
1.5.3.2.2 Drive-lock Password
For secure storage, all TOE models contain one field-replaceable, nonvolatile storage device. This storage device is
a disk-based, self-encrypting drive (SED).
The SED in the TOE uses the 256-bit "drive-lock password" as the border encryption value (BEV), which is used to
unlock the data on the drive. The BEV is generated by the TOE using a CTR_DRBG(AES) algorithm and is stored
as a key chain of one in non-field replaceable nonvolatile storage (SPI flash and EEPROM) located inside the TOE.
1.5.3.2.3 Digital Signatures for Trusted Update
The TOE uses digital signatures based on the RSA 2048-bit algorithm, SHA2-256 algorithm, and PKCS#1 v1.5 to
verify the authenticity of the signed update images. The TOE's EWS interface allows an administrator to verify and
install the signed update images.
1.5.3.2.4 Digital Signatures for TSF Testing
The TOE uses digital signatures as part of its TSF testing functionality. This is described in Section 1.5.3.7.
1.5.3.2.5 Cryptographic Implementations/Modules
The TOE uses multiple cryptographic implementations to accomplish its cryptographic functions. Table 4 provides
the complete list of cryptographic implementations used to satisfy the [HCDPP] cryptographic requirements and
maps the cryptographic implementations to the firmware modules.
Table 4: TOE cryptographic implementations
Cryptographic implementation Usage
HP FutureSmart Firmware OpenSSL 1.1.1 Drive-lock password (BEV) generation, TSF Testing,
Trusted Update
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 19 of 144
Cryptographic implementation Usage
HP FutureSmart Firmware QuickSec 7.3 Cryptographic
Module
IKE
HP FutureSmart Firmware Linux Kernel Crypto API IPsec
The field-replaceable SED also contains a cryptographic implementation within the drive called the "Seagate
Secure® TCG Opal SSC Self-Encrypting Drive." This implementation is based on the Trusted Computing Group's
(TCG) Opal Security Subsystem Class (SSC) specification. This implementation has been separately CC certified by
the SED's manufacturer. The cryptographic algorithms in this implementation are not claimed in this ST.
To prevent confusion with the new SHA3 standard, this ST replaces all occurrences of SHA-256, SHA-384, and
SHA-512 with SHA2-256, SHA2-384, and SHA2-512, respectively.
Identification, Authentication, and Authorization to Use HCD Functions
Table 5 shows the Internal and External Authentication mechanisms supported by the TOE in the evaluated
configuration and maps the mechanisms to the interfaces that use them. The PJL interface does not appear in this
table because the PJL interface does not perform authentication of users.
The following is a list of terms used in this ST.
Control Panel user
A user of the Control Panel UI.
EWS user
A user of the EWS interface, usually via a web browser.
PJL user
A user of the PJL network interface, used for submitting print jobs from a client computer.
REST user
A user of the REST network interface.
Table 5: TOE authentication mechanisms and their supported interfaces
Authentication type Mechanism name Supported interfaces
Internal Authentication Local Device Sign In Control Panel, EWS, REST
External Authentication LDAP Sign In Control Panel, EWS
Windows Sign In Control Panel, EWS, REST
1.5.3.3.1 Internal Authentication
1.5.3.3.1.1 Local Device Sign In
The Local Device Sign In method uses an internal user account database to authenticate users. The user accounts
contain the following user attributes used for identification and authentication (I&A).
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 20 of 144
• Display name
• Password
Although this method supports multiple accounts, only the built-in Device Administrator account (U.ADMIN) is to
be used with this method in the evaluated configuration. The administrator must not create any Local Device Sign In
accounts.
1.5.3.3.2 External Authentication
1.5.3.3.2.1 LDAP Sign In
The LDAP Sign In method supports the use of an LDAP server as an External Authentication mechanism. This
method uses the LDAP bind request to authenticate users. The bind request requires the user to provide a username
and password that matches a valid user account defined in the LDAP server for the bind request to be successful.
1.5.3.3.2.2 Windows Sign In
The Windows Sign In method supports the user of a Windows Domain server as an External Authentication
mechanism. The user must provide a valid Windows Domain username and password to be successfully logged in to
the TOE. This method is based on the Kerberos network protocol.
1.5.3.3.3 Control Panel I&A
The HCD has a Control Panel that allows a user to physically walk up to the HCD and select a function (e.g., print)
to be performed. The Control Panel supports the following Internal Authentication mechanism.
• Local Device Sign In
Only the Device Administrator account, which is a U.ADMIN account, is available for log in through the Local
Device Sign In method in the evaluated configuration. The user must select this account name and then enter the
Device Administrator's password in order to gain access. The Device Administrator's account name is generically
known as a Display name.
The Control Panel supports the following External Authentication mechanisms.
• LDAP Sign In
• Windows Sign In
Non-administrative users (U.NORMAL) as well as administrators can log in to the HCD through the Control Panel
using these External Authentication mechanisms.
The Control Panel allows a handful of actions (e.g., change the language, obtain help, select an authentication
mechanism, etc.) to be performed prior to identifying and authenticating a user.
The Control Panel uses permission sets (PSs) to determine user roles. The Internal Authentication mechanism has
one PS per user. The External Authentication mechanisms have one PS per authentication method, zero or one PS
per user, and zero or one PS per network group to which the user belongs. For additional details on the permission
sets, see the TOE Summary Specification (TSS) for FMT_SMR.1.
When users sign in through the Control Panel, a user's session permission bits are calculated based on several factors
and then bound to the user's session. For additional details on the permission bit calculations, see the TSS for
FIA_USB.1.
The Control Panel also supports an administratively configurable inactive session termination timeout.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 21 of 144
1.5.3.3.4 Network Interface I&A
The EWS, PJL, and REST interfaces are network protocols protected by IPsec. The EWS and REST interfaces
support one or more authentication mechanisms. These interfaces perform their I&A after the IPsec connection has
been established. The PJL interface is an unauthenticated interface (i.e., it does not perform I&A).
1.5.3.3.4.1 EWS I&A
The EWS interface is an administrative-only interface that supports the following authentication mechanisms.
• Internal Authentication mechanism
o Local Device Sign In
• External Authentication mechanisms
o LDAP Sign In
o Windows Sign In
The EWS interface allows the administrator to select the authentication mechanism (a.k.a. sign-in method) prior to
identifying and authenticating the user.
The EWS interface uses PSs to determine user roles. A user logging in to the EWS interface must have
administrative privileges in order to successfully log in. The Internal Authentication mechanism has one PS per user.
The External Authentication mechanisms have one PS per authentication method, zero or one PS per user, and zero
or one PS per network group to which the user belongs. For additional details on the permission sets, see the TSS for
FMT_SMR.1.
When users sign in through the EWS interface, a user's session permission bits are calculated based on several
factors and then bound to the user's session. For additional details on the permission bit calculations, see the TSS for
FIA_USB.1.
The EWS interface also supports an administratively configurable inactive session termination timeout.
1.5.3.3.4.2 REST I&A
The REST interface is an administrative-only interface that supports the following authentication mechanism.
• Internal Authentication mechanism
o Local Device Sign In
• External Authentication mechanism
o Windows Sign In
The TOE allows the following TSF-medicated actions prior to the REST I&A:
• Discover a subset of the Web Services
• Obtain X.509v3 certificate associated with the print engine
• Obtain configuration settings of the print engine
• Obtain list of installed licenses
• Install a digitally signed license
• Delete a license (if the license in the payload of the request is digitally signed)
• Obtain Web Services registration status
• Obtain printer Claim Code for Web Services registration
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 22 of 144
• Set printer Claim Code for Web Services registration
1.5.3.3.5 Authentication Failure Handling and Authentication Feedback
The following interfaces support authentication failure handling when using Internal Authentication mechanisms.
• Control Panel
• EWS
• REST
The following user interfaces support protected authentication feedback (i.e., the masking of passwords when being
entered during authentication).
• Control Panel
• EWS
Access Control
The TOE enforces access control on TSF data and User Data. Each piece of User Data is assigned ownership and
access to the data is limited by the access control mechanism. The PSs used to define roles also affect the access
control of each user. The access control mechanism for User Data is explained in more detail in the TSS for
FDP_ACF.1.
The TOE contains one field-replaceable nonvolatile storage device. This storage device is a disk-based SED whose
cryptographic functions have been CC certified. Together with the drive-lock password, the SED ensures that TSF
Data and User Data on the drive is not stored as plaintext.
Image Overwrite
The TOE also supports the optional Image Overwrite function (O.IMAGE_OVERWRITE) defined in [HCDPP].
[HCDPP] limits the scope of this function to a field-replaceable nonvolatile storage device.
The TOE refers to the image overwrite feature as "Managing Temporary Job Files." Although the TOE displays
three options for image overwrite, in the evaluated configuration the administrator must select one of the following
two options, both of which completely overwrite the user document data (i.e., file).
• Secure Fast Erase (overwrite 1 time)
• Secure Sanitize Erase (overwrite 3 times)
Trusted Communications
The TOE uses IPsec to protect the communications between the TOE and trusted IT entities as well as between the
TOE and client computers. IPsec provides assured identification of the endpoints. It implements IKEv1 and
transport mode. The TOE also supports both X.509v3 certificates and pre-shared keys (PSKs) for endpoint
authentication. For additional details on the TOE's IPsec features, see the TSS for FCS_IPSEC_EXT.1.
Administrative Roles
The TOE supports administrative and non-administrative roles. Assignment to these roles is controlled by the TOE's
administrator. In the case of a user authenticated using an External Authentication mechanism (Windows Sign In
and LDAP Sign In), the roles are implemented as permission sets. In the case of a user authenticated using an
Internal Authentication mechanism (Local Device Sign In), only an administrative account exists.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 23 of 144
In addition, the TOE provides security management capabilities for TOE functions, TSF data, and security attributes
as defined by this ST.
Trusted Operation
TOE updates can be downloaded from the HP Inc. website. These updates are digitally signed by the HCD
manufacturer using the RSA 2048-bit algorithm, SHA2-256 algorithm, and PKCS#1 v1.5 signature generation. The
TOE's EWS interface allows an administrator to install the update images. When installing an update image, the
TOE validates the digital signature of the update image before installing the update image. For additional details, see
the TSS for FPT_TUD_EXT.1.
The TOE contains TSF testing functionality referred to as Whitelisting to help ensure only authentic, known-good
firmware files that have not been tampered with are loaded into memory. The TOE supports dm-verity to protect the
integrity of the SquashFS file system firmware images. On each boot, the TOE verifies the digital signature of the
dm-verity hash tree corresponding to a SquashFS file system firmware image. During operation, dm-verity verifies
the integrity of a file system block before loading it into memory. The TOE uses digital signatures based on the RSA
2048-bit algorithm, SHA2-256 algorithm, and PKCS#1 v1.5 to verify the integrity of a dm-verity hash tree. For
additional details, see the TSS for FPT_TST_EXT.1.
1.5.4 TOE Boundaries
Physical Boundary
The physical boundary of the TOE is the physical boundary of the HCD product. Options and add-ons that are not
security relevant, such as finishers, are not part of the evaluation but can be added to the TOE without any security
implications.
Optional wireless add-ons are excluded from the TOE and are not part of the evaluation. Built-in wireless
capabilities are disabled in the evaluated configuration.
The firmware, [CCECG], and other supporting files are packaged in a single ZIP file (i.e., a file in ZIP archive file
format). This ZIP file is available for download from the HP Inc. website. The firmware is packaged in this ZIP file
as a single firmware bundle file. This firmware bundle contains two firmware modules.
• System firmware
• Jetdirect Inside firmware
The evaluated firmware module versions are provided in Table 1.
As seen in Table 1, there are multiple System firmware versions. Notice the first set of digits in the System firmware
versions are all the same, but the second set varies. The first set of digits represents the version of the OS and other
code that implement the security functions of the TOE. The second set of digits represents the drivers used to control
the physical features—paper trays, document feeders, and output bins—of the TOE. Because different sets of
models do not contain the exact same set of physical features, the second set of digits differs.
The consumer receives the hardware independent of the ZIP file. The evaluated hardware models, which are defined
in Table 1, are either already on the consumer's premises or must be obtained from HP Inc.
Logical Boundary
The security functionality provided by the TOE has been listed at the end of Section 1.5.3.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 24 of 144
Evaluated Configuration
The following items will need to be adhered to in the evaluated configuration.
• Only one Administrative Computer is used to manage the TOE.
• Third-party solutions must not be installed on the TOE.
• Device USB must be disabled.
• Host USB plug and play must be disabled.
• Firmware upgrades through any means other than the EWS (e.g., PJL) and USB must be disabled.
• HP Jetdirect XML Services must be disabled.
• External file system access through PJL and PS must be disabled.
• Only X.509v3 certificates and pre-shared key are supported methods for IPsec authentication (IPsec
authentication using Kerberos is not supported).
• IPsec Authentication Headers (AH) must be disabled.
• Control Panel Mandatory Sign-in must be enabled (this disables the Guest role).
• SNMP must be disabled.
• The Service PIN, used by a customer support engineer to access functions available to support personnel,
must be disabled.
• Wireless functionality must be disabled:
o Near Field Communication (NFC) must be disabled.
o Bluetooth Low Energy (BLE) must be disabled.
o Wireless Direct Print must be disabled.
o Wireless station must be disabled.
• PJL device access commands must be disabled.
• When using Windows Sign In, the Windows domain must reject Microsoft NT LAN Manager (NTLM)
connections.
• Remote Control-Panel use is disallowed.
• Local Device Sign In accounts must not be created (i.e., only the built-in Device Administrator account is
allowed as a Local Device Sign In account).
• Access must be blocked to the following Web Services (WS) using IPsec:
o Open Extensibility Platform device (OXPd) Web Services
o WS* Web Services
• Device Administrator Password must be set.
• Remote Configuration Password must not be set.
• OAUTH2 use is disallowed.
• SNMP over HTTP use is disallowed.
• HP Workpath Platform must be disabled.
• Licenses must not be installed to enable features beyond what is supported in the evaluated configuration.
• Firmware updates through REST Web Services is disallowed.
• PS privileged operators must be disabled.
• Cancel print jobs after unattended error must be enabled.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 25 of 144
• FIPS-140 must be disabled.
• Partial clean functionality of the TOE is disallowed.
• Smart Cloud Print must be disabled.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 26 of 144
2 CC Conformance Claim
This Security Target is CC Part 2 extended and CC Part 3 conformant.
This Security Target claims conformance to the following Protection Profiles and PP packages:
• [HCDPP]: Protection Profile for Hardcopy Devices; IPA, NIAP, and the MFP Technical Community.
Version 1.0 as of 2015-09-10; exact conformance.
• [HCDPP-ERRATA]: Protection Profile for Hardcopy Devices - v1.0, Errata #1, June 2017. Version 1.0 as
of 2017-06; exact conformance.
Common Criteria [CC] version 3.1 revision 5 is the basis for this conformance claim.
2.1 Protection Profile Tailoring and Additions
2.1.1 Protection Profile for Hardcopy Devices; IPA, NIAP, and the MFP
Technical Community ([HCDPP])
Table 6 contains the NIAP Technical Decisions (TDs) for this protection profile at the time of the evaluation and a
statement of applicability to the evaluation.
Table 6: NIAP TDs
NIAP TD TD description Applicability TD reference
TD0157 FCS_IPSEC_EXT.1.1 - Testing
SPDs
Applicable. The TOE includes IPsec. [CCEVS-TD0157]
TD0176 FDP_DSK_EXT.1.2 - SED Testing Applicable. The TOE includes a field-
replaceable SED.
[CCEVS-TD0176]
TD0219 NIAP Endorsement of Errata for
HCD PP v1.0
Applicable. [CCEVS-TD0219]
TD0253 Assurance Activities for Key
Transport
Not applicable. FCS_COP.1(i) is not
claimed.
[CCEVS-TD0253]
TD0261 Destruction of CSPs in flash Applicable. The TOE stores one or
more keys in flash memory.
[CCEVS-TD0261]
TD0299 Update to FCS_CKM.4 Assurance
Activities
Not applicable. The "a new value of a
key of the same size" is not selected in
FCS_CKM.4.
[CCEVS-TD0299]
TD0393 Require FTP_TRP.1(b) only for
printing
Not applicable. The TOE supports a
remote, non-administrative interface for
submitting print jobs to the TOE.
FTP_TRP.1(b) is claimed.
[CCEVS-TD0393]
TD0474 Removal of Mandatory Cipher Suite
in FCS_TLS_EXT.1
Not applicable. FCS_TLS_EXT.1 is not
claimed.
[CCEVS-TD0474]
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 27 of 144
NIAP TD TD description Applicability TD reference
TD0494 Removal of Mandatory SSH
Ciphersuite for HCD
Not applicable. FCS_SSH_EXT.1.7 is
not claimed.
[CCEVS-TD0494]
TD0562 Test activity for Public Key
Algorithms
Not applicable. FCS_SSH_EXT.1.5 is
not claimed.
[CCEVS-TD0562]
TD0642 FCS_CKM.1.1(a) and
FCS_COP.1.1(b) Requirements in
HCD PP v1.0
Applicable. [CCEVS-TD0642]
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 28 of 144
3 Security Problem Definition
3.1 Threat Environment
The Security Problem Definition (SPD) is delivered into two parts. This first part describes Assets, Threats, and
Organizational Security Policies, in narrative form. [Brackets] indicate a reference to the second part, formal
definitions of Users, Assets, Threats, Organizational Security Policies, and Assumptions, which appear in Appendix
A of [HCDPP].
Users
A conforming TOE must define at least the following two User roles:
1. Normal Users [U.NORMAL] who are identified and authenticated and do not have an administrative role.
2. Administrators [U.ADMIN] who are identified and authenticated and have an administrative role.
A conforming TOE may allow additional roles, sub-roles, or groups. In particular, a conforming TOE may allow
several administrative roles that have authority to administer different aspects of the TOE.
Assets
For a User's perspective, the primary Asset to be protected in a TOE is User Document Data [D.USER.DOC]. A
User's job instructions, User Job Data [D.USER.JOB] (information related to a User's Document or Document
Processing Job), may also be protected if their compromise impacts the protection of User Document Data.
Together, User Document Data and User Job Data are considered to be User Data.
From an Administrator's perspective, the primary Asset to be protected in a TOE is data that is used to configure and
monitor the secure operation of the TOE. This kind of data is considered to be TOE Security Functionality (TSF)
Data.
There are two broad categories for this kind of data:
1. Protected TSF Data, which may be read by any User but must be protected from unauthorized modification
and deletion [D.TSF.PROT]; and,
2. Confidential TSF Data, which may neither be read nor modified or deleted except by authorized Users
[D.TSF.CONF].
3.1.1 Threats Countered by the TOE
Table 7: Threats countered by the TOE
Threat Description
T.UNAUTHORIZED_ACCESS An attacker may access (read, modify, or delete) User Document Data or
change (modify or delete) User Job Data in the TOE through one of the
TOE’s interfaces.
T.TSF_COMPROMISE An attacker may gain Unauthorized Access to TSF Data in the TOE
through one of the TOE’s interfaces.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 29 of 144
Threat Description
T.TSF_FAILURE A malfunction of the TSF may cause loss of security if the TOE is
permitted to operate while in a degraded state.
T.UNAUTHORIZED_UPDATE An attacker may cause the installation of unauthorized software on the
TOE.
T.NET_COMPROMISE An attacker may access data in transit or otherwise compromise the
security of the TOE by monitoring or manipulating network
communication.
3.2 Assumptions
3.2.1 Environment of Use of the TOE
Physical
Table 8: Physical assumptions
Assumption Description
A.PHYSICAL Physical security, commensurate with the value of the TOE and the data it
stores or processes, is assumed to be provided by the environment.
Personnel
Table 9: Personnel assumptions
Assumption Description
A.TRUSTED_ADMIN TOE Administrators are trusted to administer the TOE according to site
security policies.
A.TRAINED_USERS Authorized Users are trained to use the TOE according to site security
policies.
Connectivity
Table 10: Connectivity assumptions
Assumption Description
A.NETWORK The Operational Environment is assumed to protect the TOE from direct,
public access to its LAN interface.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 30 of 144
3.3 Organizational Security Policies
Table 11: Organizational security policies
Organizational security policy Description
P.AUTHORIZATION Users must be authorized before performing Document Processing and
administrative functions.
P.AUDIT Security-relevant activities must be audited and the log of such actions
must be protected and transmitted to an External IT Entity.
P.COMMS_PROTECTION The TOE must be able to identify itself to other devices on the LAN.
P.STORAGE_ENCRYPTION If the TOE stores User Document Data or Confidential TSF Data on Field-
Replaceable Nonvolatile Storage Devices, it will encrypt such data on
those devices.
P.KEY_MATERIAL Cleartext keys, submasks, random numbers, or any other values that
contribute to the creation of encryption keys for Field-Replaceable
Nonvolatile Storage of User Document Data or Confidential TSF Data
must be protected from unauthorized access and must not be stored on that
storage device.
P.IMAGE_OVERWRITE Upon completion or cancellation of a Document Processing job, the TOE
shall overwrite residual image data from its Field-Replaceable Nonvolatile
Storage Device.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 31 of 144
4 Security Objectives
4.1 Objectives for the TOE
Table 12: Security objectives for the TOE
Security objective Description
O.USER_I&A The TOE shall perform identification and authentication of Users for
operations that require access control, User authorization, or Administrator
roles.
O.ACCESS_CONTROL The TOE shall enforce access controls to protect User Data and TSF Data
in accordance with security policies.
O.USER_AUTHORIZATION The TOE shall perform authorization of Users in accordance with security
policies.
O.ADMIN_ROLES The TOE shall ensure that only authorized Administrators are permitted to
perform administrator functions.
O.UPDATE_VERIFICATION The TOE shall provide mechanisms to verify the authenticity of software
updates.
O.TSF_SELF_TEST The TOE shall test some subset of its security functionality to help ensure
that subset is operating properly.
O.COMMS_PROTECTION The TOE shall have the capability to protect LAN communications of User
Data and TSF Data from Unauthorized Access, replay, and
source/destination spoofing.
O.AUDIT The TOE shall generate audit data, and be capable of sending it to a trusted
External IT Entity. Optionally, it may store audit data in the TOE.
O.STORAGE_ENCRYPTION If the TOE stores User Document Data or Confidential TSF Data in Field-
Replaceable Nonvolatile Storage devices, then the TOE shall encrypt such
data on those devices.
O.KEY_MATERIAL The TOE shall protect from unauthorized access any cleartext keys,
submasks, random numbers, or other values that contribute to the creation
of encryption keys for storage of User Document Data or Confidential TSF
Data in Field-Replaceable Nonvolatile Storage Devices; The TOE shall
ensure that such key material is not stored in cleartext on the storage
device that uses that material.
O.IMAGE_OVERWRITE Upon completion or cancellation of a Document Processing job, the TOE
shall overwrite residual image data from its Field-Replaceable Nonvolatile
Storage Devices.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 32 of 144
4.2 Objectives for the Operational Environment
Table 13: Security objectives for the operational environment
Security objective Description
OE.PHYSICAL_PROTECTION The Operational Environment shall provide physical security,
commensurate with the value of the TOE and the data it stores or
processes.
OE.NETWORK_PROTECTION The Operational Environment shall provide network security to protect the
TOE from direct, public access to its LAN interface.
OE.ADMIN_TRUST The TOE Owner shall establish trust that Administrators will not use their
privileges for malicious purposes.
OE.USER_TRAINING The TOE Owner shall ensure that Users are aware of site security policies
and have the competence to follow them.
OE.ADMIN_TRAINING The TOE Owner shall ensure that Administrators are aware of site security
policies and have the competence to use manufacturer’s guidance to
correctly configure the TOE and protect passwords and keys accordingly.
4.3 Security Objectives Rationale
4.3.1 Coverage
The following table provides a mapping of TOE objectives to threats and policies, showing that each objective
counters or enforces at least one threat or policy, respectively.
Table 14: Mapping of security objectives to threats and policies
Objective Threats/OSPs
O.USER_I&A T.UNAUTHORIZED_ACCESS
T.TSF_COMPROMISE
P.AUTHORIZATION
O.ACCESS_CONTROL T.UNAUTHORIZED_ACCESS
T.TSF_COMPROMISE
P.AUDIT
O.USER_AUTHORIZATION P.AUTHORIZATION
P.AUDIT
O.ADMIN_ROLES T.UNAUTHORIZED_ACCESS
T.TSF_COMPROMISE
P.AUTHORIZATION
O.UPDATE_VERIFICATION T.UNAUTHORIZED_UPDATE
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 33 of 144
Objective Threats/OSPs
O.TSF_SELF_TEST T.TSF_FAILURE
O.COMMS_PROTECTION T.NET_COMPROMISE
P.COMMS_PROTECTION
O.AUDIT P.AUDIT
O.STORAGE_ENCRYPTION P.STORAGE_ENCRYPTION
O.KEY_MATERIAL P.KEY_MATERIAL
O.IMAGE_OVERWRITE P.IMAGE_OVERWRITE
The following table provides a mapping of the objectives for the Operational Environment to assumptions, threats
and policies, showing that each objective holds, counters or enforces at least one assumption, threat or policy,
respectively.
Table 15: Mapping of security objectives for the Operational
Environment to assumptions, threats and policies
Objective Assumptions/Threats/OSPs
OE.PHYSICAL_PROTECTION A.PHYSICAL
OE.NETWORK_PROTECTION A.NETWORK
OE.ADMIN_TRUST A.TRUSTED_ADMIN
OE.USER_TRAINING A.TRAINED_USERS
OE.ADMIN_TRAINING A.TRAINED_USERS
4.3.2 Sufficiency
The following rationale provides justification that the security objectives are suitable to counter each individual
threat and that each security objective tracing back to a threat, when achieved, actually contributes to the removal,
diminishing or mitigation of that threat.
Table 16: Sufficiency of objectives countering threats
Threat Rationale for security objectives
T.UNAUTHORIZED_ACCESS O.ACCESS_CONTROL restricts access to User Data in the TOE to
authorized Users.
O.USER_I&A provides the basis for access control.
O.ADMIN_ROLES restricts the ability to authorize Users and set access
controls to authorized Administrators.
T.TSF_COMPROMISE O.ACCESS_CONTROL restricts access to User Data in the TOE to
authorized Users.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 34 of 144
Threat Rationale for security objectives
O.USER_I&A provides the basis for access control.
O.ADMIN_ROLES restricts the ability to authorize Users and set access
controls to authorized Administrators.
T.TSF_FAILURE O.TSF_SELF_TEST prevents the TOE from operating if a malfunction is
detected.
T.UNAUTHORIZED_UPDATE O.UPDATE_VERIFICATION verifies the authenticity of software updates.
T.NET_COMPROMISE O.COMMS_PROTECTION protects LAN communications from sniffing,
replay, and man-in-the-middle attacks.
The following rationale provides justification that the security objectives for the environment are suitable to cover
each individual assumption, that each security objective for the environment that traces back to an assumption about
the environment of use of the TOE, when achieved, actually contributes to the environment achieving consistency
with the assumption, and that if all security objectives for the environment that trace back to an assumption are
achieved, the intended usage is supported.
Table 17: Sufficiency of objectives holding assumptions
Assumption Rationale for security objectives
A.PHYSICAL OE.PHYSICAL_PROTECTION establishes a protected physical
environment for the TOE.
A.TRUSTED_ADMIN OE.ADMIN_TRUST establishes responsibility of the TOE Owner to have a
trusted relationship with Administrators.
A.TRAINED_USERS OE.ADMIN_TRAINING establishes responsibility of the TOE Owner
to provide appropriate training for Administrators.
OE.USER_TRAINING establishes responsibility of the TOE Owner to
provide appropriate training for Users.
A.NETWORK OE.NETWORK_PROTECTION establishes a protected LAN environment
for the TOE.
The following rationale provides justification that the security objectives are suitable to cover each individual
organizational security policy (OSP), that each security objective that traces back to an OSP, when achieved,
actually contributes to the implementation of the OSP, and that if all security objectives that trace back to an OSP
are achieved, the OSP is implemented.
Table 18: Sufficiency of objectives enforcing Organizational Security Policies
OSP Rationale for security objectives
P.AUTHORIZATION O.USER_AUTHORIZATION restricts the ability to perform Document
Processing and administrative functions to authorized Users.
O.USER_I&A provides the basis for authorization.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 35 of 144
OSP Rationale for security objectives
O.ADMIN_ROLES restricts the ability to authorize Users to authorized
Administrators.
P.AUDIT O.AUDIT requires the generation of audit data.
O.ACCESS_CONTROL restricts access to audit data in the TOE to
authorized Users.
O.USER_AUTHORIZATION provides the basis for authorization.
P.COMMS_PROTECTION O.COMMS_PROTECTION protects LAN communications from man-in-
the-middle attacks.
P.STORAGE_ENCRYPTION O.STORAGE_ENCRYPTION protects User Document Data and
Confidential TSF Data stored in Field-Replaceable Nonvolatile Storage
Devices from exposure if a device has been removed from the TOE and its
Operational Environment.
P.KEY_MATERIAL O.KEY_MATERIAL protects keys and key materials from unauthorized
access and ensures that they any key materials are not stored in cleartext on
the device that uses those materials for its own encryption.
P.IMAGE_OVERWRITE O.IMAGE_OVERWRITE overwrites residual image data from Field-
Replaceable Nonvolatile Storage Devices after Document Processing jobs
are completed or cancelled.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 36 of 144
5 Extended Components Definition
All the extended components definitions in this section are from [HCDPP]. Only the [HCDPP] extended
components definitions used by this ST are listed in this section.
5.1 Class FAU: Security Audit
5.1.1 Extended: External Audit Trail Storage (FAU_STG)
Family behaviour
This family defines requirements for the TSF to ensure that secure transmission of audit data from TOE to an
External IT Entity.
Component leveling
FAU_STG_EXT.1.1 The TSF shall be able to transmit the generated audit data to an External IT Entity using a
trusted channel according to FTP_ITC.1.
Management: FAU_STG_EXT.1
The following actions could be considered for the management functions in FMT:
a) The TSF shall have the ability to configure the cryptographic functionality.
Audit: FAU_STG_EXT.1
There are no audit events foreseen.
FAU_STG_EXT.1 - Extended: Protected Audit Trail Storage
Hierarchical to: No other components
Dependencies: FAU_GEN.1 Audit data generation
FTP_ITC.1 Inter-TSF trusted channel
FAU_STG_EXT.1.1 The TSF shall be able to transmit the generated audit data to an External IT Entity using a
trusted channel according to FTP_ITC.1.
Rationale The TSF is required that the transmission of generated audit data to an External IT Entity
which relies on a non-TOE audit server for storage and review of audit records. The
storage of these audit records and the ability to allow the administrator to review these
audit records is provided by the Operational Environment in that case. The Common
Criteria does not provide a suitable SFR for the transmission of audit data to an External
IT Entity.
This extended component protects the audit records, and it is therefore placed in the FAU
class with a single component.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 37 of 144
5.2 Class FCS: Cryptographic Support
5.2.1 Cryptographic Key Management (FCS_CKM)
Family behaviour
This family addresses the management aspects of cryptographic keys. Especially, this extended component is
intended for cryptographic key destruction.
Component leveling
FCS_CKM_EXT.4 Cryptographic Key Material Destruction ensures not only keys but also key materials that are no
longer needed are destroyed by using an approved method.
Management: FCS_CKM_EXT.4
There are no management activities foreseen.
Audit: FCS_CKM_EXT.4
There are no audit events foreseen.
FCS_CKM_EXT.4 - Extended: Cryptographic Key Material Destruction
Hierarchical to: No other components
Dependencies: FCS_CKM.1 Cryptographic key generation
FCS_CKM.4 Cryptographic key destruction
FCS_CKM_EXT.4.1 The TSF shall destroy all plaintext secret and private cryptographic keys and
cryptographic critical security parameters when no longer needed.
Rationale Cryptographic Key Material Destruction is to ensure the keys and key materials that are
no longer needed are destroyed by using an approved method, and the Common Criteria
does not provide a suitable SFR for the Cryptographic Key Material Destruction.
This extended component protects the cryptographic key and key materials against
exposure, and it is therefore placed in the FCS class with a single component.
5.2.2 Extended: IPsec selected (FCS_IPSEC)
Family behaviour
This family addresses requirements for protecting communications using IPsec.
Component leveling
FCS_IPSEC_EXT.1 IPsec requires that IPsec be implemented as specified.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 38 of 144
Management: FCS_IPSEC_EXT.1
There are no management activities foreseen.
Audit: FCS_IPSEC_EXT.1
The following actions should be auditable if FAU_GEN Security audit data generation is included in the PP/ST:
a) Minimal: Failure to establish an IPsec SA.
FCS_IPSEC_EXT.1 – Extended: IPsec selected
Hierarchical to: No other components
Dependencies: FIA_PSK_EXT.1 Extended: Pre-Shared Key Composition
FCS_CKM.1 Cryptographic key generation
FCS_COP.1 Cryptographic operation
FCS_RBG_EXT.1 Extended: Random Bit Generation
FCS_IPSEC_EXT.1.1 The TSF shall implement the IPsec architecture as specified in RFC 4301.
FCS_IPSEC_EXT.1.2 The TSF shall implement [selection: tunnel mode, transport mode].
FCS_IPSEC_EXT.1.3 The TSF shall have a nominal, final entry in the SPD that matches anything that is
otherwise unmatched, and discards it.
FCS_IPSEC_EXT.1.4 The TSF shall implement the IPsec protocol ESP as defined by RFC 4303 using
[selection: the cryptographic algorithms AES-CBC-128 (as specified by RFC 3602)
together with a Secure Hash Algorithm (SHA)-based HMAC, AES-CBC-256 (as
specified by RFC 3602) together with a Secure Hash Algorithm (SHA)-based
HMAC, AES-GCM-128 as specified in RFC 4106, AES-GCM-256 as specified in
RFC 4106].
FCS_IPSEC_EXT.1.5 The TSF shall implement the protocol: [selection: IKEv1, using Main Mode for Phase
1 exchanges, as defined in RFCs 2407, 2408, 2409, RFC 4109, [selection: no other
RFCs for extended sequence numbers, RFC 4304 for extended sequence numbers]
and [selection: no other RFCs for hash functions, RFC 4868 for hash functions],
IKEv2 as defined in RFCs 5996 [selection: with no support for NAT traversal, with
mandatory support for NAT traversal as specified in section 2.23] and [selection: no
other RFCs for hash functions, RFC 4868 for hash functions]].
FCS_IPSEC_EXT.1.6 The TSF shall ensure the encrypted payload in the [selection: IKEv1, IKEv2] protocol
uses the cryptographic algorithms AES-CBC-128, Protection Profile for Hardcopy
Devices – v1.0 September 10, 2015 Page 112 AES-CBC-256 as specified in RFC 3602
and [selection: AES-GCM-128, AES-GCM-256 as specified in RFC 5282, no other
algorithm].
FCS_IPSEC_EXT.1.7 The TSF shall ensure that IKEv1 Phase 1 exchanges use only main mode.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 39 of 144
FCS_IPSEC_EXT.1.8 The TSF shall ensure that [selection: IKEv2 SA lifetimes can be established based on
[selection: number of packets/number of bytes, length of time, where the time values
can be limited to: 24 hours for Phase 1 SAs and 8 hours for Phase 2 SAs], IKEv1 SA
lifetimes can be established based on [selection: number of packets/number of bytes,
length of time, where the time values can be limited to: 24 hours for Phase 1 SAs
and 8 hours for Phase 2 SAs]].
FCS_IPSEC_EXT.1.9 The TSF shall ensure that all IKE protocols implement DH Groups 14 (2048-bit MODP),
and [selection: 24 (2048-bit MODP with 256-bit POS), 19 (256-bit Random ECP), 20
(384-bit Random ECP, 5 (1536-bit MODP)), [assignment: other DH groups that are
implemented by the TOE], no other DH groups].
FCS_IPSEC_EXT.1.10The TSF shall ensure that all IKE protocols perform Peer Authentication using the
[selection: RSA, ECDSA] algorithm and Pre-shared Keys
Rationale IPsec is one of the secure communication protocols, and the Common Criteria does not
provide a suitable SFR for the communication protocols using cryptographic algorithms.
This extended component protects the communication data using cryptographic
algorithms, and it is therefore placed in the FCS class with a single component.
5.2.3 Extended: Cryptographic Operation (Key Chaining) (FCS_KYC)
Family behaviour
This family provides the specification to be used for using multiple layers of encryption keys to ultimately secure
the protected data encrypted on the storage.
Component leveling
FCS_KYC_EXT Key Chaining, requires the TSF to maintain a key chain and specifies the characteristics of that
chain.
Management: FCS_KYC_EXT.1
There are no management activities foreseen.
Audit: FCS_KYC_EXT.1
There are no audit events foreseen.
FCS_KYC_EXT.1 – Extended: Key Chaining
Hierarchical to: No other components
Dependencies: [FCS_COP.1(e) Cryptographic operation (Key Wrapping), FCS_SMC_EXT.1 Extended:
Submask Combining, FCS_COP.1(i) Cryptographic operation (Key Transport),
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 40 of 144
FCS_KDF_EXT.1 Cryptographic Operation (Key Derivation), and/or FCS_COP.1(f)
Cryptographic operation (Key Encryption)]
FCS_KYC_EXT.1.1 The TSF shall maintain a key chain of: [selection: one, using a submask as the BEV or
DEK, intermediate keys originating from one or more submask(s) to the BEV or
DEK using the following method(s): [selection: key wrapping as specified in
FCS_COP.1(e), key combining as specified in FCS_SMC_EXT.1, key encryption as
specified in FCS_COP.1(f), key derivation as specified in FCS_KDF_EXT.1, key
transport as specified in FCS_COP.1(i)]] while maintaining an effective strength of
[selection: 128 bits, 256 bits].
Rationale Key Chaining ensures that the TSF maintains the key chain, and also specifies the
characteristics of that chain. However, the Common Criteria does not provide a suitable
SFR for the management of multiple layers of encryption key to protect encrypted data.
This extended component protects the TSF data using cryptographic algorithms, and it is
therefore placed in the FCS class with a single component.
5.2.4 Extended: Cryptographic Operation (Random Bit Generation)
(FCS_RBG)
Family behaviour
This family defines requirements for random bit generation to ensure that it is performed in accordance with selected
standards and seeded by an entropy source.
Component leveling
FCS_RBG_EXT.1 Random Bit Generation requires random bit generation to be performed in accordance with
selected standards and seeded by an entropy source.
Management: FCS_RBG_EXT.1
There are no management activities foreseen.
Audit: FCS_RBG_EXT.1
There are no audit events foreseen.
FCS_RBG_EXT.1 – Extended: Random Bit Generation
Hierarchical to: No other components
Dependencies: No dependencies
FCS_RBG_EXT.1.1 The TSF shall perform all deterministic random bit generation services in accordance
with [selection: ISO/IEC 18031:2011, NIST SP 800-90A] using [selection:
Hash_DRBG (any), HMAC_DRBG (any), CTR_DRBG (AES)].
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 41 of 144
FCS_RBG_EXT.1.2 The deterministic RBG shall be seeded by an entropy source that accumulates entropy
from [selection: [assignment: number of software-based sources] software-based
noise source(s), [assignment: number of hardware-based sources] hardware-based
noise source(s)] with a minimum of [selection: 128 bits, 256 bits] of entropy at least
equal to the greatest security strength, according to ISO/IEC 18031:2011 Table C.1
"Security strength table for hash functions", of the keys and hashes that it will generate.
Rationale Random bits/number will be used by the SFRs for key generation and destruction, and the
Common Criteria does not provide a suitable SFR for the random bit generation.
This extended component ensures the strength of encryption keys, and it is therefore
placed in the FCS class with a single component.
5.3 Class FDP: User Data Protection
5.3.1 Extended: Protection of Data on Disk (FDP_DSK)
Family behaviour
This family is to mandate the encryption of all protected data written to the storage.
Component leveling
FDP_DSK_EXT.1 Extended: Protection of Data on Disk, requires the TSF to encrypt all the Confidential TSF and
User Data stored on the Field-Replaceable Nonvolatile Storage Devices in order to avoid storing these data in
plaintext on the devices.
Management: FDP_DSK_EXT.1
There are no management activities foreseen.
Audit: FDP_DSK_EXT.1
There are no audit events foreseen.
FDP_DSK_EXT.1 – Extended: Protection of Data on Disk
Hierarchical to: No other components
Dependencies: FCS_COP.1 Cryptographic operation
FDP_DSK_EXT.1.1 The TSF shall be [selection: perform encryption in accordance with FCS_COP.1(d),
use a self-encrypting Field-Replaceable Nonvolatile Storage Device that is separately
CC certified to conform to the FDE EE cPP] such that any Field-Replaceable
Nonvolatile Storage Device contains no plaintext User Document Data and no plaintext
confidential TSF Data.
FDP_DSK_EXT.1.2 The TSF shall encrypt all protected data without user intervention.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 42 of 144
Rationale Extended: Protection of Data on Disk is to specify that encryption of any confidential
data without user intervention, and the Common Criteria does not provide a suitable SFR
for the Protection of Data on Disk.
This extended component protects the Data on Disk, and it is therefore placed in the FDP
class with a single component.
5.4 Class FIA: Identification and Authentication
5.4.1 Extended: Password Management (FIA_PMG)
Family behaviour
This family defines requirements for the attributes of passwords used by administrative users to ensure that strong
passwords and passphrases can be chosen and maintained.
Component leveling
FIA_PMG_EXT.1 Password management requires the TSF to support passwords with varying composition
requirements, minimum lengths, maximum lifetime, and similarity constraints.
Management: FIA_PMG_EXT.1
There are no management activities foreseen.
Audit: FIA_PMG_EXT.1
There are no audit events foreseen.
FIA_PMG_EXT.1 – Extended: Password Management
Hierarchical to: No other components
Dependencies: No dependencies
FIA_PMG_EXT.1.1 The TSF shall provide the following password management capabilities for User
passwords:
• Passwords shall be able to be composed of any combination of upper and lower
case letters, numbers, and the following special characters [selection: "!", "@",
"#", "$", "%", "^", "&", "*", "(", ")", [assignment: other characters]]
• Minimum password length shall be settable by an Administrator, and have the
capability to require passwords of 15 characters or greater.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 43 of 144
Rationale Password Management is to ensure the strong authentication between the endpoints of
communication, and the Common Criteria does not provide a suitable SFR for the
Password Management.
This extended component protects the TOE by means of password management, and it is
therefore placed in the FIA class with a single component.
5.4.2 Extended: Pre-Shared Key Composition (FIA_PSK)
Family behaviour
This family defines requirements for the TSF to ensure the ability to use pre-shared keys for IPsec.
Component leveling
FIA_PSK_EXT.1 Pre-Shared Key Composition, ensures authenticity and access control for updates.
Management: FIA_PSK_EXT.1
There are no management activities foreseen.
Audit: FIA_PSK_EXT.1
There are no audit events foreseen.
FIA_PSK_EXT.1 – Extended: Pre-Shared Key Composition
Hierarchical to: No other components
Dependencies: FCS_RBG_EXT.1 Extended: Random Bit Generation
FIA_PSK_EXT.1.1 The TSF shall be able to use pre-shared keys for IPsec.
FIA_PSK_EXT.1.2 The TSF shall be able to accept text-based pre-shared keys that are:
• 22 characters in length and [selection: [assignment: other supported lengths],
no other lengths]
• composed of any combination of upper and lower case letters, numbers, and
special characters (that include: "!", "@", "#", "$", "%", "^", "&", "*", "(", and
")").
FIA_PSK_EXT.1.3 The TSF shall condition the text-based pre-shared keys by using [selection: SHA-1,
SHA2-256, SHA2-512, [assignment: method of conditioning text string]] and be able
to [selection: use no other pre-shared keys, accept bit-based pre-shared keys,
generate bit-based pre-shared keys using the random bit generator specified in
FCS_RBG_EXT.1].
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 44 of 144
Rationale Pre-shared Key Composition is to ensure the strong authentication between the endpoints
of communications, and the Common Criteria does not provide a suitable SFR for the
Pre-shared Key Composition.
This extended component protects the TOE by means of strong authentication, and it is
therefore placed in the FIA class with a single component.
5.5 Class FPT: Protection of the TSF
5.5.1 Extended: Protection of Key and Key Material (FPT_KYP)
Family behaviour
This family addresses the requirements for keys and key materials to be protected if and when written to nonvolatile
storage.
Component leveling
FPT_KYP_EXT.1 Extended: Protection of key and key material, requires the TSF to ensure that no plaintext key or
key materials are written to nonvolatile storage.
Management: FPT_KYP_EXT.1
There are no management activities foreseen.
Audit: FPT_KYP_EXT.1
There are no audit events foreseen.
FPT_KYP_EXT.1 – Extended: Protection of Key and Key Material
Hierarchical to: No other components
Dependencies: No dependencies
FPT_KYP_EXT.1.1 The TSF shall not store plaintext keys that are part of the keychain specified by
FCS_KYC_EXT.1 in any Field-Replaceable Nonvolatile Storage Device, and not store
any such plaintext key on a device that uses the key for its encryption.
Rationale Protection of Key and Key Material is to ensure that no plaintext key or key material are
written to nonvolatile storage, and the Common Criteria does not provide a suitable SFR
for the protection of key and key material.
This extended component protects the TSF data, and it is therefore placed in the FPT
class with a single component.
5.5.2 Extended: Protection of TSF Data (FPT_SKP)
Family behaviour
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 45 of 144
This family addresses the requirements for managing and protecting the TSF data, such as cryptographic keys. This
is a new family modelled as the FPT Class.
Component leveling
FPT_SKP_EXT.1 Protection of TSF Data (for reading all symmetric keys), requires preventing symmetric keys
from being read by any user or subject. It is the only component of this family.
Management: FPT_SKP_EXT.1
There are no management activities foreseen.
Audit: FPT_SKP_EXT.1
There are no audit events foreseen.
FPT_SKP_EXT.1 – Extended: Protection of TSF Data
Hierarchical to: No other components
Dependencies: No dependencies
FPT_SKP_EXT.1.1 The TSF shall prevent reading of all pre-shared keys, symmetric keys, and private keys.
Rationale Protection of TSF Data is to ensure the pre-shared keys, symmetric keys and private keys
are protected securely, and the Common Criteria does not provide a suitable SFR for the
protection of such TSF data.
This extended component protects the TOE by means of strong authentication using Pre-
shared Key, and it is therefore placed in the FPT class with a single component.
5.5.3 Extended: TSF Testing (FPT_TST)
Family behaviour
This family addresses the requirements for self-testing the TSF for selected correct.
Component leveling
FPT_TST_EXT.1 TSF testing requires a suite of self-testing to be run during initial start-up in order to demonstrate
correct operation of the TSF.
Management: FPT_TST_EXT.1
There are no management activities foreseen.
Audit: FPT_TST_EXT.1
There are no audit events foreseen.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 46 of 144
FPT_TST_EXT.1 – Extended: TSF Testing
Hierarchical to: No other components
Dependencies: No dependencies
FPT_TST_EXT.1.1 The TSF shall run a suite of self-tests during initial start-up (and power on) to
demonstrate the correct operation of the TSF.
Rationale TSF testing is to ensure the TSF can be operated correctly, and the Common Criteria does
not provide a suitable SFR for the TSF testing. In particular, there is no SFR defined for
TSF testing.
This extended component protects the TOE, and it is therefore placed in the FPT class
with a single component.
5.5.4 Extended: Trusted Update (FPT_TUD)
Family behaviour
This family defines requirements for the TSF to ensure that only administrators can update the TOE
firmware/software, and that such firmware/software is authentic.
Component leveling
FPT_TUD_EXT.1 Trusted Update, ensures authenticity and access control for updates.
Management: FPT_TUD_EXT.1
There are no management activities foreseen.
Audit: FPT_TUD_EXT.1
There are no audit events foreseen.
FPT_TUD_EXT.1 – Extended: Trusted Update
Hierarchical to: No other components
Dependencies: [FCS_COP.1 Cryptographic operation]
FPT_TUD_EXT.1.1 The TSF shall provide authorized administrators the ability to query the current version
of the TOE firmware/software.
FPT_TUD_EXT.1.2 The TSF shall provide authorized administrators the ability to initiate updates to TOE
firmware/software.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 47 of 144
FPT_TUD_EXT.1.3 The TSF shall provide a means to verify firmware/software updates to the TOE using a
digital signature mechanism and [published hash, no other functions] prior to installing
those updates.
Rationale Firmware/software is a form of TSF Data, and the Common Criteria does not provide a
suitable SFR for the management of firmware/software. In particular, there is no SFR
defined for importing TSF Data.
This extended component protects the TOE, and it is therefore placed in the FPT class
with a single component.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 48 of 144
6 Security Requirements
6.1 TOE Security Functional Requirements
The following table shows the SFRs for the TOE, and the operations performed on the components according to CC
part 1: iteration (Iter.), refinement (Ref.), assignment (Ass.) and selection (Sel.).
Table 19: Security functional requirements for the TOE
Security
functional group
Security functional
requirement
Base security
functional
component
Source Operations
Iter. Ref. Ass. Sel.
FAU - Security
audit
FAU_GEN.1 Audit data
generation
HCDPP No No Yes No
FAU_GEN.2 User identity
association
HCDPP No No No No
FAU_STG_EXT.1 Extended:
Audit Trail Storage
HCDPP No No No No
FCS -
Cryptographic
support
FCS_CKM.1(a)
Cryptographic key generation
(for asymmetric keys)
FCS_CKM.1 HCDPP Yes No No Yes
FCS_CKM.1(b)
Cryptographic key generation
(Symmetric Keys)
FCS_CKM.1 HCDPP Yes Yes No Yes
FCS_CKM_EXT.4 Extended:
Cryptographic key material
destruction
HCDPP No No No No
FCS_CKM.4 Cryptographic
key destruction
HCDPP Yes Yes No Yes
FCS_COP.1(a) Cryptographic
Operation (Symmetric
encryption/decryption)
FCS_COP.1 HCDPP Yes No Yes Yes
FCS_COP.1(b) Cryptographic
Operation (for signature
generation/verification)
FCS_COP.1 HCDPP Yes No Yes Yes
FCS_COP.1(c) Cryptographic
operation (Hash algorithm)
FCS_COP.1 HCDPP Yes No No Yes
FCS_COP.1(g) Cryptographic
operation (for keyed-hash
message authentication)
FCS_COP.1 HCDPP Yes Yes Yes Yes
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 49 of 144
Security
functional group
Security functional
requirement
Base security
functional
component
Source Operations
Iter. Ref. Ass. Sel.
FCS_IPSEC_EXT.1
Extended: IPsec selected
HCDPP No No Yes Yes
FCS_KYC_EXT.1 Extended:
Key chaining
HCDPP No No No Yes
FCS_RBG_EXT.1 Extended:
Cryptographic Operation
(Random Bit Generation)
HCDPP No Yes Yes Yes
FDP - User data
protection
FDP_ACC.1 Subset access
control
HCDPP No No No No
FDP_ACF.1 Security attribute
based access control
HCDPP No No Yes No
FDP_DSK_EXT.1 Extended:
Protection of Data on Disk
HCDPP No No No Yes
FDP_RIP.1(a) Subset residual
information protection
FDP_RIP.1 HCDPP Yes No No No
FIA -
Identification and
authentication
FIA_AFL.1 Authentication
failure handling
HCDPP No No Yes Yes
FIA_ATD.1 User attribute
definition
HCDPP No No Yes No
FIA_PMG_EXT.1 Extended:
Password Management
HCDPP No No Yes Yes
FIA_PSK_EXT.1 Extended:
Pre-shared key composition
HCDPP No No Yes Yes
FIA_UAU.1 Timing of
authentication
HCDPP No No Yes No
FIA_UAU.7 Protected
authentication feedback
HCDPP No No Yes No
FIA_UID.1 Timing of
identification
HCDPP No No Yes No
FIA_USB.1 User-subject
binding
HCDPP No No Yes No
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 50 of 144
Security
functional group
Security functional
requirement
Base security
functional
component
Source Operations
Iter. Ref. Ass. Sel.
FMT - Security
management
FMT_MOF.1 Management of
security functions behaviour
HCDPP No Yes Yes Yes
FMT_MSA.1 Management of
security attributes
HCDPP No Yes Yes Yes
FMT_MSA.3 Static attribute
initialisation
HCDPP No Yes Yes Yes
FMT_MTD.1 Management of
TSF data
HCDPP No No Yes Yes
FMT_SMF.1 Specification of
Management Functions
HCDPP No Yes Yes No
FMT_SMR.1 Security roles HCDPP No No No No
FPT - Protection
of the TSF
FPT_KYP_EXT.1 Extended:
Protection of Key and
Material
HCDPP No No No No
FPT_SKP_EXT.1 Extended:
Protection of TSF data
HCDPP No No No No
FPT_STM.1 Reliable time
stamps
HCDPP No No No No
FPT_TST_EXT.1 Extended:
TSF testing
HCDPP No No No No
FPT_TUD_EXT.1 Extended:
Trusted Update
HCDPP No No No Yes
FTA - TOE access FTA_SSL.3 TSF-initiated
termination
HCDPP No No Yes No
FTP - Trusted
path/channels
FTP_ITC.1 Inter-TSF trusted
channel
HCDPP No No Yes Yes
FTP_TRP.1(a) Trusted path
(for Administrators)
FTP_TRP.1 HCDPP Yes No No Yes
FTP_TRP.1(b) Trusted path
(for Non-administrators)
FTP_TRP.1 HCDPP Yes No No Yes
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 51 of 144
6.1.1 Security audit (FAU)
Audit data generation (FAU_GEN.1)
FAU_GEN.1.1 The TSF shall be able to generate an audit record of the following auditable events:
a) Start-up and shutdown of the audit functions;
b) All auditable events for the not specified level of audit; and
c) All auditable events specified in Table 20, none.
FAU_GEN.1.2 The TSF shall record within each audit record at least the following information:
a) Date and time of the event, type of event, subject identity (if applicable), and the
outcome (success or failure) of the event; and
b) For each audit event type, based on the auditable event definitions of the functional
components included in the PP/ST, additional information specified in Table 20,
none.
Table 20: Auditable events
Auditable event Relevant SFR(s) Additional information Origin
Job completion FDP_ACF.1 Type of job [HCDPP]
Unsuccessful user
authentication
FIA_UAU.1 Required by [HCDPP]:
• None
[HCDPP]
Unsuccessful user
identification
FIA_UID.1 Required by [HCDPP]:
• None
Added by vendor:
• The attempted user identity
[HCDPP]
Use of management functions FMT_SMF.1 None [HCDPP]
Modification to the group of
Users that are part of a role
FMT_SMR.1 None [HCDPP]
Changes to the time FPT_STM.1 Required by [HCDPP]:
• None
Added by vendor:
• New date and time
• Old date and time
[HCDPP]
Failure to establish session FTP_ITC.1
FTP_TRP.1(a)
FTP_TRP.1(b)
Required by [HCDPP]:
• Reason for failure
Added by vendor:
[HCDPP]
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 52 of 144
Auditable event Relevant SFR(s) Additional information Origin
• Non-TOE endpoint of connection
(e.g., IP address)
Locking an account FIA_AFL.1 User name associated with account Vendor
Unlocking an account FIA_AFL.1 User name associated with account Vendor
TSS Link: TSS for FAU_GEN.1.
User identity association (FAU_GEN.2)
FAU_GEN.2.1 For audit events resulting from actions of identified users, the TSF shall be able to
associate each auditable event with the identity of the user that caused the event.
TSS Link: TSS for FAU_GEN_2.
Extended: Audit Trail Storage (FAU_STG_EXT.1)
FAU_STG_EXT.1.1 The TSF shall be able to transmit the generated audit data to an External IT Entity using a
trusted channel according to FTP_ITC.1.
TSS Link: TSS for FAU_STG_EXT_1.
6.1.2 Cryptographic support (FCS)
Cryptographic key generation (asymmetric keys) (FCS_CKM.1(a))
FCS_CKM.1.1(a) The TSF shall generate asymmetric cryptographic keys used for key establishment in
accordance with
• NIST Special Publication 800-56A, "Recommendation for Pair-Wise Key
Establishment Schemes Using Discrete Logarithm Cryptography" for finite
field-based key establishment schemes
and specified cryptographic key sizes equivalent to, or greater than, a symmetric key
strength of 112 bits.
Table 21: Asymmetric key generation
Usage Implementation Purpose Algorithm Key sizes Related SFRs
IKE HP FutureSmart
Firmware
QuickSec 7.3
Cryptographic
Module
KAS FFC DH (dhEphem) P=2048, SHA2-256 FCS_COP.1(c)
FCS_IPSEC_EXT.1
FCS_RBG_EXT.1
DSA L=2048, N=224;
L=2048, N=256;
L=3072, N=256
TSS Link: TSS for FCS_CKM.1(a).
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 53 of 144
Cryptographic key generation (symmetric keys) (FCS_CKM.1(b))
FCS_CKM.1.1(b) The TSF shall generate symmetric cryptographic keys using a Random Bit Generator as
specified in FCS_RBG_EXT.1 and specified cryptographic key sizes defined in Table 22
that meet the following: No Standard.
Table 22: Symmetric key generation
Usage Implementation Purpose Key sizes Related SFRs
Drive-lock
password (BEV)
HP FutureSmart Firmware
OpenSSL 1.1.1
BEV generation 256 bits FCS_KYC_EXT.1,
FCS_RBG_EXT.1
TSS Link: TSS for FCS_CKM.1(b).
Extended: Cryptographic key material destruction (FCS_CKM_EXT.4)
FCS_CKM_EXT.4.1 The TSF shall destroy all plaintext secret and private cryptographic keys and
cryptographic critical security parameters when no longer needed.
TSS Link: TSS for FCS_CKM_EXT.4.
Cryptographic key destruction (FCS_CKM.4)
FCS_CKM.4.1(a) The TSF shall destroy cryptographic keys in accordance with a specified cryptographic
key destruction method
• For volatile memory, the destruction shall be executed by a removal of
power to the memory;
that meets the following: No Standard.
TSS Link: TSS for FCS_CKM.4.
Cryptographic Operation (Symmetric encryption/decryption)
(FCS_COP.1(a))
FCS_COP.1.1(a) The TSF shall perform encryption and decryption in accordance with a specified
cryptographic algorithm AES operating in the modes defined in Table 23 and
cryptographic key sizes 128-bits and 256-bits that meets the following:
• FIPS PUB 197, "Advanced Encryption Standard (AES)"
• NIST SP 800-38A
Table 23: AES encryption/decryption algorithms
Usage Implementation Purpose Algorithm Modes Key sizes Related SFRs
IKE HP FutureSmart
Firmware
Data encryption and
decryption
AES CBC 128 bits,
256 bits
FCS_IPSEC_EXT.1
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 54 of 144
Usage Implementation Purpose Algorithm Modes Key sizes Related SFRs
QuickSec 7.3
Cryptographic
Module
Encryption in
CTR_DRBG(AES)
AES ECB 256 bits
IPsec HP FutureSmart
Firmware Linux
Kernel Crypto
API
Data encryption and
decryption
AES CBC 128 bits,
256 bits
FCS_IPSEC_EXT.1
Drive-lock
password
(BEV)
HP FutureSmart
Firmware
OpenSSL 1.1.1
Encryption in
CTR_DRBG(AES)
AES CTR 256 bits FCS_KYC_EXT.1
FCS_RBG_EXT.1
AES ECB 256 bits
TSS Link: TSS for FCS_COP.1(a).
Cryptographic Operation (for signature generation/verification)
(FCS_COP.1(b))
FCS_COP.1.1(b) The TSF shall perform cryptographic signature services in accordance with a
• RSA Digital Signature Algorithm (rDSA) with key sizes (modulus) of the bit
sizes defined in Table 24
that meets the following
Case: RSA Digital Signature Algorithm
• FIPS PUB 186-4, "Digital Signature Standard".
Table 24: Asymmetric algorithms for signature generation/verification
Usage Implementation Purpose Algorithm Key sizes Related SFRs
IKE HP FutureSmart
Firmware
QuickSec 7.3
Cryptographic
Module
Signature generation
and verification based
on PKCS#1 v1.5
RSA 2048 bits,
3072 bits
FCS_IPSEC_EXT.1
Trusted update HP FutureSmart
Firmware
OpenSSL 1.1.1
Signature verification
based on PKCS#1
v1.5
RSA 2048 bits FPT_TUD_EXT.1
TSF testing HP FutureSmart
Firmware
OpenSSL 1.1.1
Signature verification
based on PKCS#1
v1.5
RSA 2048 bits FPT_TST_EXT.1
TSS Link: TSS for FCS_COP.1(b).
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 55 of 144
Cryptographic operation (Hash algorithm) (FCS_COP.1(c))
FCS_COP.1.1(c) The TSF shall perform cryptographic hashing services in accordance with the algorithms
in Table 25 that meet the following: [ISO/IEC 10118-3:2004].
Table 25: Hash algorithms
Usage Implementation Purpose Algorithm Related SFRs
IKE HP FutureSmart
Firmware QuickSec
7.3 Cryptographic
Module
Pre-shared keys SHA-1,
SHA2-256,
SHA2-512
FIA_PSK_EXT.1
KAS FFC SHA2-256 FCS_CKM.1(a)
RSA digital
signature generation
SHA2-256,
SHA2-384,
SHA2-512
FCS_COP.1(b)
RSA digital
signature
verification
SHA-1,
SHA2-256,
SHA2-384,
SHA2-512
HMAC SHA2-256,
SHA2-384,
SHA2-512
FCS_COP.1(g)
IPsec HP FutureSmart
Firmware Linux
Kernel Crypto API
HMAC SHA-1,
SHA2-256,
SHA2-384,
SHA2-512
FCS_COP.1(g)
HMAC
(HMAC_DRBG)
SHA-2-256 FCS_COP.1(g)
FCS_RBG_EXT.1
Trusted update HP FutureSmart
Firmware OpenSSL
1.1.1
RSA digital
signature
verification
SHA2-256 FPT_TUD_EXT.1
TSF testing HP FutureSmart
Firmware OpenSSL
1.1.1
RSA digital
signature
verification
SHA2-256 FPT_TST_EXT.1
TSS Link: TSS for FCS_COP.1(c).
Cryptographic operation (for keyed-hash message authentication)
(FCS_COP.1(g))
FCS_COP.1.1(g) The TSF shall perform keyed-hash message authentication in accordance with a specified
cryptographic algorithm HMAC- defined in Table 26, key size defined in Table 26 and
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 56 of 144
message digest sizes defined in Table 26 in bits that meet the following: FIPS PUB 198-
1, 'The Keyed-Hash Message Authentication Code, and FIPS PUB 180-3, "Secure Hash
Standard."'
Table 26: HMAC algorithms
Usage Implementation Algorithm Key size Digest size Related SFRs
IKE HP FutureSmart
Firmware QuickSec
7.3 Cryptographic
Module
HMAC-SHA2-256-128 256 bits 256 bits FCS_IPSEC_EXT.1
HMAC-SHA2-384-192 384 bits 384 bits
HMAC-SHA2-512-256 512 bits 512 bits
IPsec HP FutureSmart
Firmware Linux
Kernel Crypto API
HMAC-SHA1-96 160 bits 160 bits FCS_IPSEC_EXT.1
HMAC-SHA2-256-128 256 bits 256 bits
HMAC-SHA2-384-192 384 bits 384 bits
HMAC-SHA2-512-256 512 bits 512 bits
TSS Link: TSS for FCS_COP.1(g).
Extended: IPsec selected (FCS_IPSEC_EXT.1)
FCS_IPSEC_EXT.1.1 The TSF shall implement the IPsec architecture as specified in RFC 4301.
FCS_IPSEC_EXT.1.2 The TSF shall implement transport mode.
FCS_IPSEC_EXT.1.3 The TSF shall have a nominal, final entry in the SPD that matches anything that is
otherwise unmatched, and discards it.
FCS_IPSEC_EXT.1.4 The TSF shall implement the IPsec protocol ESP as defined by RFC 4303 using the
cryptographic algorithms AES-CBC-128 (as specified by RFC 3602) together with a
Secure Hash Algorithm (SHA)-based HMAC, AES-CBC-256 (as specified by RFC
3602) together with a Secure Hash Algorithm (SHA)-based HMAC.
FCS_IPSEC_EXT.1.5 The TSF shall implement the protocol: IKEv1, using Main Mode for Phase 1
exchanges, as defined in RFCs 2407, 2408, 2409, RFC 4109, no other RFCs for
extended sequence numbers and RFC 4868 for hash functions.
FCS_IPSEC_EXT.1.6 The TSF shall ensure the encrypted payload in the IKEv1 protocol uses the cryptographic
algorithms AES-CBC-128, AES-CBC-256 as specified in RFC 3602 and no other
algorithm.
FCS_IPSEC_EXT.1.7 The TSF shall ensure that IKEv1 Phase 1 exchanges use only main mode.
FCS_IPSEC_EXT.1.8 The TSF shall ensure that IKEv1 SA lifetimes can be established based on length of
time, where the time values can be limited to: 24 hours for Phase 1 SAs and 8 hours
for Phase 2 SAs.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 57 of 144
FCS_IPSEC_EXT.1.9 The TSF shall ensure that all IKE protocols implement DH Groups 14 (2048-bit MODP),
and DH Group 15 (3072-bit MODP), DH Group 16 (4096-bit MODP), DH Group 17
(6144-bit MODP), DH Group 18 (8192-bit MODP).
FCS_IPSEC_EXT.1.10 The TSF shall ensure that all IKE protocols perform Peer Authentication using the RSA
algorithm and Pre-shared Keys.
TSS Link: TSS for FCS_IPSEC_EXT.1.
Extended: Key chaining (FCS_KYC_EXT.1)
FCS_KYC_EXT.1.1 The TSF shall maintain a key chain of: one, using submasks as the BEV or DEK while
maintaining an effective strength of 256 bits.
TSS Link: TSS for FCS_KYC_EXT.1.
Extended: Cryptographic Operation (Random Bit Generation)
(FCS_RBG_EXT.1)
FCS_RBG_EXT.1.1 The TSF shall perform all deterministic random bit generation services in accordance
with NIST SP 800-90A using the algorithm defined in Table 27.
FCS_RBG_EXT.1.2 The deterministic RBG shall be seeded by at least one entropy source that accumulates
entropy from the number defined in Table 27 of hardware-based noise source(s) with
a minimum of bits defined in Table 27 of entropy at least equal to the greatest security
strength, according to ISO/IEC 18031:2011 Table C.1 "Security Strength Table for Hash
Functions", of the keys and hashes that it will generate.
Table 27: DRBG algorithms
Usage Implementation Algorithm Hardware
noise sources
Minimum
entropy bits
Related SFRs
IKE HP FutureSmart
Firmware QuickSec
7.3 Cryptographic
Module
CTR_DRBG(AES) 1 256 bits FCS_CKM.1(a)
FCS_COP.1(a)
FCS_IPSEC_EXT.1
IPsec HP FutureSmart
Firmware Linux
Kernel Crypto API
HMAC_DRBG(H
MAC-SHA2-256)
1 256 bits FCS_CKM.1(a)
FCS_COP.1(g)
FCS_IPSEC_EXT.1
Drive-lock
password
(BEV)
HP FutureSmart
Firmware OpenSSL
1.1.1
CTR_DRBG(AES) 1 256 bits FCS_CKM.1(b)
FCS_COP.1(a)
FCS_KYC_EXT.1
TSS Link: TSS for FCS_RBG_EXT.1.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 58 of 144
6.1.3 User data protection (FDP)
Subset access control (FDP_ACC.1)
FDP_ACC.1.1 The TSF shall enforce the User Data Access Control SFP on subjects, objects, and
operations among subjects and objects specified in Table 28 and Table 29.
TSS Link: TSS for FDP_ACC.1.
Security attribute based access control (FDP_ACF.1)
FDP_ACF.1.1 The TSF shall enforce the User Data Access Control SFP to objects based on the
following: subjects, objects, and attributes specified in Table 28 and Table 29.
FDP_ACF.1.2 The TSF shall enforce the following rules to determine if an operation among controlled
subjects and controlled objects is allowed: rules governing access among controlled
subjects and controlled objects using controlled operations on controlled objects specified
in Table 28 and Table 29.
FDP_ACF.1.3 The TSF shall explicitly authorise access of subjects to objects based on the following
additional rules: none.
FDP_ACF.1.4 The TSF shall explicitly deny access of subjects to objects based on the following
additional rules: none.
Table 28: D.USER.DOC Access Control SFP
“Create” “Read” “Modify” “Delete”
Print Operation:
Submit a
document to be
printed
View image or
Release printed
output
Modify stored
document
Delete stored
document
Job owner n/a allowed
denied by
design
allowed
U.ADMIN n/a denied
denied by
design
allowed
U.NORMAL n/a denied
denied by
design
denied
Unauthenticated allowed denied
denied by
design
denied
Storage/
retrieval
Operation: Store document
Retrieve stored
document
Modify stored
document
Delete stored
document
Job owner
allowed
(note 1)
allowed
denied by
design
allowed
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 59 of 144
U.ADMIN denied
allowed /
denied
denied by
design
allowed
U.NORMAL denied denied
denied by
design
denied
Unauthenticated
allowed
(condition 1)
denied
denied by
design
denied
Table 29: D.USER.JOB Access Control SFP
“Create” “Read” “Modify” “Delete”
Print
Operation: Create print job
View print
queue / log
Modify print
job
Cancel print
job
Job owner n/a allowed
denied by
design
allowed
U.ADMIN n/a allowed
denied by
design
allowed
U.NORMAL n/a
Queue: allowed
Log: denied
denied by
design
denied
Unauthenticated allowed denied
denied by
design
denied
Storage/
retrieval
Operation:
Create storage /
retrieval job
View storage /
retrieval log
Modify storage
/ retrieval job
Cancel storage
/ retrieval job
Job owner
allowed
(note 1)
allowed
denied by
design
allowed
U.ADMIN denied allowed
denied by
design
allowed
U.NORMAL denied denied
denied by
design
denied
Unauthenticated
allowed
(condition 1)
denied
denied by
design
denied
TSS Link: TSS for FDP_ACF.1.
HCDPP Application Note: The term "n/a" means not applicable.
Condition 1: Jobs submitted by unauthenticated users must contain a credential that the TOE can use to identify the
Job Owner.
Note 1: Job Owner is identified by a credential or assigned to an authorized User as part of the process of submitting
a print or storage Job.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 60 of 144
Extended: Protection of Data on Disk (FDP_DSK_EXT.1)
FDP_DSK_EXT.1.1 The TSF shall use a self-encrypting Field-Replaceable Nonvolatile Storage Device
that is separately CC certified to conform to the FDE EE cPP, such that any Field-
Replaceable Nonvolatile Storage Device contains no plaintext User Document Data and
no plaintext confidential TSF Data.
FDP_DSK_EXT.1.2 The TSF shall encrypt all protected data without user intervention.
TSS Link: TSS for FDP_DSK_EXT.1.
Subset residual information protection (FDP_RIP.1(a))
FDP_RIP.1.1(a) The TSF shall ensure that any previous information content of a resource is made
unavailable by overwriting data upon the deallocation of the resource from the following
objects: D.USER.DOC.
TSS Link: TSS for FDP_RIP.1(a).
6.1.4 Identification and authentication (FIA)
Authentication failure handling (FIA_AFL.1)
FIA_AFL.1.1 The TSF shall detect when an administrator configurable positive integer within 3 to
10 unsuccessful authentication attempts occur related to the last successful
authentication for the indicated user identity for the following interfaces
• Control Panel, EWS, and REST
o Local Device Sign In
FIA_AFL.1.2 When the defined number of unsuccessful authentication attempts has been met, the TSF
shall lock the account.
TSS Link: TSS for FIA_AFL.1.
User attribute definition (FIA_ATD.1)
FIA_ATD.1.1 The TSF shall maintain the following list of security attributes belonging to individual
users:
• Control Panel users
o Internal Authentication (Local Device Sign In)
▪ Identifier: Display name
▪ Authenticator: Password
▪ PS: Device Administrator PS
o External Authentication (LDAP Sign In and Windows Sign In)
▪ PS: Network user PS
• EWS users
o Internal Authentication (Local Device Sign In)
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 61 of 144
▪ Identifier: Display name
▪ Authenticator: Password
▪ Role: (implied U.ADMIN)
o External Authentication (LDAP Sign In and Windows Sign In)
▪ Role: (implied U.ADMIN)
• REST users
o Internal Authentication (Local Device Sign In)
▪ Identifier: Display name
▪ Authenticator: Password
▪ Role: (implied U.ADMIN)
o External Authentication (Windows Sign In)
▪ Role: (implied U.ADMIN)
Application Note: PJL users are unauthenticated.
TSS Link: TSS for FIA_ATD.1.
Extended: Password Management (FIA_PMG_EXT.1)
FIA_PMG_EXT.1.1 The TSF shall provide the following password management capabilities for User
passwords:
a) Passwords shall be able to be composed of any combination of upper and lower
case letters, numbers, and the following special characters
o Device Administrator Password
▪ "!", "@", "#", "$", "%", "^", "&", "*", "(", ")", """,
"'", "`", "+", ",", "-", ".", "/", "\", ":", ";", "<", "=",
">", "?", "[", "]", "_", "|", "~", "{", "}"
b) Minimum password length shall be settable by an Administrator, and have the
capability to require passwords of 15 characters or greater.
TSS Link: TSS for FIA_PMG_EXT.1.
Application Note: This SFR applies to the Device Administrator Password—which is used by the Control Panel,
EWS, and REST interfaces.
Extended: Pre-shared key composition (FIA_PSK_EXT.1)
FIA_PSK_EXT.1.1 The TSF shall be able to use pre-shared keys for IPsec.
FIA_PSK_EXT.1.2 The TSF shall be able to accept text-based pre-shared keys that are:
a) 22 characters in length and up to 128 characters in length;
b) composed of any combination of upper and lower case letters, numbers, and
special characters (that include: "!", "@", "#", "$", "%", "^", "&", "*", "(", and
")").
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 62 of 144
FIA_PSK_EXT.1.3 The TSF shall condition the text-based pre-shared keys by using SHA-1, SHA2-256,
SHA2-512 and be able to accept bit-based pre-shared keys.
TSS Link: TSS for FIA_PSK_EXT.1.
Timing of authentication (FIA_UAU.1)
FIA_UAU.1.1 The TSF shall allow
• Control Panel:
o View the Welcome message
o Reset the session
o Select the Sign In button
o Select a sign-in method from Sign In screen
o View the device status information
o Change the display language for the session
o Place the device into sleep mode
o View or print the network connectivity status information
o View or print the Web Services status information
o View the help information
o View the system time
• EWS:
o Select a sign in method
• REST:
o Discover a subset of the Web Services
o Obtain the X.509v3 certificate on the print engine
o Obtain the secure configuration settings on the print engine
o Obtain list of installed licenses
o Install a digitally signed license
o Delete a license (if the license in the payload of the request is
digitally signed)
o Obtain Web Services registration status
o Obtain printer Claim Code for Web Services registration
o Set printer Claim Code for Web Services registration
on behalf of the user to be performed before the user is authenticated.
FIA_UAU.1.2 The TSF shall require each user to be successfully authenticated before allowing any
other TSF-mediated actions on behalf of that user.
TSS Link: TSS for FIA_UAU.1.
Protected authentication feedback (FIA_UAU.7)
FIA_UAU.7.1 The TSF shall provide only dots to the user while the authentication is in progress.
TSS Link: TSS for FIA_UAU.7.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 63 of 144
Timing of identification (FIA_UID.1)
FIA_UID.1.1 The TSF shall allow
• Control Panel:
o View the Welcome message
o Reset the session
o Select the Sign In button
o Select a sign-in method from Sign In screen
o View the device status information
o Change the display language for the session
o Place the device into sleep mode
o View or print the network connectivity status information
o View or print the Web Services status information
o View the help information
o View the system time
• EWS:
o Select a sign in method
• REST:
o Discover a subset of the Web Services
o Obtain the X.509v3 certificate on the print engine
o Obtain the secure configuration settings on the print engine
o Obtain list of installed licenses
o Install a digitally signed license
o Delete a license (if the license in the payload of the request is
digitally signed)
o Obtain Web Services registration status
o Obtain printer Claim Code for Web Services registration
o Set printer Claim Code for Web Services registration
on behalf of the user to be performed before the user is identified.
FIA_UID.1.2 The TSF shall require each user to be successfully identified before allowing any other
TSF-mediated actions on behalf of that user.
TSS Link: TSS for FIA_UID.1.
User-subject binding (FIA_USB.1)
FIA_USB.1.1 The TSF shall associate the following user security attributes with subjects acting on the
behalf of that user:
1) User identifier
o Control Panel users:
▪ Local Device Sign In method: Display name
▪ LDAP Sign In method: LDAP username
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 64 of 144
▪ Windows Sign In method: Windows username
o EWS users:
▪ Local Device Sign In: Display name
▪ LDAP Sign In: LDAP username
▪ Windows Sign In: Windows username
o REST users:
▪ Local Device Sign In: Display name
▪ Windows Sign In: Windows username
2) User role
o Control Panel users: U.ADMIN and U.NORMAL (User session PS)
o EWS users: U.ADMIN
o REST users: U.ADMIN
FIA_USB.1.2 The TSF shall enforce the following rules on the initial association of user security
attributes with subjects acting on the behalf of users: Control Panel and EWS user
session PS:
• Internal Authentication (Local Device Sign In)
o Device Administrator session PS = Device
Administrator PS
• External Authentication (LDAP Sign In and Windows Sign In)
If a PS is associated with a network user account, then: User
session PS = Network user PS + Device Guest PS
Else, if the network user is associated with one or more network
group PSs, then: User session PS = Network group PSs +
Device Guest PS
Else: User session PS = External Authentication method
PS + Device Guest PS
• If the "Allow users to choose alternate sign-in methods" function is
disabled, the user's session PS calculated above will be reduced to exclude
the permissions of applications whose sign in method does not match the
sign in method used by the user to sign in.
FIA_USB.1.3 The TSF shall enforce the following rules governing changes to the user security
attributes associated with subjects acting on the behalf of users:
• None—The TOE does not allow a subject to change its in-session security
attributes.
TSS Link: TSS for FIA_USB.1.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 65 of 144
6.1.5 Security management (FMT)
Management of security functions behaviour (FMT_MOF.1)
FMT_MOF.1.1 The TSF shall restrict the ability to perform the actions defined in Table 30 on the
functions defined in Table 30 to U.ADMIN.
Table 30: Management of functions
Function Actions Related SFRs Application note
Allow users to choose
alternate sign-in methods
at the product control
panel
Enable,
disable
FIA_USB.1 The “Allow users to choose alternate sign-in
methods at the product control panel”
function affects how the TOE authorizes
Control Panel users.
Control Panel Mandatory
Sign-in
Enable,
disable
FIA_ATD.1
FIA_UAU.1
FIA_UID.1
In the evaluated configuration, the "Control
Panel Mandatory Sign-in" function must be
enabled.
Windows Sign In Enable,
disable
In the evaluated configuration, at least one
External Authentication mechanism
(Windows Sign In or LDAP Sign In) must
be enabled.
LDAP Sign In Enable,
disable
In the evaluated configuration, at least one
External Authentication mechanism
(Windows Sign In or LDAP Sign In) must
be enabled.
Account lockout Enable,
disable
FIA_AFL.1 In the evaluated configuration, account
lockout for the Device Administrator
account must be enabled.
Enhanced security event
logging
Enable,
disable
FAU_GEN.1 In the evaluated configuration, enhanced
security event logging must be enabled.
Managing Temporary Job
Files (i.e., image
overwrite)
Determine the
behavior of,
modify the
behavior of
FDP_RIP.1(a) The TOE offers three options: Non-Secure
Fast Erase (no overwrite), Secure Fast Erase
(overwrite 1 time), and Secure Sanitize
Erase (overwrite 3 times). In the evaluated
configuration, the administrator must select
either Secure Fast Erase or Secure Sanitize
Erase.
IPsec Enable,
disable
FCS_IPSEC_EXT.1 In the evaluated configuration, IPsec must
be enabled.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 66 of 144
Function Actions Related SFRs Application note
Automatically synchronize
with a Network Time
Service
Enable,
disable
FPT_STM.1 In the evaluated configuration, NTS must be
enabled.
TSS Link: TSS for FMT_MOF.1.
Management of security attributes (FMT_MSA.1)
FMT_MSA.1.1 The TSF shall enforce the User Data Access Control SFP to restrict the ability to
perform the restricted operations defined in Table 31 on the security attributes
defined in Table 31 to the authorized identified roles defined in Table 31.
Table 31: Management of security attributes
TOE component Security
attribute
Available
operations
Restricted
operations
Authorized
identified
roles
Default
value
property
Default
value
override
roles
Control Panel and
EWS subject
attributes
Account identity
(Internal
Authentication
mechanism)
None None n/a n/a No role
Account identity
(External
Authentication
mechanisms)
None None n/a n/a No role
Device
Administrator
permission set
permissions
View View U.ADMIN Permissive No role
Device User and
Device Guest
permission set
permissions
Modify,
view
Modify,
view
U.ADMIN Restrictive No role
Custom
permission set
permissions
Create,
modify,
delete,
view
Create,
modify,
delete,
view
U.ADMIN Restrictive No role
Job Storage object
attributes
Job owner View View Job owner,
U.ADMIN
n/a No role
TSS Link: TSS for FMT_MSA.1.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 67 of 144
Static attribute initialisation (FMT_MSA.3)
FMT_MSA.3.1 The TSF shall enforce the User Data Access Control SFP to provide the properties
defined in Table 31 of the default values for security attributes that are used to enforce
the SFP.
FMT_MSA.3.2 The TSF shall allow the default value override role defined in Table 31 to specify
alternative initial values to override the default values when an object or information is
created.
TSS Link: TSS for FMT_MSA.3.
HCDPP Application Note: FMT_MSA.3.2 applies only to security attributes whose default values can be
overridden.
Management of TSF data (FMT_MTD.1)
FMT_MTD.1.1 The TSF shall restrict the ability to perform the specified operations on the specified TSF
Data to the roles specified in Table 32.
Table 32: Management of TSF Data
Data Operation Authorized roles Related SFR(s)
List of TSF Data owned by U.NORMAL or associated with Documents or jobs owned by a U.NORMAL
None n/a n/a n/a
List of TSF Data not owned by U.NORMAL
Device Administrator password Change U.ADMIN FIA_PMG_EXT.1
Permission set associations (except on the
Device Administrator account)
Add, delete, view U.ADMIN FDP_ACF.1
FMT_MSA.1
Permission set associations (only on the
Device Administrator account)
View U.ADMIN
List of software, firmware, and related configuration data
IPsec CA and identity certificates Import, delete U.ADMIN FCS_IPSEC_EXT.1
IPsec pre-shared keys Set, change U.ADMIN FIA_PSK_EXT.1
NTS server configuration data Change U.ADMIN FPT_STM.1
Minimum password length Change U.ADMIN FIA_PMG_EXT.1
Account lockout maximum attempts Change U.ADMIN FIA_AFL.1
Account lockout interval Change U.ADMIN
Account reset lockout counter interval Change U.ADMIN
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 68 of 144
Data Operation Authorized roles Related SFR(s)
Session inactivity timeout Change U.ADMIN FTA_SSL.3
TSS Link: TSS for FMT_MTD.1.
Specification of Management Functions (FMT_SMF.1)
FMT_SMF.1.1 The TSF shall be capable of performing the following management functions: defined in
Table 33.
Table 33: Specification of management functions
Management function SFR TSS page
number
Objectives
Management of Device Administrator
password
FMT_MTD.1 126 O.USER_AUTHORIZATION,
O.USER_I&A
Management of account lockout policy FMT_MTD.1 126 O.USER_I&A
Management of minimum length password
settings
FMT_MTD.1 126
Management of Internal and External
authentication mechanisms
FMT_MOF.1 123
Management of "Allow users to choose
alternate sign-in methods at the product
control panel" function
FMT_MOF.1 123
Management of session inactivity timeouts FMT_MTD.1 126
Management of permission set associations FMT_MTD.1 126 O.ADMIN_ROLES
Management of permission set permissions FMT_MSA.1 124 O.ACCESS_CONTROL
Management of IPsec pre-shared keys FMT_MTD.1 126 O.COMMS_PROTECTION
Management of CA and identity certificates
for IPsec authentication
FMT_MTD.1 126
Management of enhanced security event
logging
FMT_MOF.1 123 O.AUDIT
Management of NTS configuration data FMT_MTD.1 126
Management of image overwrite option in
"Managing Temporary Job Files"
FMT_MOF.1 123 O.IMAGE_OVERWRITE
TSS Link: TSS for FMT_SMF.1.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 69 of 144
Security roles (FMT_SMR.1)
FMT_SMR.1.1 The TSF shall maintain the roles U.ADMIN, U.NORMAL.
FMT_SMR.1.2 The TSF shall be able to associate users with roles.
TSS Link: TSS for FMT_SMR.1.
6.1.6 Protection of the TSF (FPT)
Extended: Protection of Key and Material (FPT_KYP_EXT.1)
FPT_KYP_EXT.1.1 The TSF shall not store plaintext keys that are part of the keychain specified by
FCS_KYC_EXT.1 in any Field-Replaceable Nonvolatile Storage Device.
TSS Link: TSS for FPT_KYP_EXT.1.
Extended: Protection of TSF data (FPT_SKP_EXT.1)
FPT_SKP_EXT.1.1 The TSF shall prevent reading of all pre-shared keys, symmetric keys, and private keys.
TSS Link: TSS for FPT_SKP_EXT.1.
HCDPP Application Note: The intent of the requirement is that an administrator is unable to read or view the
identified keys (stored or ephemeral) through "normal" interfaces. While it is understood that the administrator
could directly read memory to view these keys, doing so is not a trivial task and may require substantial work on the
part of an administrator. Since the administrator is considered a trusted agent, it is assumed they would not engage in
such an activity.
Reliable time stamps (FPT_STM.1)
FPT_STM.1.1 The TSF shall be able to provide reliable time stamps.
TSS Link: TSS for FPT_STM.1.
Extended: TSF testing (FPT_TST_EXT.1)
FPT_TST_EXT.1.1 The TSF shall run a suite of self-tests during initial start-up (and power on) to
demonstrate the correct operation of the TSF.
TSS Link: TSS for FPT_TST_EXT.1.
Extended: Trusted Update (FPT_TUD_EXT.1)
FPT_TUD_EXT.1.1 The TSF shall provide authorized administrators the ability to query the current version
of the TOE firmware/software.
FPT_TUD_EXT.1.2 The TSF shall provide authorized administrators the ability to initiate updates to TOE
firmware/software.
FPT_TUD_EXT.1.3 The TSF shall provide a means to verify firmware/software updates to the TOE using a
digital signature mechanism and no other functions prior to installing those updates.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 70 of 144
TSS Link: TSS for FPT_TUD_EXT.1.
Application Note: The HP Inc. Software Depot kiosk provides a SHA2-256 published hash of the update image and
a Windows OS utility program that can be downloaded and used to verify the hash. Once downloaded, the update
image can be verified on a separate computer prior to installation on the TOE using the published hash and the
Windows OS utility program. Because the published hash verification is not performed by the TSF, the SHA2-256
published hash verification method is excluded from this SFR.
6.1.7 TOE access (FTA)
TSF-initiated termination (FTA_SSL.3)
FTA_SSL.3.1 The TSF shall terminate an interactive session after a administrator-configurable
amount of time of user inactivity.
TSS Link: TSS for FTA_SSL.3.
6.1.8 Trusted path/channels (FTP)
Inter-TSF trusted channel (FTP_ITC.1)
FTP_ITC.1.1 The TSF shall use IPsec to provide a trusted communication channel between itself and
authorized IT entities supporting the following capabilities: authentication server, DNS
server, NTS server, SMB server, SMTP server, syslog server, and WINS server that
is logically distinct from other communication channels and provides assured
identification of its end points and protection of the channel data from disclosure and
detection of modification of the channel data.
FTP_ITC.1.2 The TSF shall permit the TSF, or the authorized IT entities, to initiate communication via
the trusted channel.
FTP_ITC.1.3 The TSF shall initiate communication via the trusted channel for authentication server,
DNS server, NTS server, SMB server, SMTP server, syslog server, and WINS
server.
TSS Link: TSS for FTP_ITC.1.
Trusted path (for Administrators) (FTP_TRP.1(a))
FTP_TRP.1.1(a) The TSF shall use IPsec to provide a trusted communication path between itself and
remote administrators that is logically distinct from other communication paths and
provides assured identification of its end points and protection of the communicated data
from disclosure and detection of modification of the communicated data.
FTP_TRP.1.2(a) The TSF shall permit remote administrators to initiate communication via the trusted
path.
FTP_TRP.1.3(a) The TSF shall require the use of the trusted path for initial administrator authentication
and all remote administration actions.
TSS Link: TSS for FTP_TRP.1(a).
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 71 of 144
Trusted path (for Non-administrators) (FTP_TRP.1(b))
FTP_TRP.1.1(b) The TSF shall use IPsec to provide a trusted communication path between itself and
remote users that is logically distinct from other communication paths and provides
assured identification of its end points and protection of the communicated data from
disclosure and detection of modification of the communicated data.
FTP_TRP.1.2(b) The TSF shall permit remote users to initiate communication via the trusted path.
FTP_TRP.1.3(b) The TSF shall require the use of the trusted path for initial user authentication and all
remote user actions.
TSS Link: TSS for FTP_TRP.1(b).
6.2 Security Functional Requirements Rationale
6.2.1 Coverage
The following table provides a mapping of SFR to the security objectives, showing that each security functional
requirement addresses at least one security objective.
Table 34: Mapping of security functional requirements to security objectives
Security functional requirements Objectives
FAU_GEN.1 O.AUDIT
FAU_GEN.2 O.AUDIT
FAU_STG_EXT.1 O.AUDIT
FCS_CKM.1(a) O.COMMS_PROTECTION
FCS_CKM.1(b) O.COMMS_PROTECTION
O.STORAGE_ENCRYPTION
FCS_CKM_EXT.4 O.COMMS_PROTECTION
O.STORAGE_ENCRYPTION
FCS_CKM.4 O.COMMS_PROTECTION
O.STORAGE_ENCRYPTION
FCS_COP.1(a) O.COMMS_PROTECTION
FCS_COP.1(b) O.COMMS_PROTECTION
O.UPDATE_VERIFICATION
FCS_COP.1(c) O.COMMS_PROTECTION
O.STORAGE_ENCRYPTION
O.UPDATE_VERIFICATION
FCS_COP.1(g) O.COMMS_PROTECTION
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 72 of 144
Security functional requirements Objectives
FCS_IPSEC_EXT.1 O.COMMS_PROTECTION
FCS_KYC_EXT.1 O.STORAGE_ENCRYPTION
FCS_RBG_EXT.1 O.COMMS_PROTECTION
O.STORAGE_ENCRYPTION
FDP_ACC.1 O.ACCESS_CONTROL
O.USER_AUTHORIZATION
FDP_ACF.1 O.ACCESS_CONTROL
O.USER_AUTHORIZATION
FDP_DSK_EXT.1 O.STORAGE_ENCRYPTION
FDP_RIP.1(a) O.IMAGE_OVERWRITE
FIA_AFL.1 O.USER_I&A
FIA_ATD.1 O.USER_AUTHORIZATION
FIA_PMG_EXT.1 O.USER_I&A
FIA_PSK_EXT.1 O.COMMS_PROTECTION
FIA_UAU.1 O.USER_I&A
FIA_UAU.7 O.USER_I&A
FIA_UID.1 O.ADMIN_ROLES,
O.USER_I&A
FIA_USB.1 O.USER_I&A
FMT_MOF.1 O.ADMIN_ROLES
FMT_MSA.1 O.ACCESS_CONTROL,
O.USER_AUTHORIZATION
FMT_MSA.3 O.ACCESS_CONTROL,
O.USER_AUTHORIZATION
FMT_MTD.1 O.ACCESS_CONTROL
FMT_SMF.1 O.ACCESS_CONTROL,
O.ADMIN_ROLES,
O.USER_AUTHORIZATION
FMT_SMR.1 O.ACCESS_CONTROL,
O.ADMIN_ROLES,
O.USER_AUTHORIZATION
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 73 of 144
Security functional requirements Objectives
FPT_KYP_EXT.1 O.KEY_MATERIAL
FPT_SKP_EXT.1 O.COMMS_PROTECTION
FPT_STM.1 O.AUDIT
FPT_TST_EXT.1 O.TSF_SELF_TEST
FPT_TUD_EXT.1 O.UPDATE_VERIFICATION
FTA_SSL.3 O.USER_I&A
FTP_ITC.1 O.AUDIT
O.COMMS_PROTECTION
FTP_TRP.1(a) O.COMMS_PROTECTION
FTP_TRP.1(b) O.COMMS_PROTECTION
6.2.2 Sufficiency
The following rationale provides justification for each security objective for the TOE, showing that the security
functional requirements are suitable to meet and achieve the security objectives.
Table 35: Security objectives for the TOE rationale
Security objectives SFR Relationship Rationale
O.USER_I&A FIA_AFL.1 Supports This SFR protects the authentication
function by limiting the number of
unauthorized authentication attempts that
can be made, thereby reducing the
likelihood of impersonation.
FIA_PMG_EXT.1 Satisfies This SFR protects the authentication
function by providing for strong credentials
that are difficult to guess or derive.
FIA_UAU.1 Satisfies This SFR defines the TOE functions that
can be performed without authentication
and the functions that require authentication
for use.
FIA_UAU.7 Satisfies This SFR protects the authentication
function by hiding the authentication
credential as it is being input.
FIA_UID.1 Satisfies This SFR defines the TOE functions that
can be performed without identification and
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 74 of 144
Security objectives SFR Relationship Rationale
the functions that require identification for
use.
FIA_USB.1 Satisfies This requirement provides assurance that an
identified user is associated with attributes
that govern their authorizations to the TSF
upon successful authentication to the TOE.
FTA_SSL.3 Satisfies This SFR helps prevent User or
Administrator impersonation by
terminating unattended sessions.
O.ACCESS_CONTROL FDP_ACC.1 Satisfies This SFR defines the access control policy
that is used to protect access to User Data
and TSF Data.
FDP_ACF.1 Satisfies This SFR defines the specific rule-set that
constitutes the access control policy,
identifying the conditions under which
access to resources, functions, and data are
authorized or denied."
FMT_MSA.1 Supports The management of the product
configuration, security settings, and user
attributes and authorizations is critical to
maintaining operational security. These
management functions, as a group, provide
for the ability of authorized administrators
to configure the system, add and delete
users, grant user-specific authorizations to
system data, resources, and functions,
introduce code (e.g., updates) into the
system, and assign users to roles.
Additionally, the SFRs also require that
management functions be limited to users
who have been explicitly authorized to
perform management functions.
FMT_MSA.3 Supports
FMT_MTD.1 Supports
FMT_SMF.1 Supports
FMT_SMR.1 Supports
O.USER_AUTHORIZATION FDP_ACC.1 Supports This SFR enforces User Access Control
SFP on subjects, objects, and operations in
accordance with user authorization.
FDP_ACF.1 Supports This SFR enforces the User Access Control
SFP to objects based on attributes in
accordance with user authorization.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 75 of 144
Security objectives SFR Relationship Rationale
FIA_ATD.1 Supports This SFR defines the attributes that are
associated with Users that can be used to
define their authorizations.
FMT_MSA.1 Satisfies This SFR defines the authorizations that are
required to access data that is protected by
the TSF.
FMT_MSA.3 Satisfies This SFR defines the default security
posture for enforcement of the access
control policy that governs access to data
that is protected by the TSF.
FMT_SMF.1 Satisfies This SFR defines the management
functions provided by the TOE that can be
used to define User authorizations.
FMT_SMR.1 Satisfies This SFR defines administrative roles that
can be used to define authorizations to
groups of Users.
O.ADMIN_ROLES FIA_UID.1 Supports This SFR defines the TOE management
functions that can be accessed without
requiring Administrator authorization.
FMT_MOF.1 Satisfies This SFR defines the authorizations that are
required for Administrators to access TOE
functions.
FMT_SMF.1 Satisfies This SFR defines the administrative
functions that are provided by the TSF.
FMT_SMR.1 Satisfies This SFR defines the different roles that
can be assigned to Administrators for the
purposes of determining authentication and
authorization.
O.UPDATE_VERIFICATION FCS_COP.1(b) Selection This SFR defines the digital signature
service(s) used to verify the authenticity
TOE updates.
FCS_COP.1(c) Selection This SFR defines the hashing algorithm(s)
used to verify the integrity of TOE updates.
FPT_TUD_EXT.1 Satisfies This SFR defines the ability of the TOE to
be updated and the method(s) by which the
updates are known to be trusted.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 76 of 144
Security objectives SFR Relationship Rationale
O.TSF_SELF_TEST FPT_TST_EXT.1 Satisfies This SFR defines the ability of the TSF to
perform self-tests which assert the security
properties of the TOE.
O.COMMS_PROTECTION FCS_CKM.1(a) Satisfies This SFR defines the use of secure
algorithms for key pair generation that can
be used for key transport during protected
communications.
FCS_CKM.1(b) Satisfies This SFR defines the use of secure
algorithms for key generation that can be
used for protection communications.
FCS_CKM.4 Supports This SFR defines the method of data
erasure used by FCS_CKM_EXT.4 that
provides assurance that cryptographic keys
that need to be erased cannot be recovered.
FCS_CKM_EXT.4 Supports This SFR ensures that residual
cryptographic data cannot be used to
compromise protected communications.
FCS_COP.1(a) Satisfies This SFR defines the use of a secure
symmetric key algorithm that can be used
for protected communications.
FCS_COP.1(b) Satisfies This SFR defines the digital signature
services(s) used for protected
communications.
FCS_COP.1(c) Selection This mapping is missing from [HCDPP]
Table 17. This SFR defines the hashing
algorithm(s) used to condition the IPsec
text-based pre-shared keys.
FCS_COP.1(g) Satisfies This SFR defines the use of a secure
HMAC algorithm that can be used for
protected communications.
FCS_IPSEC_EXT.1 Selection This SFR defines secure communications
protocols that can be used to protect the
transmission of security-relevant data.
FCS_RBG_EXT.1 Supports This SFR supports protected
communications by defining a secure
method of random bit generation that
allows cryptographic functions to operate
with their theoretical maximum strengths.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 77 of 144
Security objectives SFR Relationship Rationale
FIA_PSK_EXT.1 Selection This SFR defines the use of pre-shared
keys in IPsec which allows for the secure
implementation of that protocol.
FPT_SKP_EXT.1 Satisfies This SFR prevents the compromise of
protected communications by ensuring that
secret cryptographic data is protected
against unauthorized access.
FTP_ITC.1 Satisfies This SFR defines the interfaces over which
protected communications are required and
the methods used to protect the
communications used to transit those
interfaces.
FTP_TRP.1(a) Satisfies This SFR defines the protected
communications path that is used to secure
Administrator interaction with the TOE.
FTP_TRP.1(b) Satisfies This SFR defines the protected
communications path that is used to secure
user interaction with the TOE.
O.AUDIT FAU_GEN.1 Satisfies This SFR defines the auditable events for
which the TOE generates audit data and the
fields that are included in each audit record.
FAU_GEN.2 Satisfies This SFR defines the ability of the TOE to
apply attribution to all activities performed
by a user or Administrator.
FAU_STG_EXT.1 Satisfies This SFR defines the ability of the TSF to
transmit generated audit data to an external
entity using a protected channel.
FPT_STM.1 Supports This SFR ensures that audit data is labeled
with accurate timestamps.
FTP_ITC.1 Supports This SFR defines the protected
communications channel(s) over which
audit data can be transmitted.
O.STORAGE_ENCRYPTION FCS_CKM.1(b) Selection This SFR defines the use of secure
algorithms for key generation that can be
used for storage encryption.
FCS_CKM_EXT.4 Supports This SFR helps define the requirements for
the proper destruction of cryptographic
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 78 of 144
Security objectives SFR Relationship Rationale
keys in order to ensure that stored data is
unrecoverable should the storage device(s)
be separated from the TOE.
FCS_COP.1(c) Not
supported
This PP dependency is not implemented by
the TOE. Instead, the TOE uses an SED as
the field-replaceable nonvolatile storage
device to fulfill this requirement.
FCS_KYC_EXT.1 Satisfies This SFR defines the key chaining method
used by the TOE to provide multiple layers
of security for key material.
FCS_RBG_EXT.1 Supports This SFR defines the random bit generation
algorithm used to ensure that the TOE’s
cryptographic algorithms function with the
theoretical maximum level of security.
FDP_DSK_EXT.1 Satisfies This SFR requires the TSF to encrypt the
data that is stored to disk.
O.KEY_MATERIAL FPT_KYP_EXT.1 Satisfies This SFR defines the ability of the TSF
from storing unprotected key data in
insecure locations.
O.IMAGE_OVERWRITE FDP_RIP.1(a) Satisfies This SFR defines the ability of the TSF to
overwrite user document data upon its
deallocation.
6.2.3 Security requirements dependency analysis
The following table demonstrates the dependencies of the SFRs modeled in CC Part 2, [HCDPP] and [HCDPP-
ERRATA], and how the SFRs for the TOE resolve those dependencies.
Table 36: TOE SFR dependency analysis
Security functional
requirement
Dependencies
CC Part 2
Dependencies
HCDPP
Dependencies
HCDPP Errata
Resolution
FAU_GEN.1 FPT_STM.1 FPT_STM.1 FPT_STM.1 FPT_STM.1
FAU_GEN.2 FAU_GEN.1 FAU_GEN.1 Not applicable FAU_GEN.1
FIA_UID.1 FIA_UID.1 Not applicable FIA_UID.1
FAU_STG_EXT.1 Not applicable FAU_GEN.1 Not applicable FAU_GEN.1
Not applicable FTP_ITC.1 Not applicable FTP_ITC.1
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 79 of 144
Security functional
requirement
Dependencies
CC Part 2
Dependencies
HCDPP
Dependencies
HCDPP Errata
Resolution
FCS_CKM.1(a) [FCS_CKM.2 or
FCS_COP.1]
[FCS_CKM.2, or
FCS_COP.1(b)]
[FCS_CKM.2, or
FCS_COP.1(b)]
FCS_COP.1(i)]
FCS_COP.1(b)
FCS_CKM.4 Not applicable Not applicable This dependency has
been removed by the
PP.
Not applicable FCS_CKM_EXT.4 FCS_CKM_EXT.4 FCS_CKM_EXT.4
FCS_CKM.1(b) [FCS_CKM.2 or
FCS_COP.1]
[FCS_CKM.2, or
FCS_COP.1(f)]
[FCS_CKM.2, or
FCS_COP.1(a)
FCS_COP.1(d)
FCS_COP.1(e)
FCS_COP.1(f)]
FCS_COP.1(g)
FCS_COP.1(h)]
FCS_COP.1(a)
FCS_COP.1(g)
FCS_CKM.4 Not applicable Not applicable This dependency has
been removed by the
PP.
Not applicable FCS_CKM_EXT.4 FCS_CKM_EXT.4 FCS_CKM_EXT.4
Not applicable FCS_RBG_EXT.1 FCS_RBG_EXT.1 FCS_RBG_EXT.1
FCS_CKM_EXT.4 Not applicable FCS_CKM.1(a) or
FCS_CKM.1(b)
FCS_CKM.1(a) or
FCS_CKM.1(b)
FCS_CKM.1(a)
FCS_CKM.1(b)
Not applicable FCS_CKM.4 FCS_CKM.4 FCS_CKM.4
FCS_CKM.4 [FDP_ITC.1 or
FDP_ITC.2 or
FCS_CKM.1]
FCS_CKM.1(a) or
FCS_CKM.1(b)
FCS_CKM.1(a) or
FCS_CKM.1(b)
FCS_CKM.1(a)
FCS_CKM.1(b)
FCS_COP.1(a) [FDP_ITC.1 or
FDP_ITC.2 or
FCS_CKM.1]
[FDP_ITC.1, or
FDP_ITC.2, or
FCS_CKM.1(b)]
Not applicable FCS_CKM.1(b)
FCS_CKM.4 Not applicable Not applicable This dependency has
been removed by the
PP.
Not applicable FCS_CKM_EXT.4 Not applicable FCS_CKM_EXT.4
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 80 of 144
Security functional
requirement
Dependencies
CC Part 2
Dependencies
HCDPP
Dependencies
HCDPP Errata
Resolution
FCS_COP.1(b) [FDP_ITC.1 or
FDP_ITC.2 or
FCS_CKM.1]
[FDP_ITC.1, or
FDP_ITC.2, or
FCS_CKM.1]
[FDP_ITC.1, or
FDP_ITC.2, or
FCS_CKM.1
FCS_CKM.1(a)]
RSA keys are
imported by the
TOE via X.509v3
certificates, not
generated by the
TOE.
FCS_CKM.1(a) is
for the generation of
DH and DSA keys.
FCS_CKM.4 Not applicable Not applicable This dependency has
been removed by the
PP.
Not applicable FCS_CKM_EXT.4 FCS_CKM_EXT.4 FCS_CKM_EXT.4
FCS_COP.1(c) [FDP_ITC.1 or
FDP_ITC.2 or
FCS_CKM.1]
No dependencies Not applicable This dependency has
been removed by the
PP.
FCS_CKM.4 No dependencies Not applicable This dependency has
been removed by the
PP.
FCS_COP.1(g) [FDP_ITC.1 or
FDP_ITC.2 or
FCS_CKM.1]
[FDP_ITC.1, or
FDP_ITC.2, or
FCS_CKM.1(b)]
[FDP_ITC.1, or
FDP_ITC.2, or
FCS_CKM.1(b)]
FCS_CKM.1(b)
FCS_CKM.4 Not applicable Not applicable This dependency has
been removed by the
PP.
Not applicable FCS_CKM_EXT.4 FCS_CKM_EXT.4 FCS_CKM_EXT.4
FCS_IPSEC_EXT.1 Not applicable Not applicable FCS_CKM.1(a) FCS_CKM.1(a)
Not applicable FCS_COP.1(g) FCS_COP.1(a)
FCS_COP.1(b)
FCS_COP.1(c)
FCS_COP.1(g)
FCS_COP.1(a)
FCS_COP.1(b)
FCS_COP.1(c)
FCS_COP.1(g)
Not applicable Not applicable FCS_RBG_EXT.1 FCS_RBG_EXT.1
Not applicable FIA_PSK_EXT.1 FIA_PSK_EXT.1 FIA_PSK_EXT.1
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 81 of 144
Security functional
requirement
Dependencies
CC Part 2
Dependencies
HCDPP
Dependencies
HCDPP Errata
Resolution
FCS_KYC_EXT.1 Not applicable FCS_COP.1(e) Not applicable FCS_COP.1(e) is
excluded from the
ST. See Section
6.2.4 for exclusion
rationale.
Not applicable FCS_COP.1(i) Not applicable FCS_COP.1(i) is
excluded from the
ST. See Section
6.2.4 for exclusion
rationale.
Not applicable FCS_COP.1(f) Not applicable FCS_COP.1(f) is
excluded from the
ST. See Section
6.2.4 for exclusion
rationale.
Not applicable FCS_KDF_EXT.1 Not applicable FCS_KDF_EXT.1 is
excluded from the
ST. See Section
6.2.4 for exclusion
rationale.
Not applicable FCS_SMC_EXT.1 Not applicable FCS_SMC_EXT.1
is excluded from the
ST. See Section
6.2.4 for exclusion
rationale.
FCS_RBG_EXT.1 Not applicable No dependencies Not applicable
FDP_ACC.1 FDP_ACF.1 FDP_ACF.1 Not applicable FDP_ACF.1
FDP_ACF.1 FDP_ACC.1 FDP_ACC.1 Not applicable FDP_ACC.1
FMT_MSA.3 FMT_MSA.3 Not applicable FMT_MSA.3
FDP_DSK_EXT.1 Not applicable FCS_COP.1(d) Not applicable FCS_COP.1(d) is
excluded from the
ST. See Section
6.2.4 for exclusion
rationale.
FDP_RIP.1(a) No dependencies No dependencies Not applicable
FIA_AFL.1 FIA_UAU.1 FIA_UAU.1 Not applicable FIA_UAU.1
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 82 of 144
Security functional
requirement
Dependencies
CC Part 2
Dependencies
HCDPP
Dependencies
HCDPP Errata
Resolution
FIA_ATD.1 No dependencies No dependencies Not applicable
FIA_PMG_EXT.1 Not applicable No dependencies Not applicable
FIA_PSK_EXT.1 Not applicable FCS_RBG_EXT.1 Not applicable FCS_RBG_EXT.1
FIA_UAU.1 FIA_UID.1 FIA_UID.1 Not applicable FIA_UID.1
FIA_UAU.7 FIA_UAU.1 FIA_UAU.1 Not applicable FIA_UAU.1
FIA_UID.1 No dependencies No dependencies Not applicable
FIA_USB.1 FIA_ATD.1 FIA_ATD.1 Not applicable FIA_ATD.1
FMT_MOF.1 FMT_SMR.1 FMT_SMR.1 Not applicable FMT_SMR.1
FMT_SMF.1 FMT_SMF.1 Not applicable FMT_SMF.1
FMT_MSA.1 [FDP_ACC.1 or
FDP_IFC.1]
[FDP_ACC.1, or
FDP_IFC.1]
Not applicable FDP_ACC.1
FMT_SMR.1 FMT_SMR.1 Not applicable FMT_SMR.1
FMT_SMF.1 FMT_SMF.1 Not applicable FMT_SMF.1
FMT_MSA.3 FMT_MSA.1 FMT_MSA.1 Not applicable FMT_MSA.1
FMT_SMR.1 FMT_SMR.1 Not applicable FMT_SMR.1
FMT_MTD.1 FMT_SMR.1 FMT_SMR.1 FMT_SMR.1 FMT_SMR.1
FMT_SMF.1 FMT_SMF.1 FMT_SMF.1 FMT_SMF.1
FMT_SMF.1 No dependencies No dependencies No dependencies
FMT_SMR.1 FIA_UID.1 FIA_UID.1 Not applicable FIA_UID.1
FPT_KYP_EXT.1 Not applicable No dependencies No dependencies
FPT_SKP_EXT.1 Not applicable No dependencies Not applicable
FPT_STM.1 No dependencies No dependencies Not applicable
FPT_TST_EXT.1 Not applicable No dependencies Not applicable
FPT_TUD_EXT.1 Not applicable [FCS_COP.1(b), or
FCS_COP.1(c)]
[FCS_COP.1(b), or
FCS_COP.1(c)].
FCS_COP.1(b)
FCS_COP.1(c)
FTA_SSL.3 No dependencies No dependencies Not applicable
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 83 of 144
Security functional
requirement
Dependencies
CC Part 2
Dependencies
HCDPP
Dependencies
HCDPP Errata
Resolution
FTP_ITC.1 No dependencies [FCS_IPSEC_EXT.1,
or
FCS_TLS_EXT.1, or
FCS_SSH_EXT.1, or
FCS_HTTPS_EXT.1]
[FCS_IPSEC_EXT.1,
or
FCS_TLS_EXT.1, or
FCS_SSH_EXT.1, or
FCS_HTTPS_EXT.1]
FCS_IPSEC_EXT.1
FTP_TRP.1(a) No dependencies [FCS_IPSEC_EXT.1,
or
FCS_TLS_EXT.1, or
FCS_SSH_EXT.1, or
FCS_HTTPS_EXT.1]
[FCS_IPSEC_EXT.1,
or
FCS_TLS_EXT.1, or
FCS_SSH_EXT.1, or
FCS_HTTPS_EXT.1]
FCS_IPSEC_EXT.1
FTP_TRP.1(b) No dependencies [FCS_IPSEC_EXT.1,
or
FCS_TLS_EXT.1, or
FCS_SSH_EXT.1, or
FCS_HTTPS_EXT.1]
[FCS_IPSEC_EXT.1,
or
FCS_TLS_EXT.1, or
FCS_SSH_EXT.1, or
FCS_HTTPS_EXT.1]
FCS_IPSEC_EXT.1
6.2.4 HCDPP SFR reconciliation
This ST excludes the follow SFRs found in [HCDPP].
Table 37: HCDPP SFRs excluded from the ST
Excluded PP SFR Type Rationale
FAU_SAR.1 Optional Optional.
FAU_SAR.2 Optional Optional.
FAU_STG.1 Optional Optional.
FAU_STG.4 Optional Optional.
FCS_COP.1(d) Selection-based O.STORAGE_ENCRYPTION: FCS_COP.1(d) is for AES data
encryption and decryption of stored data on field-replaceable
nonvolatile storage devices by the TOE. The TOE does not perform
AES data encryption and decryption of stored data on field-
replaceable nonvolatile storage devices. Instead, the TOE uses an
SED for data encryption and decryption. The SED performs its own
data encryption and decryption.
FCS_COP.1(e) Selection-based O.STORAGE_ENCRYPTION: FCS_COP.1(e) is defined in
[HCDPP] for key wrapping within the key chain. The TOE does not
use key wrapping in the key chain; thus, key wrapping is not
selected in FCS_KYC_EXT.1.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 84 of 144
Excluded PP SFR Type Rationale
FCS_COP.1(f) Selection-based O.STORAGE_ENCRYPTION: FCS_COP.1(f) is defined in
[HCDPP] for AES encryption of keys in the key chain. The TOE
does not use symmetric encryption algorithms to encrypt keys in the
key chain; thus, AES key encryption is not selected in
FCS_KYC_EXT.1.
FCS_COP.1(h) Selection-based O.STORAGE_ENCRYPTION: FCS_COP.1(h) is defined in
[HCDPP] for keyed-hash message authentication algorithms for
creating the BEV. The TOE does not use HMACs to create the
BEV.
FCS_COP.1(i) Selection-based O.STORAGE_ENCRYPTION: FCS_COP.1(i) is defined in
[HCDPP] for key transport encryption within the key chain. The
TOE does not use key transport encryption in the key chain; thus,
key transport is not selected in FCS_KYC_EXT.1.
FCS_HTTPS_EXT.1 Selection-based All communication channels are protected by IPsec. See
FCS_IPSEC_EXT.1 for more information.
FCS_KDF_EXT.1 Selection-based O.STORAGE_ENCRYPTION: FCS_KDF_EXT.1 is defined in
[HCDPP] for generating intermediate keys. The TOE does not
generate or use intermediate keys related to
O.STORAGE_ENCRYPTION.
FCS_PCC_EXT.1 Selection-based O.STORAGE_ENCRYPTION: FCS_PCC_EXT.1 is defined in
[HCDPP] for cryptographic password construction and conditioning
of the BEV. The TOE generates the BEV from the RBG instead of
from a password.
FCS_SMC_EXT.1 Selection-based O.STORAGE_ENCRYPTION: FCS_SMC_EXT.1 is defined in
[HCDPP] for submask combining. The TOE does not use submask
combining in the key chain; thus, submask combining is not
selected in FCS_KYC_EXT.1.
FCS_SNI_EXT.1 Selection-based O.STORAGE_ENCRYPTION: FCS_SNI_EXT.1 is defined in
[HCDPP] for generation of salts, nonces, and initialization vectors
when manual entry of a drive encryption passphrase is supported by
the TOE. The TOE does not support manual entry of a drive
encryption passphrase.
FCS_SSH_EXT.1 Selection-based All communication channels are protected by IPsec. See
FCS_IPSEC_EXT.1 for more information.
FCS_TLS_EXT.1 Selection-based All communication channels are protected by IPsec. See
FCS_IPSEC_EXT.1 for more information.
FDP_RIP.1(b) Optional O.PURGE_DATA is not supported in the evaluated configuration.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 85 of 144
6.3 Security Assurance Requirements
The security assurance requirements (SARs) for the TOE correspond to the following assurance components:
ASE_CCL.1, ASE_ECD.1, ASE_INT.1, ASE_OBJ.1, ASE_REQ.1, ASE_SPD.1, ASE_TSS.1, ADV_FSP.1,
AGD_OPE.1, AGD_PRE.1, ALC_CMC.1, ALC_CMS.1, ATE_IND.1 and AVA_VAN.1.
The following table shows the SARs, and the operations performed on the components according to CC part 3:
iteration (Iter.), refinement (Ref.), assignment (Ass.) and selection (Sel.).
Table 38: Security assurance requirements
Security assurance
class
Security assurance requirement Source
Operations
Iter. Ref. Ass. Sel.
ASE Security Target
evaluation
ASE_CCL.1 Conformance claims CC Part 3 No No No No
ASE_ECD.1 Extended components definition CC Part 3 No No No No
ASE_INT.1 ST introduction CC Part 3 No No No No
ASE_OBJ.1 Security objectives for the
operational environment
CC Part 3 No No No No
ASE_REQ.1 Stated security requirements CC Part 3 No No No No
ASE_SPD.1 Security problem definition CC Part 3 No No No No
ASE_TSS.1 TOE summary specification CC Part 3 No No No No
ADV Development ADV_FSP.1 Basic functional specification CC Part 3 No No No No
AGD Guidance
documents
AGD_OPE.1 Operational user guidance CC Part 3 No No No No
AGD_PRE.1 Preparative procedures CC Part 3 No No No No
ALC Life-cycle
support
ALC_CMC.1 Labelling of the TOE CC Part 3 No No No No
ALC_CMS.1 TOE CM coverage CC Part 3 No No No No
ATE Tests ATE_IND.1 Independent testing - conformance CC Part 3 No No No No
AVA Vulnerability
assessment
AVA_VAN.1 Vulnerability survey CC Part 3 No No No No
6.4 Security Assurance Requirements Rationale
The rationale for choosing these security assurance requirements is that they define a minimum security baseline
that is based on the anticipated threat level of the attacker, the security of the Operational Environment in which the
TOE is deployed, and the relative value of the TOE itself. The assurance activities throughout the PP are used to
provide tailored guidance on the specific expectations for completing the security assurance requirements.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 86 of 144
7 TOE Summary Specification
7.1 TOE Security Functionality
The TSS page numbers in Table 39 provide a quick index to each SFR's TSS entry in Table 40 of the next section.
Table 39: TSS index
SFR TSS
page
SFR TSS
page
SFR TSS
page
SFR TSS
page
FAU_GEN.1 86 FCS_IPSEC_EXT.1 102 FIA_UAU.1 115 FPT_SKP_EXT.1 130
FAU_GEN.2 91 FCS_KYC_EXT.1 106 FIA_UAU.7 119 FPT_STM.1 131
FAU_STG_EXT.1 91 FCS_RBG_EXT.1 107 FIA_UID.1 119 FPT_TST_EXT.1 131
FCS_CKM.1(a) 93 FDP_ACC.1 108 FIA_USB.1 120 FPT_TUD_EXT.1 132
FCS_CKM.1(b) 94 FDP_ACF.1 108 FMT_MOF.1 123 FTA_SSL.3 133
FCS_CKM_EXT.4 95 FDP_DSK_EXT.1 110 FMT_MSA.1 124 FTP_ITC.1 134
FCS_CKM.4 95 FDP_RIP.1(a) 111 FMT_MSA.3 126 FTP_TRP.1(a) 134
FCS_COP.1(a) 97 FIA_AFL.1 112 FMT_MTD.1 126 FTP_TRP.1(b) 135
FCS_COP.1(b) 98 FIA_ATD.1 113 FMT_SMF.1 129
FCS_COP.1(c) 99 FIA_PMG_EXT.1 114 FMT_SMR.1 129
FCS_COP.1(g) 101 FIA_PSK_EXT.1 115 FPT_KYP_EXT.1 130
7.1.1 TOE SFR compliance rationale
Table 40 provides the rationale for how the TOE complies with each of the SFRs in Section 6.1. Table 40 uses the
following abbreviations.
• AA—Assurance Activity
• n/a—Not applicable
• Resp—Response
Table 40: TOE SFR compliance rationale
TOE SFRs TOE SFR compliance rationale
FAU_GEN.1
(Audit
generation)
Objective(s): O.AUDIT
Summary: The TOE generates audit records for the audit events specified in [HCDPP]. It also
generates audit records for additional vendor-specific audit events defined in FAU_GEN.1.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 87 of 144
TOE SFRs TOE SFR compliance rationale
To generate the proper set of audit events, the TOE's enhanced security event logging must be
enabled. For information on this, see the TSS for FMT_MOF.1.
The complete audit record format and audit record details are provided in the [CCECG] in
chapter 7 Enhanced security event logging messages in section Syslog messages. The [CCECG]
groups the events into event categories in the section Syslog messages.
Table 41 provides a mapping of the [CCECG] event categories to the events defined in
FAU_GEN.1. (The ST author's intent is to not consume 30 pages of the ST by repeating the
audit events listed in the [CCECG], but to refer the ST reader to the appropriate category of
events in the [CCECG] that map to the events defined in FAU_GEN.1.)
Each audit record includes the date and time of the event, type of event, subject identity (if
applicable), and the outcome (success or failure) of the event.
Table 41: TOE audit records
Auditable event Additional information CCECG “Syslog messages” category
and records
Start-up and
shutdown of the
audit functions
None Enhanced security event logging:
• Auditing was started during boot
up
• Auditing was stopped using
EWS
• Auditing was restarted using
EWS
Job completion Type of job Job completion:
• Save to Device Memory job
completion
• Retrieve from Device Memory
job completion (Print from job
storage)
• Print job completion
Unsuccessful user
authentication
[HCDPP]:
• None
Local device sign in:
• Local Device sign-in method
failed
Windows sign in:
• Windows sign-in method failed
for the specified user
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 88 of 144
TOE SFRs TOE SFR compliance rationale
LDAP sign in:
• LDAP sign-in method failed for
the specified user
Unsuccessful user
identification
[HCDPP]:
• None
Vendor:
• Attempted user
identity
Same categories and records as the
“Unsuccessful user authentication”
auditable events
Use of the
management
functions
None Device administrator password:
• Device Administrator Password
modified
Account lockout policy:
• Account Lockout Policy enabled
• Account Lockout Policy
disabled
• Account Lockout Policy setting
modified
Minimum password length settings:
• Minimum Password Length
Policy setting modified
Windows Sign In:
• Windows Sign In enabled
• Windows Sign In disabled
• Windows Sign In configuration
modified
LDAP Sign In:
• LDAP Sign In enabled
• LDAP Sign In disabled
• LDAP Sign In configuration
modified
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 89 of 144
TOE SFRs TOE SFR compliance rationale
“Allow users to choose alternate sign-in
methods at the product control panel”
function:
• Sign In and Permission Policy
settings modified
Session inactivity timeout:
• Control Panel Inactivity Timeout
Changed
• EWS Session Timeout modified
Permission set associations:
• Default Permission set for sign-
in method modified
• User to Permission Set
Relationship added
• User to Permission Set
Relationship deleted
• Group to Permission Set
Relationship added
• Group to Permission Set
Relationship deleted
Custom permission sets:
• Permission Set added
• Permission Set modified
• Permission Set copied
• Permission Set deleted
Permissions associated with permission
sets:
• Permission Set modified
IPsec pre-shared keys:
• IPsec policy added
• IPsec policy modified
• IPsec policy deleted
CA and identity certificates used for
IPsec authentication:
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 90 of 144
TOE SFRs TOE SFR compliance rationale
• Device CA certificate installed
• Device CA certificate deleted
• Device Identity certificate and
private key installed
• Certificate selected for IPSec
usage
• Device Identity certificate
deleted
Enhanced security event logging:
• CCC logging started
• CCC logging stopped
NTS configuration data:
• Date and Time configuration
modified
Image overwrite option in “Managing
Temporary Job Files”:
• File Erase Mode for erasing
temporary job files modified
Modifications to
the group of users
that are part of a
role
None Network user to permission set
relationships:
• User to Permission Set
Relationship added
• User to Permission Set
Relationship deleted
Network group to permission set
relationships:
• Group to Permission Set
Relationship added
• Group to Permission Set
Relationship deleted
Changes to the
time
[HCDPP]:
• None
Vendor:
• New date and time
System time:
• System time changed
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 91 of 144
TOE SFRs TOE SFR compliance rationale
• Old date and time
Failure to establish
session (trusted
channel/path)
[HCDPP]:
• Reason for failure
Vendor:
• Non-TOE endpoint
of connection (e.g.
IP address)
IKEv1 phase 1 negotiations:
• IKEv1 phase 1 negotiation failed
initiated by the client computer
• IKEv1 phase 1 negotiation failed
initiated by the local device
(TOE)
IKEv1 phase 2 negotiations:
• IKEv1 phase 2 negotiation failed
initiated by the client computer
• IKEv1 phase 2 negotiation failed
initiated by the local device
(TOE)
Locking an
account
User name associated with
account
Account entered lockout (protected)
mode:
• Account Entered Lockout Mode
Unlocking an
account
User name associated with
account
Account exited lockout (protected) mode:
• Account Exited Lockout Mode
AA The evaluator shall check the TOE Summary Specification (TSS) to ensure that
auditable events and its recorded information are consistent with the definition of the
SFR.
Resp Table 20 contains the auditable events for FAU_GEN.1. Table 41 contains the TSS
auditable events and records.
FAU_GEN.2
(Audit user
identification)
Objective(s): O.AUDIT
Summary: Events resulting from actions of identified users are associated with the identity of
the user that caused the event.
AA The Assurance Activities for FAU_GEN.1 address this SFR.
Resp n/a
FAU_STG_EX
T.1
Objective(s): O.AUDIT
Summary: The TOE connects and sends audit records to an external syslog server for long-term
storage and audit review. It uses the syslog protocol to transmit the records over an IPsec
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 92 of 144
TOE SFRs TOE SFR compliance rationale
(Audit trail
storage)
channel. The IPsec channel provides protection of the transmitted data and assured identification
of both endpoints.
The TOE contains two in-memory audit record message queues. One queue is for network audit
records (e.g., IKEv1 phase 1 negotiation events) generated and maintained by the Jetdirect
Inside firmware, and the other queue is for HCD audit records (e.g., Control Panel Sign In
events) generated and maintained by the System firmware. These in-memory message queues
are not accessible through any TOE interface and, thus, are protected against unauthorized
access.
The network queue holds up to 15 audit records. New audit records are discarded when the
network queue becomes full. The HCD queue holds up to 1000 audit records. New audit records
replace the oldest audit records when the HCD queue becomes full.
The TOE establishes a persistent connection to the external syslog server. An audit record is
generated, added to a queue, immediately sent from the queue to the syslog server and written to
the internal log file, then removed from the queue once the record has been successfully
received by the syslog server.
If the connection is interrupted (e.g., network outage), the TOE will make 5 attempts to
reestablish the connection where each attempt lasts for approximately 30 seconds. If all attempts
fail, the TOE will repeat the reestablishment process again when a new audit record is added to
the HCD queue. Once the connection is reestablished, the records from both queues are
immediately sent to the syslog server.
If the TOE is powered off, any audit records remaining in the two in-memory messages queues
at the time of power-off will be discarded.
Note: The TOE also stores up to 2500 audit records in an internal log file on the SED replacing
the oldest audit records with new audit records when the log file becomes full. These audit
records can be exported via the EWS interface. In the evaluated configuration, access to the
audit records export function is restricted to U.ADMIN.
AA The evaluator shall examine the TSS to ensure it describes the means by which the audit
data are transferred to the external audit server, and how the trusted channel is
provided. Testing of the trusted channel mechanism will be performed as specified in the
associated assurance activities for the particular trusted channel mechanism.
Resp The TOE uses the syslog protocol over an IPsec channel to transfer audit data to the
external audit server.
AA The evaluator shall examine the TSS to ensure it describes the amount of audit data that
are stored locally; what happens when the local audit data store is full; and how these
records are protected against unauthorized access. The evaluator shall also examine the
operational guidance to determine that it describes the relationship between the local
audit data and the audit data that are sent to the audit log server. For example, when an
audit event is generated, is it simultaneously sent to the external server and the local
store, or is the local store used as a buffer and "cleared" periodically by sending the
data to the audit server.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 93 of 144
TOE SFRs TOE SFR compliance rationale
Resp There are two in-memory audit record message queues: network queue and HCD queue.
The network queue holds up to 15 records and, if full, discards new records. The HCD
queue holds up to 1000 records and, if full, replaces the oldest records with new records.
When an audit record is added to a queue, it is immediately sent to the external syslog
server (assuming a connection to the server exists) and written to the internal log file.
Once an audit record is sent to the external syslog server, it is removed from the queue.
No TOE interface is provided to access the two in-memory queues; thus, no
unauthorized access is possible.
Using the EWS interface, U.ADMIN can export the audit records in the internal log file.
Access to the audit records export function is restricted to U.ADMIN.
FCS_CKM.1(a
) (Asymmetric
key generation)
Objective(s): O.COMMS_PROTECTION
Summary: For IPsec IKEv1 KAS FFC, the TOE uses the DH key pair generation algorithm to
establish a protected communication channel. A portion of the DH key generation algorithm is
the same as the DSA key generation algorithm. Because of this, the cryptographic algorithm
testing for DH contains a prerequisite for testing the DSA key generation function used by the
DH key generation function. Thus, DSA key generation is a prerequisite for and included as part
of KAS FFC.
For KAS FFC, the TOE uses the DH ephemeral (dhEphem) scheme with SHA2-256 for key
establishment as per the NIST Special Publication (SP) [SP800-56A-Rev3] standard Section
5.5.1.1 "FFC Domain Parameter Generation" tests FB and FC, Section 5.6.1.1 "FFC Key-Pair
Generation," and Section 6.1.2.1 "dhEphem, C(2e, 0s, FFC DH) Scheme." The DH/DSA key
pair generation supports the following values as per the [FIPS186-4] standard.
• L=2048, N=224
• L=2048, N=256
• L=3072, N=256
For KAS FFC, any necessary key material is obtained using the QuickSec 7.3 Cryptographic
Module CTR_DRBG(AES) defined in FCS_RBG_EXT.1.
The TOE does not implement the key derivation function (KDF) defined in the NIST SP
[SP800-56A-Rev3] standard. Instead, the TOE implements the IPsec IKEv1 KDF.
The TOE uses RSA-based X.509v3 certificates for IPsec/IKEv1 authentication using the IPsec
IKEv1 digital signature authentication method. (See FCS_COP.1(b) for RSA digital signature
generation and verification.) The TOE does not perform RSA key pair generation. Instead, the
RSA certificates are generated by the Operational Environment and imported by the TOE.
Therefore, RSA key pair generation is not claimed in FCS_CKM.1(a)
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 94 of 144
TOE SFRs TOE SFR compliance rationale
Table 42: Asymmetric key generation
Usage Implementation Algorithm Modes and key sizes
IKE HP FutureSmart
Firmware QuickSec
7.3 Cryptographic
Module
DH
(dhEphem)
SHA2-256
DSA L=2048, N=224;
L=2048, N=256;
L=3072, N=256
AA The evaluator shall ensure that the TSS contains a description of how the TSF complies
with 800-56A and/or 800-56B, depending on the selections made. This description shall
indicate the sections in 800-56A and/or 800-56B that are implemented by the TSF, and
the evaluator shall ensure that key establishment is among those sections that the TSF
claims to implement.
Resp The Summary section above provides the explanation.
AA Any TOE-specific extensions, processing that is not included in the documents, or
alternative implementations allowed by the documents that may impact the security
requirements the TOE is to enforce shall be described in the TSS. The TSS may refer to
the Key Management Description (KMD), described in [HCDPP] Appendix F, that may
not be made available to the public.
Resp There are no TOE-specific extensions. As mentioned in the Summary section, the KDF
used by the TOE is the IKEv1 KDF.
FCS_CKM.1(b
) (Symmetric
key generation)
Objective(s): O.COMMS_PROTECTION, O.STORAGE_ENCRYPTION
Summary: The TOE uses the HP FutureSmart Firmware OpenSSL 1.1.1 CTR_DRBG(AES)
defined in FCS_RBG_EXT.1 to generate the key used for the SED's drive-lock password
(BEV). Table 43 shows the purpose and key sizes generated and the standards to which they
conform. For information on how the TOE invokes the DRBG, see the [KMD].
Table 43: Symmetric key generation
Usage Implementation Purpose Key size Standard
Drive-lock
password (BEV)
HP FutureSmart
Firmware
OpenSSL 1.1.1
BEV generation 256-bit No standard
AA The evaluator shall review the TSS to determine that it describes how the functionality
described by FCS_RBG_EXT.1 is invoked.
Resp This information is provided in the [KMD].
Objective(s): O.COMMS_PROTECTION, O.STORAGE_ENCRYPTION
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 95 of 144
TOE SFRs TOE SFR compliance rationale
FCS_CKM_E
XT.4
(Key material
destruction)
Summary: The TOE's plaintext secret and private cryptographic keys and cryptographic critical
security parameters (CSPs) are as follows.
• IPsec keys and key material (for O.COMMS_PROTECTION)
• Drive-lock password (for O.STORAGE_ENCRYPTION)
TSS for FCS_CKM.4 contains an accounting of the keys and key material, when these values
are no longer needed, and when to expect them to be destroyed.
AA The evaluator shall verify the TSS provides a high level description of what it means for
keys and key material to be no longer needed and when then should be expected to be
destroyed.
Resp TSS for FCS_CKM.4 contains the requested information on a per key basis.
FCS_CKM.4
(Key
destruction)
Objective(s): O.COMMS_PROTECTION, O.STORAGE_ENCRYPTION
Summary: As stated in the TSS for FCS_CKM_EXT.4, the TOE's plaintext secret and private
cryptographic keys and cryptographic critical security parameters (CSPs) are as follows.
• IPsec keys and key material (for O.COMMS_PROTECTION)
• SED drive-lock password (for O.STORAGE_ENCRYPTION)
Table 44 contains the list of the IPsec volatile memory keys, their usage, their storage location,
when they are no longer needed, when they are destroyed, and their destruction algorithm.
Rationale for no nonvolatile key destruction
Although the following keys reside in nonvolatile memory, the nonvolatile selection in the
[HCDPP] FCS_CKM.4 is not selected because of the following reasons.
• Drive-lock password (BEV)—This plaintext secret used to unlock the SED is generated
once by the TOE in the evaluated configuration, stored in non-field replaceable
nonvolatile storage (SPI flash and EEPROM), is always needed, is not viewable from
the TOE interfaces by an administrator or non-administrator, and is never modified in
the evaluated configuration, thus, it is never destroyed.
• IPsec Pre-shared keys—The PSKs are stored on the SED and, thus, are considered to
be stored as ciphertext, not plaintext.
• IPsec RSA private key—This private key is stored on the SED and, thus, is considered
to be stored as ciphertext, not plaintext.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 96 of 144
Table 44: TOE key destruction
Secret type Usage Storage
location
No longer
needed
When
destroyed
Destruction
algorithm
IPsec Diffie-
Hellman
(DH) private
exponent
The private exponent
used in DH exchange
(generated by the
TOE)
RAM After DH
shared secret
generation
Power off Power loss
IPsec DH
shared secret
Shared secret
generated by the DH
key exchange
(generated by the
TOE)
RAM Session
termination
Power off Power loss
IPsec
SKEYID
Value derived from
the shared secret
within IKE exchange
(generated by the
TOE)
RAM Session
termination
Power off Power loss
IPsec IKE
session
encrypt key
The IKE session
encrypt key
(generated by the
TOE)
RAM Session
termination
Power off Power loss
IPsec IKE
session
authenticatio
n key
The IKE session
authentication key
(generated by the
TOE)
RAM Session
termination
Power off Power loss
IPsec pre-
shared key
The key used to
generate the IKE
SKEYID during pre-
shared key
authentication
(entered by the
administrator)
RAM After
SKEYID
generation
Power off Power loss
IPsec IKE
RSA private
key
RSA private key for
IKE authentication
RAM After session
establishment
Power off Power loss
IPsec
encryption
key
The IPsec encryption
key (generated by the
TOE)
RAM Session
termination
Power off Power loss
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 97 of 144
TOE SFRs TOE SFR compliance rationale
IPsec
authenticatio
n key
The IPsec
authentication key
RAM Session
termination
Power off Power loss
Drive-lock
password
(BEV)
The SED password.
Generated by the
TOE.
RAM After boot Power off Power loss
AA The evaluator shall verify the TSS provides a high level description of how keys and key
material are destroyed.
Resp The Summary section above contains the requested information on a per key basis.
FCS_COP.1(a)
(AES)
Objective(s): O.COMMS_PROTECTION
Summary: IKE and IPsec support both AES CBC 128-bit and AES CBC 256-bit for symmetric
data encryption and decryption.
IKE supports AES ECB 256-bit for the symmetric encryption in CTR_DRBG(AES) using the
HP FutureSmart Firmware QuickSec 7.3 Cryptographic Module meeting both [FIPS197] and
[SP800-38A] standards.
The drive-lock password generation supports AES CTR 256-bit (which, for cryptographic
algorithm testing, has a dependency on AES ECB 256-bit) for symmetric encryption in
CTR_DRBG(AES) using the HP FutureSmart Firmware OpenSSL 1.1.1 meeting both
[FIPS197] and [SP800-38A] standards.
Table 45: AES algorithms
Usage Implementation Algorithm Modes and key sizes
IKE HP FutureSmart
Firmware QuickSec
7.3 Cryptographic
Module
AES encryption and
decryption
AES-CBC-128,
AES-CBC-256
AES encryption AES-ECB-256
IPsec HP FutureSmart
Firmware Linux
Kernel Crypto API
AES encryption and
decryption
AES-CBC-128,
AES-CBC-256
Drive-lock password
(BEV)
HP FutureSmart
Firmware OpenSSL
1.1.1
AES encryption AES-CTR-256
AES encryption AES-ECB-256
AA None
Resp n/a
Objective(s): O.COMMS_PROTECTION, O.UPDATE_VERIFICATION
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 98 of 144
TOE SFRs TOE SFR compliance rationale
FCS_COP.1(b)
(RSA)
Summary: The TOE's IKE uses RSA certificates for digital signature-based authentication. IKE
uses the RSA 2048-bit and 3072-bit algorithms for digital signature authentication (i.e.,
signature generation and verification) using the HP FutureSmart Firmware QuickSec 7.3
Cryptographic Module. The RSA signature generation is based on PKCS#1 v1.5 and uses
SHA2-256, SHA2-384, and SHA2-512. The RSA signature verification is based on PKCS#1
v1.5 and uses SHA-1, SHA2-256, SHA2-384, and SHA2-512. For more details on IKE, see the
TSS for FCS_IPSEC_EXT.1.
The TOE's trusted update function uses the RSA 2048-bit algorithm, SHA2-256 algorithm, and
PKCS#1 v1.5 for digital signature verification. This function uses the HP FutureSmart Firmware
OpenSSL 1.1.1 implementation of the RSA 2048-bit algorithm. For more details on trusted
update, see the TSS for FPT_TUD_EXT.1.
The TOE’s TSF testing (Whitelisting) function uses the RSA 2048-bit algorithm, SHA2-256
algorithm, and PKCS#1 v1.5 for digital signature verification. This function uses the HP
FutureSmart Firmware OpenSSL 1.1.1 implementation of the RSA 2048-bit algorithm. For
more details on TSF testing, see the TSS for FPT_TST_EXT.1.
All implementations meet the [FIPS186-4] standard.
Table 46: Asymmetric algorithms for signature generation/verification
Usage Implementation Algorithm Key sizes
IKE HP FutureSmart
Firmware QuickSec 7.3
Cryptographic Module
RSA signature
generation based on
PKCS#1 v1.5 using
SHA2-256, SHA2-384,
SHA2-512
2048-bits, 3072-bits
RSA signature
verification based on
PKCS#1 v1.5 using
SHA-1, SHA2-256,
SHA2-384, SHA2-512
2048-bits, 3072-bits
Trusted update HP FutureSmart
Firmware OpenSSL
1.1.1
RSA signature
verification based on
PKCS#1 v1.5 using
SHA2-256
2048-bits
TSF testing HP FutureSmart
Firmware OpenSSL
1.1.1
RSA signature
verification based on
PKCS#1 v1.5 using
SHA2-256
2048-bits
AA None
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 99 of 144
TOE SFRs TOE SFR compliance rationale
Resp n/a
FCS_COP.1(c)
(SHS)
Objective(s):
• O.COMMS_PROTECTION
• O.UPDATE_VERIFICATION
• O.STORAGE_ENCRYPTION - The TOE uses an SED as the field-replaceable
nonvolatile storage device to fulfill this requirement; therefore, the TOE does not
implement FCS_COP.1(c) for this objective. For more information on the SED, see
FDP_DSK_EXT.1 and the TSS for FDP_DSK_EXT.1.
Summary:
IKE
IKE supports the conditioning of text-based pre-shared keys using SHA-1, SHA2-256, and
SHA2-512 hash algorithms as specified in FIA_PSK_EXT.1.
IKE supports SHA2-256 for KAS FFC as specified in FCS_CKM.1(a).
IKE supports SHA2-256, SHA2-384, and SHA2-512 for RSA signature generation and SHA-1,
SHA2-256, SHA2-384, and SHA2-512 for RSA signature verification as specified in
FCS_COP.1(b).
Also, IKE supports HMAC-SHA2-256, HMAC-SHA2-384, and HMAC-SHA2-512 which use
SHA2-256, SHA2-384, and SHA2-512, respectively.
IKE uses the HP FutureSmart Firmware QuickSec 7.3 Cryptographic Module for these
algorithms. For more details on pre-shared keys, see the TSS for FIA_PSK_EXT.1. For more
details on signature generation and verification, see the TSS for FCS_COP.1(b). For more
details on the HMAC algorithms, see the TSS for FCS_COP.1(g).
IPsec
IPsec supports HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384, and HMAC-SHA2-512
which use SHA-1, SHA2-256, SHA2-384, and SHA2-512, respectively.
IPsec supports HMAC_DRBG with HMAC-SHA2-256 which uses SHA2-256. IPsec uses the
HP FutureSmart Firmware Linux Kernel Crypto API for these algorithms. For more details on
the HMAC algorithms, see the TSS for FCS_COP.1(g).
Trusted update
The TOE's trusted update function uses the SHA2-256 algorithm for RSA digital signature
verification. This function uses the HP FutureSmart Firmware OpenSSL 1.1.1 implementation
of the SHA2-256 algorithm. For more details on trusted update, see the TSS for
FPT_TUD_EXT.1.
TSF testing
The TOE’s TSF testing (Whitelisting) function uses the SHA2-256 algorithm for RSA digital
signature verification. This function uses the HP FutureSmart Firmware OpenSSL 1.1.1
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 100 of 144
TOE SFRs TOE SFR compliance rationale
implementation of the SHA2-256 algorithm. For more details on TSF testing, see the TSS for
FPT_TST_EXT.1.
All implementations meet the [ISO-10118-3] standard.
Table 47: SHS algorithms
Usage Implementation Purpose Algorithm
IKE HP FutureSmart
Firmware QuickSec
7.3 Cryptographic
Module
Pre-shared keys SHA-1,
SHA2-256,
SHA2-512
KAS FFC SHA2-256
RSA digital signature
generation
SHA2-256,
SHA2-384,
SHA2-512
RSA digital signature
verification
SHA-1,
SHA2-256,
SHA2-384,
SHA2-512
HMAC
SHA2-256,
SHA2-384,
SHA2-512
IPsec HP FutureSmart
Firmware Linux
Kernel Crypto API
HMAC SHA-1,
SHA2-256,
SHA2-384,
SHA2-512
HMAC
(HMAC_DRBG)
SHA2-256
Trusted update HP FutureSmart
Firmware OpenSSL
1.1.1
RSA digital signature
verification
SHA2-256
TSF testing HP FutureSmart
Firmware OpenSSL
1.1.1
RSA digital signature
verification
SHA2-256
AA The evaluator shall check that the association of the hash function with other TSF
cryptographic functions (for example, the digital signature verification function) is
documented in the TSS.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 101 of 144
TOE SFRs TOE SFR compliance rationale
Resp IKE supports the conditioning of text-based pre-shared keys using SHA-1, SHA2-256,
and SHA2-512 hash algorithms as specified in FIA_PSK_EXT.1. For more details on
the pre-shared keys, see the TSS for FIA_PSK_EXT.1.
IKE supports SHA2-256 for KAS FFC as specified in TSS for FCS_CKM.1(a). For
more details on KAS FFC, see the TSS for FCS_CKM.1(a).
IKE supports SHA2-256, SHA2-384, and SHA2-512 for RSA signature generation and
SHA-1, SHA2-256, SHA2-384, and SHA2-512 for RSA signature verification. For
more details on the signature generation and verification algorithms, see the TSS for
FCS_COP.1(b).
IKE also supports HMAC algorithms using SHA2-256, SHA2-384, and SHA2-512. For
more details on the HMAC algorithms, see the TSS for FCS_COP.1(g).
IPsec supports HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384, and HMAC-
SHA2-512 which use SHA-1, SHA2-256, SHA2-384, and SHA2-512, respectively. For
more details on the HMAC algorithms, see the TSS for FCS_COP.1(g).
IPsec supports HMAC_DRBG with HMAC-SHA2-256 which uses SHA2-256. For
more details on the HMAC algorithms, see the TSS for FCS_COP.1(g).
For trusted update, the RSA digital signature verification uses the SHA2-256 hash
algorithm. For more details on digital signatures in trusted update, see the TSS for
FPT_TUD_EXT.1.
For TSF testing (Whitelisting), the RSA digital signature verification uses the SHA2-
256 hash algorithm. For more details on digital signatures in TSF testing, see the TSS
for FPT_TST_EXT.1.
FCS_COP.1(g)
(HMAC)
Objective(s): O.COMMS_PROTECTION
Summary:
IKE
IKE supports the keyed-hash message authentication algorithms and key sizes specified in Table
48 using the HP FutureSmart Firmware QuickSec 7.3 Cryptographic Module meeting [FIPS180-
4] (which supersedes FIPS 180-3 specified in the SFR) and [FIPS198-1].
IKE uses truncated HMACs. Table 48 also shows the actual digest sizes and the truncated digest
sizes. For more details on the required HMAC algorithms, see the TSS for FCS_IPSEC_EXT.1.
IPsec
IPsec support the keyed-hash message authentication algorithms and key sizes specified in Table
48 using the HP FutureSmart Firmware Linux Kernel Crypto API meeting [FIPS180-4] (which
supersedes FIPS 180-3 specified in the SFR) and [FIPS198-1].
IPsec use truncated HMACs. Table 48 also shows the actual digest sizes and the truncated digest
sizes. For more details on the required HMAC algorithms, see the TSS for FCS_IPSEC_EXT.1.
IPsec supports HMAC_DRBG with HMAC-SHA2-256 which uses SHA2-256.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 102 of 144
TOE SFRs TOE SFR compliance rationale
Table 48: HMAC algorithms
Usage Implementation Algorithm Key size Actual/Trunc.
Digest size
IKE HP FutureSmart
Firmware
QuickSec 7.3
Cryptographic
Module
HMAC-SHA1-
96
160 bits 160/96 bits
HMAC-SHA2-
256-128
256 bits 256/128 bits
HMAC-SHA2-
384-192
384 bits 384/192 bits
HMAC-SHA2-
512-256
512 bits 512/256 bits
IPsec HP FutureSmart
Firmware Linux
Kernel Crypto
API
HMAC-SHA1-
96
160 bits 160/96 bits
HMAC-SHA2-
256-128
256 bits 256/128 bits
HMAC-SHA2-
384-192
384 bits 384/192 bits
HMAC-SHA2-
512-256
512 bits 512/256 bits
AA None
Resp n/a
FCS_IPSEC_E
XT.1 (IPsec)
Objective(s): O.COMMS_PROTECTION
Summary: The TOE uses IPsec to protect all communication channels required to satisfy
O.COMMS_PROTECTION. IPsec must be enabled in the evaluated configuration. The
management function for enabling IPsec is specified in the TSS for FMT_MOF.1.
IPsec supports both PSKs and X.509v3 certificates for authentication, the Encapsulating
Security Payload (ESP), Internet Security Association and Key Management Protocol
(ISAKMP), and Internet Key Exchange version 1 (IKEv1) protocol.
IKEv1 supports following cryptographic algorithms.
• DH (dhEphem) P=2048, SHA2-256 (FCS_CKM.1(a))
• DSA (FCS_CKM.1(a))
o L=2048, N=224
o L=2048, N=256
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 103 of 144
TOE SFRs TOE SFR compliance rationale
o L=3072, N=256
• RSA 2048-bit and 3072-bit signature generation/verification (FCS_COP.1(b))
• AES-CBC-128, AES-CBC-256, and AES-ECB-256 (FCS_COP.1(a))
• HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384, and HMAC-SHA2-512
(FCS_COP.1(g))
• CTR_DRBG(AES) (FCS_RBG_EXT.1)
IPsec ESP supports the following cryptographic algorithms.
• AES-CBC-128 and AES-CBC-256 (FCS_COP.1(a))
• HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384, and HMAC-SHA2-512
(FCS_COP.1(g))
• HMAC_DRBG (FCS_RBG_EXT.1)
The TOE imports the RSA keys—in the form of X.509v3 certificates—used by IKEv1 in the
evaluated configuration. It does not generate RSA keys. During the TOE's initial configuration,
the administrator imports the TOE's RSA-based identity certificate and the matching RSA-based
Certificate Authority (CA) root certificate from the Operational Environment as described in the
[CCECG] section Certificates. The administrator also imports any other RSA-based CA
certificates necessary for peer authentication. For more information on the TOE's certificate
management capabilities, see the TSS for FMT_MTD.1 for certificate importing.
IKEv1 supports DH/DSA in phase 1 to establish a protected connection using KAS FFC.
Random values generated for KAS FFC are generated by the TOE using the CTR_DRBG(AES)
specified in FCS_RBG_EXT.1 and described in the TSS for FCS_RBG_EXT.1. The
CTR_DRBG(AES) DRBG uses the AES-ECB-256 algorithm.
For IKEv1, the TOE supports peer authentication using either RSA-based digital signatures
(RSA 2048-bit and 3072-bit) or pre-shared keys. IKEv1 uses only Main Mode for Phase 1
exchanges to provide identity protection. (Aggressive Mode is not supported and is not a
configurable option.)
The encrypted IKEv1 payloads are required to use either AES-CBC-128 or AES-CBC-256. No
other payload algorithms are allowed in the evaluated configuration.
The TOE's IKEv1 supports the following DH Groups. The DH groups are specified using a
defined group description as specified in [RFC3526].
• DH Group 14 (2048-bit MODP)
• DH Group 15 (3072-bit MODP)
• DH Group 16 (4096-bit MODP)
• DH Group 17 (6144-bit MODP)
• DH Group 18 (8192-bit MODP)
All TOE cryptographic functions used by IKE are implemented in the HP FutureSmart
Firmware QuickSec 7.3 Cryptographic Module.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 104 of 144
TOE SFRs TOE SFR compliance rationale
The TOE's Security Association (SA) lifetimes can be established based on the length of time,
where the time values can be limited to 24 hours for Phase 1 SAs and 8 hours for Phase 2 SAs.
The TOE's IPsec processes packets following the policy order defined in the Security Policy
Database (SPD). The first matching policy is used to process the packet. The final policy in the
SPD matches all unmatched packets and causes the TOE to discard the packet.
The TOE's IPsec is conformant to the MUST/MUST NOT requirements of the following
Internet Engineering Task Force (IETF) Request for Comments (RFCs).
• [RFC3602] for use of AES-CBC-128 and AES-CBC-256 in IPsec
• [RFC4301] for IPsec
• [RFC4303] for ESP
• [RFC4304] for extended sequence numbers
• [RFC2407] and [RFC2408] for ISAKMP
• [RFC2409] and [RFC4109] for IKEv1
• [RFC4868] for SHA-2 HMAC in IPsec
Incoming packet processing
In a network context, the TOE is an endpoint versus being an intermediary such as a network
switch. Thus, packets originate from and terminate at the TOE.
When the TOE receives an incoming packet, it determines whether or not the packet is destined
for the TOE. If not destined for the TOE, the packet is discarded. If destined for the TOE, the
IPsec rules are applied. The rules map address templates to service templates. In essence, the
rules map IP addresses to ports. The default rule is to discard (i.e., drop) all packets that do not
match a rule. This default rule can be modified by an administrator. Also, if the packet is not an
IPsec protected packet, the packet is discarded except for the DHCPv4/BOOTP, DHCPv6,
ICMPv4, and ICMPv6 service packets which are bypassed. The TOE's simplicity of the rule
configuration helps to avoid overlapping rules, but if one or more overlapping rules exist, the
first matching rule is the rule that is enforced. Administrators can add, delete, enable, and
disable rules as well as modify the processing order of existing rules.
If the packet is a request for a new connection, then the IKE negotiation is performed to
establish SAs based on the connection rules in the SPD. This negotiation supports both pre-
shared keys and certificates. Next, the packet is compared against the set of known SAs. If the
packet fails to match an SA, the packet is discarded. The SA is checked to ensure that the SA's
lifetime has not expired and that the amount of data allowed by the SA has not been exceeded. If
any of these checks fail, the packet is discarded. If all the checks succeed, the IPsec portion of
the packet processing is considered complete, and the packet is processed as part of the
connection's flow.
Outgoing packet processing
The TOE originates packets over established IPsec connections. Because of this, only protected
(encrypted) packets are sent from the TOE to connected IT entities. The exceptions being for the
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 105 of 144
TOE SFRs TOE SFR compliance rationale
DHCPv4/BOOTP, DHCPv6, ICMPv4, and ICMPv6 service packets which are bypassed. The
TOE does not forward packets received from other devices.
Protected packets being transmitted are compared to the SPD rules for that interface. Again, the
first matching rule applies. Packets matching an SPD rule are encrypted and sent to the IT entity.
All other packets are discarded. If this is the first transmission, an SA is created based on the
SPD connection rules.
AA As per NIAP Technical Decision [CCEVS-TD0157] FCS_IPSEC_EXT.1.1: The
evaluator shall examine the TSS and determine that it describes what takes place when a
packet is processed by the TOE, e.g., the algorithm used to process the packet. The TSS
describes how the SPD is implemented and the rules for processing both inbound and
outbound packets in terms of the IPsec policy. The TSS describes the rules that are
available and the resulting actions available after matching a rule. The TSS describes
how those rules and actions form the SPD in terms of the BYPASS (e.g., no encryption),
DISCARD (e.g., drop the packet) and PROTECT (e.g., encrypt the packet) actions
defined in RFC 4301.
As noted in section 4.4.1 of [RFC4301], the processing of entries in the SPD is non-
trivial and the evaluator shall determine that the description in the TSS is sufficient to
determine which rules will be applied given the rule structure implemented by the TOE.
For example, if the TOE allows specification of ranges, conditional rules, etc., the
evaluator shall determine that the description of rule processing (for both inbound and
outbound packets) is sufficient to determine the action that will be applied, especially in
the case where two different rules may apply. This description shall cover both the
initial packets (that is, no SA is established on the interface or for that particular
packet) as well as packets that are part of an established SA.
Resp The Summary section above provides a description of the packet processing.
AA FCS_IPSEC_EXT.1.2: The evaluator checks the TSS to ensure it states that the VPN can
be established to operate in tunnel mode and/or transport mode (as selected).
Resp The VPN operates in transport mode only in the evaluated configuration.
AA FCS_IPSEC_EXT.1.3: The evaluator shall examine the TSS to verify that the TSS
provides a description of how a packet is processed against the SPD and that if no
“rules” are found to match, that a final rule exists, either implicitly or explicitly, that
causes the network packet to be discarded.
Resp Packets are processed following the order defined in the Security Policy Database
(SPD). The first matching policy is used to process the packet. The final policy in the
SPD matches all unmatched packets and causes the TOE to discard the packet.
AA FCS_IPSEC_EXT.1.4: The evaluator shall examine the TSS to verify that the symmetric
encryption algorithms selected (along with the SHA-based HMAC algorithm, if AES-
CBC is selected) are described. If selected, the evaluator ensures that the SHA-based
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 106 of 144
TOE SFRs TOE SFR compliance rationale
HMAC algorithm conforms to the algorithms specified in FCS_COP.1(g) Cryptographic
Operations (for keyed-hash message authentication).
Resp Algorithms:
• AES-CBC-128 and AES-CBC-256 (FCS_COP.1(a))
• HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA2-384, and HMAC-SHA2-
512 (FCS_COP.1(g))
AA FCS_IPSEC_EXT.1.5: The evaluator shall examine the TSS to verify that IKEv1 and/or
IKEv2 are implemented.
Resp Only IKEv1 is supported in the evaluated configuration.
AA FCS_IPSEC_EXT.1.6: The evaluator shall ensure the TSS identifies the algorithms used
for encrypting the IKEv1 and/or IKEv2 payload, and that the algorithms AES-CBC-128,
AES-CBC-256 are specified, and if others are chosen in the selection of the requirement,
those are included in the TSS discussion.
Resp Only AES-CBC-128 and AES-CBC-256 are used for encrypting the payload.
AA FCS_IPSEC_EXT.1.7: The evaluator shall examine the TSS to ensure that, in the
description of the IPsec protocol supported by the TOE, it states that aggressive mode is
not used for IKEv1 Phase 1 exchanges, and that only main mode is used. It may be that
this is a configurable option.
Resp Only Main Mode is used for Phase 1 exchanges. Aggressive Mode is not supported and
is not a configurable option.
AA FCS_IPSEC_EXT.1.9: The evaluator shall check to ensure that the DH groups specified
in the requirement are listed as being supported in the TSS. If there is more than one
DH group supported, the evaluator checks to ensure the TSS describes how a particular
DH group is specified/negotiated with a peer.
Resp The DH groups are specified using a defined group description as specified in
[RFC3526].
AA FCS_IPSEC_EXT.1.10: The evaluator shall check that the TSS contains a description of
the IKE peer authentication process used by the TOE, and that this description covers
the use of the signature algorithm or algorithms specified in the requirement.
Resp RSA-based digital signatures (RSA 2048-bit and 3072-bit) or pre-shared keys.
FCS_KYC_EX
T.1
(Key chaining)
Objective(s): O.STORAGE_ENCRYPTION
Summary: The TOE uses a 256-bit drive-lock password (a.k.a. BEV) to unlock the TOE's field-
replaceable SED. This BEV is stored as a key chain of one in a non-field replaceable nonvolatile
storage (SPI flash and EEPROM) located inside the TOE. The TOE generates this BEV by
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 107 of 144
TOE SFRs TOE SFR compliance rationale
making a single invocation request for 256-bits of data from the HP FutureSmart Firmware
OpenSSL 1.1.1 DRBG specified in FCS_RBG_EXT.1.
The BEV is automatically generated by the TOE when the TOE is first initialized and stored in
non-field replaceable, nonvolatile memory. Afterwards, the BEV is never changed in the
evaluated configuration; therefore, there are no claimed security management functions for the
BEV in this ST. It is also never destroyed. No interfaces are provided to view the BEV or to
retrieve the BEV; therefore, the BEV is never seen by a human (i.e., it is only known by the
TOE).
AA The evaluator shall verify the TSS contains a high-level description of the BEV sizes –
that it supports BEV outputs of no fewer [than] 128 bits for products that support only
AES-128, and no fewer than 256 bits for products that support AES-256.
Resp The drive-lock password (a.k.a. BEV) is a 256-bit binary value and generated using
FCS_RBG_EXT.1.
FCS_RBG_EX
T.1
(DRBG)
Objective(s): O.COMMS_PROTECTION, O.STORAGE_ENCRYPTION
Summary: IKE uses the CTR_DRBG(AES) DRBG algorithm from the HP FutureSmart
Firmware QuickSec 7.3 Cryptographic Module to generate key and key material. This DRBG
supports the AES 256-bit algorithm. The AES-ECB-256 algorithm claimed in FCS_COP.1(a) is
used by this DRBG.
IPsec uses the HMAC_DRBG algorithm with HMAC-SHA2-256 from the HP FutureSmart
Firmware Linux Kernel Crypto API. The HMAC-SHA2-256 algorithm claimed in
FCS_COP.1(g) is used by this DRBG.
The SED drive-lock password generation mechanism uses the CTR_DRBG(AES) algorithm
from HP FutureSmart Firmware OpenSSL 1.1.1 to generate the password (BEV). This DRBG
supports the AES 256-bit algorithm. The AES-CTR-256 algorithm claimed in FCS_COP.1(a) is
used by this DRBG.
The three DRBGs are seeded by a hardware-based entropy noise source. This entropy source
provides at least 256 bits of minimum entropy.
Table 49: DRBG algorithms
Usage Implementation Modes and key sizes
IKE HP FutureSmart Firmware
QuickSec 7.3 Cryptographic
Module
CTR_DRBG(AES)
IPsec HP FutureSmart Firmware
Linux Kernel Crypto API
HMAC_DRBG(HMAC-
SHA2-256)
Drive-lock password (BEV) HP FutureSmart Firmware
OpenSSL 1.1.1
CTR_DRBG(AES)
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 108 of 144
TOE SFRs TOE SFR compliance rationale
AA For any RBG services provided by a third party, the evaluator shall ensure the TSS
includes a statement about the expected amount of entropy received from such a source,
and a full description of the processing of the output of the third-party source. The
evaluator shall verify that this statement is consistent with the selection made in
FCS_RBG_EXT.1.2 for the seeding of the DRBG. If the ST specifies more than one
DRBG, the evaluator shall examine the TSS to verify that it identifies the usage of each
DRBG mechanism.
Resp The TOE implements three DRBGs. One is used by IKE, another is used by IPsec and
another is used for the SED drive-lock password (BEV) generation.
FDP_ACC.1
(Subset access
control)
Objective(s): O.ACCESS_CONTROL, O.USER_AUTHORIZATION
Summary: [HCDPP] predefines the subjects, objects, and operations. Table 28 and Table 29 of
this ST list these values and enumerates the operations between the subjects and objects.
AA It is covered by assurance activities for FDP_ACF.1.
Resp n/a
FDP_ACF.1
(Security
attribute based
access control)
Objective(s): O.ACCESS_CONTROL, O.USER_AUTHORIZATION
Summary: In this section, Table 28 is explained first followed by Table 29.
Print Create D.USER.DOC in Table 28
Print jobs are submitted to the TOE over the network using PJL. Any computer that can connect
to the TOE using IPsec can submit a print job. The TOE requires a user identity (a.k.a. job
owner) to be included with each print job, but this user identity is unauthenticated. For this
reason, the job owner, U.ADMIN, and U.NORMAL boxes in Table 28 for "Print Create" are
marked as not applicable (n/a) because the job owner is always unauthenticated. If no job owner
is provided with the print job, the print job is rejected by the TOE.
Required security attributes:
• Subject: None (Unauthenticated user)
• Object: Job owner
Print Read/Modify/Delete D.USER.DOC in Table 28
In order to print, the user must log in via the Control Panel. Each print job, when created, must
have a user identity supplied by the client computer. This user identity is used as the job owner.
The logged in user's identity must match the user identity of the print job in order for the logged
in user to be considered the job owner. Only the job owner can print (read) the job. Only the job
owner and U.ADMIN can delete a print job. By design, the D.USER.DOC information of a print
job cannot be modified by anyone.
Required security attributes:
• Subject: Control Panel user identity/role
• Object: Job owner
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 109 of 144
TOE SFRs TOE SFR compliance rationale
Storage / retrieval Create/Read/Modify/Delete D.USER.DOC in Table 28
Print jobs can be stored in Job Storage.
Client computers connect over IPsec to submit print jobs via PJL. The users of these client
computers can submit print jobs which are then stored in Job Storage by the TOE. The TOE
requires each print job to contain a user identity that is then used as the job owner of the print
job. This user identity is unauthenticated and can be any identity the submitter on the client
computer chooses. Thus, for print jobs, only unauthenticated users can store a print job in Job
Storage. This is why "allowed" is shown for "create" in Table 28 for unauthenticated users. Only
the job owner can "read" a print job from Job Storage. Both the job owner and any administrator
can delete a print job from Job Storage. By design, the D.USER.DOC information of a print job
in Job Storage cannot be modified by anyone.
Required security attributes:
• Subject: Unauthenticated users (create print job only) or Control Panel user
identity/role
• Object: Job owner
Print Create/Read/Modify/Delete D.USER.JOB in Table 29
For the same reasons described in "Print Create D.USER.DOC" above, the job owner,
U.ADMIN, and U.NORMAL, are marked as not applicable (n/a) because the job owner is
always unauthenticated.
Job owner, U.ADMIN, and U.NORMAL can view the print queue, thus, they can see all print
jobs, but only the job owner and U.ADMIN can view the print log. Unauthenticated users cannot
view the print queue or print log.
Only the job owner and U.ADMIN can delete the print job of a job owned by the job owner.
By design, the D.USER.JOB information of a print job cannot be modified by anyone.
Required security attributes:
• Subject: Unauthenticated user (create print job and view print queue only) or Control
Panel user identity/role
• Object: Job owner
Storage / retrieval Create/Read/Modify/Delete D.USER.JOB in Table 29
Print jobs can be stored in Job Storage.
Client computers connect over IPsec to submit print jobs via PJL. The users of these client
computers can submit print jobs which are stored in Job Storage. The TOE requires each print
job to contain a user identity that is then used as the job owner of the print job. This user identity
is unauthenticated and can be any identity the submitter on the client computer chooses. Thus,
for print jobs, only unauthenticated users can store a print job in Job Storage. This is why
"allowed" is shown for "create" in Table 29 for unauthenticated users. The job owner and
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 110 of 144
TOE SFRs TOE SFR compliance rationale
U.ADMIN can view the list of jobs in Job Storage owned by the job owner. By design, the
U.USER.JOB information of a print job stored in Job Storage cannot be modified.
Required security attributes:
• Subject: Unauthenticated users (create print job only) or Control Panel user
identity/role
• Object: Job owner
AA The evaluator shall check to ensure that the TSS describes the functions to realize SFP
defined in Table 28 and Table 29.
Resp See the description above.
FDP_DSK_EX
T.1
(Disk data
protection)
Objective(s): O.STORAGE_ENCRYPTION
Summary: The TOE contains one field-replaceable nonvolatile storage device. This storage
device is a disk-based self-encrypting drive (SED).
[HCDPP] states that SEDs must be CC certified using the Full Disk Encryption (FDE)
Encryption Engine (EE) collaborative PP (cPP). The field-replaceable SED model used by TOE
models is CC certified using the FDE EE cPP.
The following is the product name, model, hardware version, and firmware version for the SED:
• Name: Seagate Secure® TCG SSC Self-Encrypting Drive
• Model: ST500LM033
• Hardware version: 1RD17D
• Firmware version: SDM1
The SED is CC certified. The following is information for the CC certification of the SED:
• NIAP: VID11209
• Security Target: Version 1.5, January 25, 2024
The SED performs all of the storage encryption and decryption internally (i.e., the SED
corresponds to the FDE EE) without any TOE or user intervention. The encryption and
decryption implementation is built into the SED. The data is encrypted and stored by the SED as
the SED receives the data. The SED decrypts the data when a read request is made. The standard
Serial AT Attachment (SATA) interface is used to interface the TOE to the drive.
The TOE provides an SED drive-lock password (a.k.a. BEV) to the SED. The SED uses this
password to decrypt the symmetric key it uses to encrypt and decrypt the data on the SED (i.e.,
the TOE corresponds the FDE AA). Only when the TOE provides the correct password to the
SED can the SED's symmetric key be decrypted.
The TOE generates the initial drive-lock password when the TOE is initialized and stores it in
the TOE's internal non-field replaceable nonvolatile storage (SPI flash and EEPROM). This
password is never changed and is not accessible by any user.
SEDs typically have a small portion of space on the drive that is not encrypted. This
unencrypted space is used by the drive to store its own key chains needed to encrypt and decrypt
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 111 of 144
TOE SFRs TOE SFR compliance rationale
the rest of the storage. The SED uses the drive-lock password (BEV) provided by the TOE to
encrypt and decrypt this key chain. The TOE has no control over this unencrypted space.
For more information on the SED drive-lock password, see the TSS for FCS_KYC_EXT.1.
AA As per NIAP Technical Decision [CCEVS-TD0176]
If the self-encrypting device option is selected, the device must be certified in
conformance to the current Full Disk Encryption Protection Profile. The tester shall
confirm that the specific SED is listed in the TSS, documented and verified to be CC
certified against the FDE EE cPP.
The evaluator shall examine the TSS to ensure that the description is comprehensive in
how the data is written to the Device and the point at which the encryption function is
applied.
For the cryptographic functions that are provided by the Operational Environment, the
evaluator shall check the TSS to ensure it describes the interface(s) used by the TOE to
invoke this functionality.
The evaluator shall verify that the TSS describes the initialization of the Device at
shipment of the TOE, or by the activities the TOE performs to ensure that it encrypts all
the storage devices entirely when a user or administrator first provisions the Device.
The evaluator shall verify the TSS describes areas of the Device that it does not encrypt
(e.g., portions that do not contain confidential data boot loaders, partition tables, etc.).
If the TOE supports multiple Device encryptions, the evaluator shall examine the
administration guidance to ensure the initialization procedure encrypts all Devices.
Resp The Summary section above provides the necessary description for this assurance
activity.
FDP_RIP.1(a)
(Subset
residual
information
protection)
Objective(s): O.IMAGE_OVERWRITE
Note: The O.IMAGE_OVERWRITE objective limits the scope of this requirement to field-
replaceable nonvolatile storage devices.
Summary: User document data are stored on a field-replaceable nonvolatile storage device,
specifically a disk drive that is also an SED. This user document data is stored in the form of job
files. When a job file is deleted (either automatically by the system or by request of a user), the
TOE will overwrite the file.
The TOE calls this image overwrite feature "Managing Temporary Job Files." This feature
contains three options of which only two are allowed to be used in the evaluated configuration.
This restriction is documented in the [CCECG] section Managing temporary job files and must
be enforced by the administrator.
The administrator can select between either one of these two allowed options.
• Secure Fast Erase (overwrite 1 time)
• Secure Sanitize Erase (overwrite 3 times)
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 112 of 144
TOE SFRs TOE SFR compliance rationale
Secure Fast Erase overwrites a job file once using a static byte value of 0x48. Then the file is
unlinked (deallocated) from the file system and the disk blocks comprising the file reassigned to
free space in the file system.
Secure Sanitize Erase overwrites a job file three times. The first pass uses a static byte value of
0x48. The second pass uses a static byte value of 0xB7. The third pass uses pseudo-random
values. Then, the file is unlinked (deallocated) from the file system and the disk blocks
comprising the file reassigned to free space in the file system.
The third option is called "Non-Secure Fast Erase (no overwrite)." This option must not be
selected in the evaluated configuration.
AA The evaluator shall examine the TSS to ensure that the description is comprehensive in
describing where image data is stored and how and when it is overwritten.
Resp The TOE has one field-replaceable nonvolatile storage device. User document data is in
the form of job files on this storage device. When a job file is deleted (either
automatically by the system or by requested of a user), the TOE will overwrite the file.
The administrator can select between two options of file overwrite performed by the
TOE. The Secure Fast Erase option performs a single pass overwrite using a static value.
The Secure Sanitize Erase option performs a three pass overwrite where the first pass
uses a static value, the second pass uses a different static value, and the third pass uses
pseudo-random values. After the overwrite completes, the file is unlinked (deallocated)
from the file system.
FIA_AFL.1
(Authentication
failure
handling)
Objective(s): O.USER_I&A
Summary: This SFR applies to the Local Device Sign In mechanism (used by the Control
Panel, EWS, and REST interfaces). The only account associated with this mechanism is the
Device Administrator account.
The lockout mechanism uses the following control values.
• Account lockout maximum attempts
• Account lockout interval
• Account reset lockout counter interval
The account lockout maximum attempts value allows an administrator to control the number of
failed authentication attempts on an account before the account is locked. The administrator can
choose a value between 3 and 10 inclusively. Consecutive failed authentication attempts using
the same authentication credential count as a single failed authentication attempt. The counted
failed attempts must happen within the value set for the account reset lockout counter interval
value; otherwise, the maximum attempts counter is reset to zero. When the maximum attempts
count has been met, the account is locked for the amount of time specified by the account
lockout interval value.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 113 of 144
TOE SFRs TOE SFR compliance rationale
The account lockout interval value allows an administrator to control the length of time that the
account remains locked. The administrator can choose a value between 60 seconds (1 minute)
and 1800 seconds (30 minutes) inclusively in the evaluated configuration.
The account reset lockout counter interval value allows an administrator to specify the time (in
seconds) in which the failed login attempts must occur before the account lockout maximum
attempts counter is reset to zero. This value must be equal to or greater than the account lockout
interval value.
AA The evaluator shall check to ensure that the TSS contains a description of the actions in
the case of authentication failure (types of authentication events, the number of
unsuccessful authentication attempts, actions to be conducted), which is consistent with
the definition of the SFR.
Resp When the administrator specified 3 to 10 authentication failures on an account are met,
the account is locked for the period of time specified by the lockout interval. Caveats
are:
• Consecutive failed authentication attempts using the same authentication
credential count as a single failed authentication attempt.
• The failures must occur during the time value specified by the account reset
lockout counter interval value; otherwise, the account lockout maximum
attempts counter is reset to zero.
FIA_ATD.1
(User attribute
definition)
Objective(s): O.USER_AUTHORIZATION
Summary:
Control Panel users
For Internal Authentication (i.e., the Local Device Sign In method), only one account exists in
the evaluated configuration: Device Administrator. This account is a built-in account and is
permanently assigned the Device Administrator PS which makes its role U.ADMIN. The user
identifier is the Display name and the authenticator is a password. The Device Administrator
Password's composition requirements are defined in FIA_PMG_EXT.1.
For each External Authentication method (i.e., LDAP Sign In and Windows Sign In), the user
identifiers and passwords are stored on and verified by the External Authentication server. Also,
the network group memberships are stored on the External Authentication server. Because these
security attributes are not stored on and maintained by the TOE, they are not listed in
FIA_ATD.1.
User accounts from External Authentication methods are known as network user accounts. Each
network user account can have zero or one PS (i.e., network user PS) associated with it that is
used in calculating the user's session PS (i.e., the user's role). These PSs are stored on and
maintained by the TOE. User session PS formulas are provided in FIA_USB.1 and described in
the TSS for FIA_USB.1.
EWS users
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 114 of 144
TOE SFRs TOE SFR compliance rationale
The EWS authentication works very similarly to the Control Panel authentication.
For Internal Authentication (i.e., the Local Device Sign In method), only one account exists in
the evaluated configuration: Device Administrator. This account is a built-in account and is
permanently assigned the Device Administrator PS which makes its role U.ADMIN. It contains
a user identifier known as the Display name and a password known as the Device Administrator
Password. The Device Administrator Password's composition requirements are defined in
FIA_PMG_EXT.1.
For each External Authentication method (i.e., LDAP Sign In and Windows Sign In), the user
identifiers and passwords are stored on and verified by the External Authentication server. Also,
the network group memberships are stored on the External Authentication server. Because these
security attributes are not stored on and maintained by the TOE, they are not listed in
FIA_ATD.1.
REST users
The REST interface is an administrator-only interface used to manage the TOE over IPsec.
For Internal Authentication, the REST interface supports the Local Device Sign In method
which requires the administrator to authenticate using the Device Administrator account. The
Display name is used as the identifier and password is used as the authenticator. Both are
maintained internally by the TOE. For External Authentication, the REST interface supports the
Windows Sign In method which requires the user to be associated with the Device
Administrator permission set.
AA The evaluator shall check to ensure that the TSS contains a description of the user
security attributes that the TOE uses to implement the SFR, which is consistent with the
definition of the SFR.
Resp See the Summary section above.
FIA_PMG_EX
T.1
(Password
management)
Objective(s): O.USER_I&A
Summary: The TOE manages the following password.
• Device Administrator Password
This value is composed of any combination of upper and lower case letters, numbers, and the
special characters specified in FIA_PMG_EXT.1. Its length is configurable by the administrator
and can be set to have a minimum of 15 or more characters. For more information on the TOE's
password length management capabilities, see the TSS for FMT_MTD.1.
The Device Administrator Password is used by the Control Panel, EWS, and REST interfaces,
and can be managed through the EWS.
AA None
Resp n/a
Objective(s): O.COMMS_PROTECTION
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 115 of 144
TOE SFRs TOE SFR compliance rationale
FIA_PSK_EX
T.1
(Pre-shared
key
composition)
Summary: The TOE supports IPsec text-based pre-shared keys and accepts bit-based pre-shared
keys.
The text-based keys can be from 22 characters to 128 characters in length and be composed of
any combination of upper and lower case letters, numbers, and special characters that include
the characters: "!", "@", "#", "$", "%", "^", "&", "*", "(", and ")". The text-based keys are
conditioned using the administrator selectable SHA-1, SHA2-256, or SHA2-512 hash
algorithms specified in FCS_COP.1(c).
The TOE accepts bit-based pre-shared keys generated outside of the TOE. It does not generate
bit-based keys except from the text-based keys mentioned above. It allows the administrator to
enter a hexadecimal bit-based pre-shared key. For information on this, see the TSS for
FMT_MTD.1.
AA The evaluator shall examine the TSS to ensure that it states that text-based pre-shared
keys of 22 characters are supported, and that the TSS states the conditioning that takes
place to transform the text-based pre-shared key from the key sequence entered by the
user (e.g., ASCII representation) to the bit string used by IPsec, and that this
conditioning is consistent with the first selection in the FIA_PSK_EXT.1.3 requirement.
If the assignment is used to specify conditioning, the evaluator will confirm that the TSS
describes this conditioning.
If "bit-based pre-shared keys" is selected, the evaluator shall confirm the operational
guidance contains instructions for either entering bit-based pre-shared keys for each
protocol identified in the requirement, or generating a bit-based pre-shared key (or
both). The evaluator shall also examine the TSS to ensure it describes the process by
which the bit-based pre-shared keys are generated (if the TOE supports this
functionality), and confirm that this process uses the RBG specified in
FCS_RBG_EXT.1.
Resp Text-based keys are 22 to 128 characters in length, composed of the characters described
in the Summary above, and are conditioned using SHA-1, SHA2-256, or SHA2-512.
Hexadecimal bit-based keys can be entered into the TOE as well.
FIA_UAU.1
(Timing of
authentication)
Objective(s): O.USER.I&A
Summary:
Control Panel
From the Control Panel, the user can perform the following actions prior to authentication.
• View the Welcome message
• Reset the session
• Select the Sign In button
• Select a sign-in method from Sign In screen
• View the device status information
• Change the display language for the session
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 116 of 144
TOE SFRs TOE SFR compliance rationale
• Place the device into sleep mode
• View or print the network connectivity status information
• View or print the Web Services status information
• View the help information
• View the system time
The Control Panel user cannot perform any other TSF-mediated actions until after the user has
been successfully authenticated.
Users select the sign in method from a menu of sign in methods. The menu options vary
depending on the number of External Authentication methods configured for the TOE. The
Control Panel supports the following Internal and External Authentication methods in the
evaluated configuration.
• Internal Authentication method
o Local Device Sign In
• External Authentication methods
o LDAP Sign In
o Windows Sign In (via Kerberos)
The Local Device Sign In method is always available in the TOE. Local Device Sign In contains
only one account—the built-in Device Administrator account—in the evaluated configuration.
The username (display name) and password are maintained internally by the TOE. At the
Control Panel, the user selects the Local Device Sign In method, selects Administrator Access
Code (a.k.a. Device Administrator account) from a menu, and is then prompted for the Device
Administrator Password.
If an LDAP Sign In method is configured, that method will be one of the possible External
Authentication methods displayed in the menu. This method allows for the use of an LDAP
server, such as the Microsoft Active Directory server, for I&A. Both the username and password
are maintained by the LDAP server. The TOE uses the LDAP version 3 protocol over IPsec to
communicate to the LDAP server. If a user selects this method, the user must enter a valid
LDAP account's username and password to be granted access to the TOE.
If a Windows Sign In method is configured, that method will be one of the possible External
Authentication methods displayed in the menu. This method allows for the use of a Windows
domain server for I&A. Both the username and password are maintained by the Windows
domain server. The TOE uses the Kerberos version 5 protocol over IPsec to communicate to the
Windows domain server. If a user selects this method, the user must enter a valid Windows
domain account's username and password to be granted access to the TOE.
Network interfaces
Most of the client network interfaces protected by IPsec perform authentication. Table 50
provides a list of the available IPsec client interfaces to the TOE, whether or not there's an
authentication mechanism associated with the client interface, and a list of TSF-mediated
actions prior to authentication, if any.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 117 of 144
Table 50: IPsec client interfaces
IPsec client
interface
Authentication? TSF-mediated actions prior to authentication?
PJL (a.k.a. P9100) No n/a
EWS Yes Select a sign in method
REST Yes • Discover a subset of the Web Services
• Obtain the X.509v3 certificate on the print
engine
• Obtain the secure configuration settings on
the print engine
• Obtain list of installed licenses
• Install a digitally signed license
• Delete a license (if the license in the
payload of the request is digitally signed)
• Obtain Web Services registration status
• Obtain printer Claim Code for Web
Services registration
• Set printer Claim Code for Web Services
registration
PJL over IPsec
PJL provides all client computers with a non-administrative network interface for submitting
print jobs. The PJL interface uses the username provided in the print job as the user identifier for
the print job on the TOE. Thus, print jobs stored on the TOE will be owned by this username.
This username is by default the username of the human user signed in to the client computer, but
it is possible for the human user submitting the print job to provide a different username for the
print job. The TOE does not require authentication of this username. Table 50 shows any TSF-
mediated actions prior to authentication for this protocol.
EWS over IPsec
The EWS interface is a web browser-based administrative interface used to manage the TOE
over IPsec. The EWS interface requires the user to sign in using the same sign in method menu
options as provided by the Control Panel (i.e., Local Device Sign In, LDAP Sign In, and
Windows Sign In when configured for these sign in methods). Table 50 shows any TSF-
mediated actions prior to authentication for this protocol.
REST over IPsec
The REST interface is an administrative interface used to manage the TOE over IPsec.
The REST interface supports the Local Device Sign In method for I&A which requires the
administrator to authenticate using the Device Administrator account. The Display name and
password are maintained internally by the TOE. For External Authentication, the REST
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 118 of 144
TOE SFRs TOE SFR compliance rationale
interface supports the Windows Sign In method which requires the user to be associated with the
Device Administrator permission set. Table 50 shows any TSF-mediated actions prior to
authentication for this protocol.
Other
Also see the TSS for FIA_UID.1.
AA The evaluator shall check to ensure that the TSS describes all the identification and
authentication mechanisms that the TOE provides (e.g., Internal Authentication and
authentication by external servers).
Resp The Control Panel provides the Local Device Sign In method as the internal I&A
mechanism and provides an LDAP Sign In method and Windows Sign In method as
external I&A mechanisms.
Over the IPsec channel, EWS provides the same sign in methods as the Control Panel.
The REST interface provides the Local Device Sign In and Windows Sign In methods.
AA The evaluator shall check to ensure that the TSS identifies all the interfaces to perform
identification and authentication (e.g., identification and authentication from operation
panel or via Web interfaces).
Resp The Control Panel, EWS, and REST interfaces perform I&A.
AA The evaluator shall check to ensure that the TSS describes the protocols (e.g., LDAP,
Kerberos, OCSP) used in performing identification and authentication when the TOE
exchanges identification and authentication with External Authentication servers.
Resp External Authentication server Protocol
LDAP server LDAP version 3
Windows domain server Kerberos version 5
AA The evaluator shall check to ensure that the TSS contains a description of the permitted
actions before performing identification and authentication, which is consistent with the
definition of the SFR.
Resp On the Control Panel, the user can perform the following actions prior to I&A.
• View the Welcome message
• Reset the session
• Select the Sign In button
• Select a sign-in method from Sign In screen
• View the device status information
• Change the display language for the session
• Place the device into sleep mode
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 119 of 144
TOE SFRs TOE SFR compliance rationale
• View or print the network connectivity status information
• View or print the Web Services status information
• View the help information
• View the system time
For EWS, the user can select a sign in method.
For REST, the user can perform the following actions prior to I&A:
• Discover a subset of the Web Services
• Obtain the X.509v3 certificate on the print engine
• Obtain the secure configuration settings on the print engine
• Obtain list of installed licenses
• Install a digitally signed license
• Delete a license (if the license in the payload of the request is digitally signed)
• Obtain Web Services registration status
• Obtain printer Claim Code for Web Services registration
• Set printer Claim Code for Web Services registration
FIA_UAU.7
(Protected
authentication
feedback)
Objective(s): O.USER.I&A
Summary: The Control Panel (for Internal and External Authentication methods) and EWS (for
Internal and External Authentication methods) display a dot for each password character typed
by the user.
AA The evaluator shall check to ensure that the TSS contains a description of the
authentication information feedback provided to users while the authentication is in
progress, which is consistent with the definition of the SFR.
Resp A dot is displayed for each password character typed by the user on the Control Panel
and EWS for both Internal and External Authentication methods.
FIA_UID.1
(Timing of
identification)
Objective(s): O.ADMIN_ROLES, O.USER.I&A
Summary: From the Control Panel, the user can perform the following actions prior to
identification.
• View the Welcome message
• Reset the session
• Select the Sign In button
• Select a sign-in method from Sign In screen
• View the device status information
• Change the display language for the session
• Place the device into sleep mode
• View or print the network connectivity status information
• View or print the Web Services status information
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 120 of 144
TOE SFRs TOE SFR compliance rationale
• View the help information
• View the system time
Once the IPsec channel is successfully established, the following interfaces initiate their
identification mechanisms. The following shows their TSF-mediated actions prior to
identification.
• EWS:
o Select a sign in method
• REST:
o Discover a subset of the Web Services
o Obtain the X.509v3 certificate on the print engine
o Obtain the secure configuration settings on the print engine
o Obtain list of installed licenses
o Install a digitally signed license
o Delete a license (if the license in the payload of the request is digitally signed)
o Obtain Web Services registration status
o Obtain printer Claim Code for Web Services registration
o Set printer Claim Code for Web Services registration
In all cases, the user cannot perform any other TSF-mediated actions than the ones listed above
until after the user has been successfully identified.
For additional information on I&A, see the TSS for FIA_UAU.1.
AA It is covered by the assurance activities for FIA_UAU.1.
Resp n/a
FIA_USB.1
(User-subject
binding)
Objective(s): O.USER.I&A
Summary:
Control Panel User Identity Binding
Once a Control Panel user has successfully signed in, a username and a role are bound to the
subjects acting on behalf of that user.
For Internal Authentication, if the user signs in using the Local Device Sign In method, the
bound username will be the Display name. Because the Device Administrator is the only Local
Device Sign In account in the evaluated configuration, the username will be the Device
Administrator account's Display name.
For External Authentication, if the user signs in using the LDAP Sign In method, the bound
username will be the user's LDAP username. Similarly, if the user signs in using the Windows
Sign In method, the bound username will be the user's Windows username.
Control Panel and EWS User Role Binding
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 121 of 144
TOE SFRs TOE SFR compliance rationale
The Control Panel user's role is determined by the user's session permission set (PS) that is
bound to the subjects acting on behalf of that user. The Internal Authentication mechanism has
one PS per user. The External Authentication mechanisms have one PS per authentication
method, zero or one PS per user, and zero or one PS per network group to which the user
belongs. For more information on permission sets, see the TSS for FMT_SMR.1.
The role associated with the Local Device Sign In method's Device Administrator account is
always U.ADMIN. The TOE accomplishes this by setting the Device Administrator's session PS
to the Device Administrator PS.
Device Administrator session PS = Device Administrator PS.
The role associated with an External Authentication method's user account (a.k.a. network user
account) can be either U.ADMIN or U.NORMAL. The TOE accomplishes this using various
combinations of permission sets (PSs) depending on the existence of certain types of PSs as
described in the following paragraphs.
External user accounts introduce the concept of network groups. A network group (a.k.a. group)
is a collection of zero or more external user accounts. Each External Authentication method
defines and maintains its own groups. The members of a group are comprised of the external
user accounts from that External Authentication method. An external user account can be
associated with zero or more groups.
A TOE administrator can associate zero or one PS to each group and zero or one PS to each
external user account. These PS associations are stored and maintained on the TOE. A TOE
administrator can create, modify, and delete these associations. By default, there are no PS
associations for external user accounts and groups. For more information on the TOE's
permission set association management, see the TSS for FMT_MSA.1.
A PS is associated with each External Authentication method. These associations are also stored
and maintained on the TOE. A TOE administrator can modify these associations.
The TOE combines these various PSs using one of the following three methods.
Method #1: If the external user account has a PS association, then the TOE combines the
external user account's PS and the Device Guest PS to create the external user’s session PS.
User session PS = External user account PS + Device Guest PS.
Method #2: If the external user account does not have an associated PS, the TOE obtains the
groups to which the external user account is a member. For each of these groups, the TOE looks
for matching group-to-PS associations. For each group-to-PS association match, the TOE
combines that group’s PS with any previously found group PSs. Once all matches have been
found, the TOE combines these group PSs with the Device Guest PS to create the external user's
session PS.
User session PS = Network group PSs + Device Guest PS.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 122 of 144
TOE SFRs TOE SFR compliance rationale
Method #3: If there are no group-to-PS associations found for the external user account and the
external user account does not have an associated PS, then the TOE combines the External
Authentication method's PS and the Device Guest PS to create the external user’s session PS.
User session PS = External Authentication method PS + Device Guest PS.
An administrator can associate one sign in method to a Control Panel application. This
association limits the application to run only when the user signs in using the associated sign in
method. For example, if an application is only associated with the LDAP Sign In method, a user
must sign in using the LDAP Sign In method in order to run that application. The enforcement
of this association is controlled by the "Allow users to choose alternate sign-in methods"
function. If this function is enabled, then the sign in method permissions are ignored. If this
function is disabled, then the user's session PS calculated above will be reduced to exclude the
permissions of applications whose sign in method does not match the sign in method used by the
user to sign in.
Remote User Identity Binding
Once an IPsec client computer has performed a successful IPsec connection with the TOE, the
TOE uses the client's IP address as the client's user identifier for IPsec-related audit records.
The EWS and REST interfaces support I&A mechanisms and use some form of username (e.g.,
Display name, Windows username) in audit records.
In the case of EWS, the interface provides the same options as the Control Panel for sign in
methods. Because of this, the EWS identity will be the Display name if the Local Device Sign In
method is selected by the user, the LDAP username if the LDAP Sign In method is selected by
the user, or the Windows username if the Windows Sign In method is selected by the user. From
an auditing and access control perspective, the IP address is used by IPsec when generating
IPsec-related and network-related audit records. The EWS identity (i.e., Display name, LDAP
username, Windows username) is used for all other identity-related purposes such as
management-related tasks and audit records and access control enforcement and audit records.
In the case of the REST interface, both the Local Sign In method and Windows Sign In method
are used for I&A. When authenticating via the Local Sign In Method, the REST identity will be
the Display name. When authenticating via the Windows Sign In Method, the REST identity
will be the Windows username.
From an auditing and access control perspective, the IP address is used by IPsec when
generating IPsec-related and network-related audit records. The REST identity is used for all
other identity-related purposes such as management-related tasks and audit records and access
control enforcement and audit records.
Note: The PJL over IPsec interface contains a print job username as part of the print job data.
This username is used by the TOE as the owner of the print job object when storing the print job
on the TOE. The owner is not the user identity of the client computer. The IP address of the
client computer is the user identity of the client computer.
Remote User Role Binding
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 123 of 144
TOE SFRs TOE SFR compliance rationale
In the case of EWS, the role is determined by the login account used by the user when logging in
to the EWS interface.
In the case of PJL, the PJL interface only supports unauthenticated users. No specific role exists
for these users.
In the case of the REST interface, the role is determined by the login account used by the user
when logging in to the REST interface.
Other
For all TOE I&A, once a user is signed in, the TOE does not provide the user with a way to
modify their bound username and role.
AA The evaluator shall check to ensure that the TSS contains a description of rules for
associating security attributes with the users who succeed identification and
authentication, which is consistent with the definition of the SFR.
Resp See the explanation in the Summary section above.
FMT_MOF.1
(Management
of functions)
Objective(s): O.ADMIN_ROLES
Summary:
Allow users to choose alternate sign-in methods at the product control panel: With the “Allow
users to choose alternate sign-in methods at the product control panel” function, the TOE
provides an administrator the ability to enable and disable this function. When this function is
disabled, it requires the user to sign in using the sign-in method associated with the selected
application in order to access that application. This function is restricted to U.ADMIN and can
be performed through the EWS interface. For related information, see the TSS for FIA_USB.1.
Control Panel Mandatory Sign-in: With the “Control Panel Mandatory Sign-in” function, the
TOE provides an administrator the ability to enable and disable this function. This function must
be enabled in the evaluated configuration. This function is restricted to U.ADMIN and can be
performed through the EWS interface.
Windows Sign In: With the Windows Sign In function, the TOE provides an administrator the
ability to enable and disable the Windows Sign In method. This function is restricted to
U.ADMIN and can be performed through the EWS interface. At least one External
Authentication mechanism must be enabled in the evaluated configuration. For related
information, see the TSS for FIA_ATD.1 and TSS for FIA_UAU.1.
LDAP Sign In: With the LDAP Sign In function, the TOE provides an administrator the ability
to enable and disable the LDAP Sign In method. This function is restricted to U.ADMIN and
can be performed through the EWS interface. At least one External Authentication mechanism
must be enabled in the evaluated configuration. For related information, see the TSS for
FIA_ATD.1 and TSS for FIA_UAU.1.
Account lockout: With the account lockout function, the TOE provides an administrator the
ability to enable and disable the account lockout function of the Device Administrator account.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 124 of 144
TOE SFRs TOE SFR compliance rationale
This function must be enabled in the evaluated configuration. This function is restricted to
U.ADMIN. The Device Administrator's account lockout function can be enabled and disabled
through the EWS interface. For related information, see the TSS for FIA_AFL.1.
Enhanced security event logging: With the enhanced security event logging function, the TOE
provides an administrator the ability to enable and disable the generation of additional security
events. This function must be enabled in the evaluated configuration. This function is restricted
to U.ADMIN and can be performed through the EWS interface. For related information, see the
TSS for FAU_GEN.1.
Managing Temporary Job Files: With this image overwrite function, the TOE provides an
administrator the ability to determine which one of the three overwrite options is currently
selected (i.e., determine the behavior of the overwrite function) and to modify the selection (i.e.,
modify the behavior of the overwrite function). In the evaluated configuration, an administrator
must select between either Secure Fast Erase or Secure Sanitize Erase. The Non-Secure Fast
Erase option must not be selected in the evaluated configuration. This function is restricted to
U.ADMIN and can be performed through the EWS interface. For related information, see the
TSS for FDP_RIP.1(a).
IPsec: With the IPsec function, the TOE provides an administrator the ability to enable and
disable IPsec. IPsec must be enabled in the evaluated configuration. This function is restricted to
U.ADMIN and can be performed through the EWS interface. For related information, see the
TSS for FCS_IPSEC_EXT.1.
Automatically synchronize with a Network Time Service: With the "Automatically synchronize
with a Network Time Service" function, the TOE provides an administrator the ability to enable
and disable NTS. NTS must be enabled in the evaluated configuration. This function is restricted
to U.ADMIN and can be performed through the EWS interface. For related information, see the
TSS for FPT_STM.1. Also see the management operations for "NTS server configuration data"
in the TSS for FMT_MTD.1.
AA The evaluator shall check to ensure that the TSS contains a description of the
management functions that the TOE provides as well as user roles that are permitted to
manage the functions, which is consistent with the definition of the SFR.
The evaluator shall check to ensure that the TSS identifies interfaces to operate the
management functions.
Resp The required information is provided in the Summary section above.
FMT_MSA.1
(Management
of attributes)
Objective(s): O.ACCESS_CONTROL, O.USER_AUTHORIZATION
Summary: Depending on the interface used to access the TOE, the security attributes used by
the TOE's access control mechanism described in FDP_ACF.1 vary. The easiest way to describe
these attributes is to split them into the following categories.
• Control Panel and EWS subject attributes (identities and roles)
• Job Storage object attributes
Control Panel and EWS identities
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 125 of 144
TOE SFRs TOE SFR compliance rationale
The TOE's access control mechanism uses the identities supplied by the Control Panel and EWS
interfaces to control access to objects. This makes identities a subject security attribute of the
access control mechanism.
The TOE supports both Internal and External Authentication mechanisms in the evaluated
configuration.
Account identity (Internal Authentication mechanism): The Internal Authentication
mechanism contains only one account in the evaluated configuration. This account is the
predefined Device Administrator account. This account has a Display name (i.e., subject
identity). This Display name could be used by the access control mechanism to compare job
ownership, but since this account has the Device Administrator permission set permanently
associated with it, this account is granted administrative access by default. The TOE does not
provide any management operations for this account's identity. This is reflected in FMT_MSA.1
in Table 31. Because there are no management operations, the authorized roles entry is marked
as not applicable (n/a) in Table 31. There is no default value property for the Display name
because the account is predefined, thus, Table 31 shows this as not applicable (n/a). Similarly,
no role can override the default value.
Account identity (External Authentication mechanisms): The External Authentication
mechanisms are part of the Operational Environment. An external account's identity (a.k.a. user
name or account name) is used as a subject security attribute to grant or deny access to access
controlled objects (a.k.a. jobs) on the TOE. The external account identities are maintained by
and on the External Authentication mechanisms. The TOE does not support any management
operations on the account identities maintained by the External Authentication mechanisms as
shown in FMT_MSA.1 in Table 31. Because the TOE has no control over these external account
identities, there is no default value property (marked as n/a in Table 31) and no default value to
override, thus, no role can override the default value.
Control Panel and EWS roles
The TOE's access control mechanism also uses permission sets to control access to objects on
the TOE. Permission sets are used to determine user roles on the TOE. The TSS for
FMT_SMR.1 contains an explanation of permission sets. Permission sets can be associated with
internal user accounts, external user accounts (network users), network groups, and to External
Authentication mechanisms. When a user logs in via the Control Panel or EWS, the user's
session permission set is calculated by the TOE based on the rules described in the TSS for
FIA_USB.1. The user's session permission set is used to determine a user's access to access
controlled objects (a.k.a. jobs) on the TOE.
Device Administrator permission set permissions: For the Device Administrator permission set
permissions, the TOE provides the "view" management operation. This management operation
is restricted to U.ADMIN. This permission set comes predefined in the TOE. Its default value
property is considered permissive because its predefined value allows access to everything.
Because this value is predefined, there is no default value override role associated with it.
Device User and Device Guest permission set permissions: For the Device User permission set
permissions and the Device Guest permission set permissions, the TOE provides the "modify
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 126 of 144
TOE SFRs TOE SFR compliance rationale
and view" management operations. These management operations are restricted to U.ADMIN.
These permission sets come predefined in the TOE. Their default value properties are
considered restrictive because their predefined values are more restrictive than the Device
Administrator permission set. Because these values are predefined, there is no default value
override role associated with them.
Custom permission set permissions: For custom permission set permissions, the TOE provides
the "create, modify, delete, and view" management operations. These management operations
are restricted to U.ADMIN. A custom permission set's default value property is considered
restrictive because its initial value upon creation is an empty permission set. This default value
property cannot be overridden, therefore, there is no role that can override this default value.
Job Storage ownerships
Ownership (job owner) of Job Storage objects is assigned as the object enters the TOE. The
TOE does not provide a method to modify the ownership of an object after the object is created.
Only authenticated users can access the Job Storage area.
Job owner: For job ownership, the TOE provides the "view" ownership management operation.
This operation is available to the job owner and U.ADMIN. There is no default value property
for a job. The owner is either a Control Panel user or it is the owner specified in a print job
submitted over the PJL interface. Because there is no default value property, there is no role that
can override the default value property.
AA The evaluator shall check to ensure that the TSS contains a description of possible
operations for security attributes and given roles to those security attributes, which is
consistent with the definition of the SFR.
Resp n/a
FMT_MSA.3
(Initialization
of attributes)
Objective(s): O.ACCESS_CONTROL, O.USER_AUTHORIZATION
Summary: The descriptions have been provided in the TSS for FMT_MSA.1.
AA The evaluator shall check to ensure that the TSS describes mechanisms to generate
security attributes which have properties of default values, which are defined in the
SFR.
Resp The descriptions have been provided in the TSS for FMT_MSA.1.
FMT_MTD.1
(Management
of TSF data)
Objective(s): O.ACCESS_CONTROL
Summary:
TSF Data owned by U.NORMAL or associated with Documents or jobs owned by a U.NORMAL
None: U.NORMAL doesn't own any TSF Data on the TOE. The security attributes associated
with Documents or jobs owned by U.NORMAL are covered by FMT_MSA.1.
List of TSF Data not owned by U.NORMAL
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 127 of 144
TOE SFRs TOE SFR compliance rationale
Device Administrator password: For the Device Administrator password, the TOE provides the
"change" operation. The change operation allows a U.ADMIN to change the Device
Administrator's password. This operation is restricted to U.ADMIN. For related information, see
the TSS for FIA_PMG_EXT.1.
Permission set associations (except on the Device Administrator account): For all permission
set associations for any external user account, network group, and External Authentication
mechanism, the TOE provides the "add, delete, change, and view" management operations.
These management operations are restricted to U.ADMIN. For related information, see the TSS
for FDP_ACF.1 and TSS for FMT_MSA.1.
Permission set associations (only on the Device Administrator account): The Device
Administrator account is the only internal, built-in account in the evaluated configuration. This
account has the Device Administrator permission set permanently associated with it. The only
management operation provided for the Device Administrator account's permission set
association is the "view" operation. This can only be performed by a U.ADMIN (including the
Device Administrator). For related information, see the TSS for FDP_ACF.1 and TSS for
FMT_MSA.1.
Note: Although audit records are TSF Data not owned by U.NORMAL, the TOE does not
provide the ability to management audit records.
List of software, firmware, and related configuration data
IPsec CA and identity certificates: For the IPsec CA certificates, the TOE provides the "import
and delete" operations through the EWS interface. The import operation adds a CA certificate to
the TOE. The delete operation removes the selected CA certificate from the TOE. These
operations are restricted to U.ADMIN. The TOE may contain one or more CA certificates.
For the IPsec identity certificates, the TOE provides the "import and delete" operations for CA-
signed identity certificates through the EWS interface. The import operation adds a CA-signed
identity certificate to the TOE. The delete operation removes the CA-signed identity certificate
from the TOE. These operations are restricted to U.ADMIN.
The TOE initially comes with a self-signed identity certificate for IPsec. This self-signed
identity certificate is generated during manufacturing of the TOE and cannot be deleted. This
self-signed identity certificate must not be used in the evaluated configuration. Instead, the
[CCECG] section Certificates instructs the U.ADMIN to import a CA-signed identity certificate
and to set this CA-signed identity certificate as the TOE's IPsec certificate. The TOE only
allows one certificate to be its IPsec certificate.
IPsec pre-shared keys: For the IPsec pre-shared keys, the TOE provides the "set and change"
operations. The set operation is used to set an initial pre-shared key value. The change operation
allows an administrator to change the pre-shared key value. This operation is restricted to
U.ADMIN. The hash algorithm used on the pre-shared key is selectable. The pre-shared keys
are part of the IPsec policy. For related information on pre-shared keys, see the TSS for
FIA_PSK_EXT.1.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 128 of 144
TOE SFRs TOE SFR compliance rationale
NTS server configuration data: For the NTS server settings, the TOE provides the "change"
operation. The change operation allows an administrator to change the configuration data
associated with the NTS server. This operation is restricted to U.ADMIN. For related
information, see the TSS for FPT_STM.1. The NTS server function must be enabled for the
NTS server configuration data to have an effect. For more information on the NTS server
enablement, see the "Automatically synchronize with a Network Time Service" function in the
TSS for FMT_MOF.1.
Minimum password length: For the minimum password length setting, the TOE provides the
"change" operation. The TOE provides the minimum password length setting for the Device
Administrator account. This operation is restricted to U.ADMIN. For related information, see
the TSS for FIA_PMG_EXT.1.
Account lockout maximum attempts: For the account lockout maximum attempts value, the
TOE provides the "change" operation. This value allows an administrator to control the number
of failed login attempts before the account is locked. The administrator can choose a value
between 3 and 10 inclusively. Consecutive failed authentication attempts using the same
authentication credential count as a single failed authentication attempt. The counted failed
attempts must happen within the value set for the account reset lockout counter interval value;
otherwise, the maximum attempts counter is reset. The account lockout maximum attempt value
affects the Device Administrator account. The change operation is restricted to U.ADMIN. For
more information on account lockout in general, see the TSS for FIA_AFL.1. The account
lockout function must be enabled for the account lockout maximum attempts value to have an
effect. For information on the account lockout enablement function, see the TSS for
FMT_MOF.1.
Account lockout interval: For the account lockout interval value, the TOE provides the
"change" operation. This value allows an administrator to control the length of time that the
account remains locked. The administrator can choose a value between 60 and 1800 seconds
inclusively in the evaluated configuration. The account lockout interval value affects the Device
Administrator account. The change operation is restricted to U.ADMIN. For more information
on account lockout in general, see the TSS for FIA_AFL.1. The account lockout function must
be enabled for the account lockout interval value to have an effect. For information on the
account lockout enablement function, see the TSS for FMT_MOF.1.
Account reset lockout counter interval: For the account reset lockout counter interval value, the
TOE provides the "change" operation. This value allows an administrator to specify the time (in
seconds) in which the failed login attempts must occur before the account lockout maximum
attempts counter is reset. This value must be equal to or greater than the account lockout interval
value. The account reset lockout counter interval value affects the Device Administrator
account. The change operation is restricted to U.ADMIN. For more information on account
lockout in general, see the TSS for FIA_AFL.1. The account lockout function must be enabled
for the account reset lockout counter interval value to have an effect. For information on the
account lockout enablement function, see the TSS for FMT_MOF.1.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 129 of 144
TOE SFRs TOE SFR compliance rationale
Session inactivity timeout: For the session inactivity timeout, the TOE provides the "change"
operation. The change operation allows an administrator to change the amount of time of
inactivity before automatically logging out the user from an interactive session. This timeout
works for both Control Panel and EWS sessions. The Control Panel and EWS interfaces have
independent session inactivity timeout values. The change operation is restricted to U.ADMIN
for both interfaces. For related information, see the TSS for FTA_SSL.3.
AA None
Resp n/a
FMT_SMF.1
(Management
functions)
Objective(s): O.ACCESS_CONTROL, O.ADMIN_ROLES, O.USER_AUTHORIZATION
Summary: Table 33 in FMT_SMF.1 provides a mapping of each management function to its
respective management SFR, to its objectives, and to the respective management SFR's TSS
page. The SFR's TSS provides a more detailed description of the matching management
function.
The following objectives do not have security management functionality defined for them in this
ST.
• O.KEY_MATERIAL
• O.STORAGE_ENCRYPTION
• O.TSF_SELF_TEST
• O.UPDATE_VERIFICATION
AA The evaluator shall check the TSS to ensure that the management functions are
consistent with the assignment in the SFR.
Resp n/a
FMT_SMR.1
(Security roles)
Objective(s): O.ACCESS_CONTROL, O.ADMIN_ROLES, O.USER_AUTHORIZATION
Summary: The TOE supports two roles:
• U.ADMIN
• U.NORMAL
The TOE can associate users with roles, but there is an account that is always associated with a
specific role. Specifically, the Device Administrator account (available through the Control
Panel, EWS, and REST interfaces) is of type U.ADMIN.
Permission sets
The TOE implements roles through the use of permission sets. Permission sets are used to
determine which Control Panel applications a Control Panel user can access and which EWS
interfaces an EWS user can access. A permission set contains a list of allowed permissions
where each permission determines access to a single Control Panel application or a single EWS
interface.
The TOE contains the following built-in permission sets.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 130 of 144
TOE SFRs TOE SFR compliance rationale
• Device Administrator—Grants administrative capabilities
• Device User—Grants typical user capabilities
• Device Guest—Grants capabilities to non-signed in users
These built-in permission sets cannot be renamed or deleted. The Device Administrator
permission set cannot be modified, but an administrator can modify the permissions in the
Device User and Device Guest permission sets. In the evaluated configuration, the Device Guest
permission set is empty (i.e., contains no permissions) by default. (Device Guest is mentioned
here because its definition is used in the TSS for FIA_USB.1.)
As an alternative to built-in permission sets, administrators can create custom permission sets
that allow an administrator to better map the TOE's permissions to the usage model of their
organization. Administrators can also modify and delete any existing custom permission sets.
By default, the TOE comes with no custom permission sets.
Besides user accounts, permission sets can also be assigned to sign in methods—Local Device
Sign In, LDAP Sign In, and Windows Sign In—and network groups to which an external user
account is a member. (A network group is a collection of external user accounts located on a
single External Authentication mechanism. The network group and group members are defined
on the External Authentication mechanism.)
When a user logs in to the TOE, their session permission set is determined by a combination of
factors. For more details on how permission sets are determined, see the TSS for FIA_USB.1.
All permission sets are stored and maintained locally on the TOE. This means that the
permission sets for the internal user accounts, external user accounts, authentication
mechanisms, and network groups are all stored and maintained locally on the TOE.
AA The evaluator shall check to ensure that the TSS contains a description of security
related roles that the TOE maintains, which is consistent with the definition of the SFR.
Resp n/a
FPT_KYP_EX
T.1
(Key chain key
protection)
Objective(s): O.KEY_MATERIAL
Summary: As per FCS_KYC_EXT.1, the key chain is a key chain of one containing only the
BEV. The BEV is stored in non-field replaceable nonvolatile storage (SPI flash and EEPROM)
located inside the TOE. For more information on the key chain and BEV, see the TSS for
FCS_KYC_EXT.1.
AA None
Resp n/a
FPT_SKP_EX
T.1
(Key viewing
protection)
Objective(s): O.COMMS_PROTECTION
Summary: The TOE is a closed system and does not provide an interface to read pre-shared
keys, symmetric keys, or private keys. As a closed system, it does not allow administrators to
read memory or to access storage directly.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 131 of 144
TOE SFRs TOE SFR compliance rationale
The TOE's EWS provides an interface to enter IPsec pre-shared key values. This interface does
not allow the administrator to query the current pre-shared key value. No other external
interfaces allow for the entering or reading of pre-shared keys.
The TOE stores the IPsec pre-shared keys in a file on the field-replaceable SED. This file is not
accessible through any interface. For more details on the IPsec pre-shared keys, see the TSS for
FCS_CKM.4, TSS for FCS_IPSEC_EXT.1, and TSS for FIA_PSK_EXT.1.
The SED drive-lock password (a.k.a. BEV) can be considered a symmetric key. This password
is stored in cleartext in SPI flash and EEPROM, but the TOE does not provide an interface to
view this key or to access SPI flash or EEPROM. For more details on the SED drive-lock
password, see the TSS for FCS_KYC_EXT.1.
Ephemeral asymmetric and symmetric keys created and used in IPsec sessions are inaccessible
by any user because the TOE does not provide a user interface to read memory.
The TOE's private asymmetric keys found in X.509v3 certificates (used by IPsec) can be
imported by the TOE, but the EWS interface does not display the private keys contained in these
certificates.
AA The evaluator shall examine the TSS to determine that it details how any pre-shared
keys, symmetric keys, and private keys are stored and that they are unable to be viewed
through an interface designed specifically for that purpose, as outlined in the
application note. If these values are not stored in plaintext, the TSS shall describe how
they are protected/obscured.
Resp The TOE is a closed system and does not provide an interface to read pre-shared keys,
symmetric keys, or private keys. The description above provides extended details.
FPT_STM.1
(Time stamps)
Objective(s): O.AUDIT
Summary: Although [HCDPP] only maps O.AUDIT to FPT_STM.1, it is worth noting that
reliable timestamps are also used by O.COMMS_PROTECTION and
O.UPDATE_VERIFICATION when validating the validity period of certificates and by
O.USER_I&A when performing session inactivity timeouts and authentication failure handling.
The TOE contains an internal system clock that is used to generate reliable timestamps. The
TOE requires the use of an NTS service to keep the internal system clock's time synchronized.
Only administrators can manage the system clock and the TOE's configuration of NTS.
AA The evaluator shall check to ensure that the TSS describes mechanisms that provide
reliable time stamps.
Resp The TOE contains an internal system clock that is synchronized using an NTS.
FPT_TST_EX
T.1
(TSF testing)
Objective(s): O.TSF_SELF_TEST
Summary: The TOE contains TSF testing functionality called Whitelisting to help ensure only
authentic, known-good firmware files that have not been tampered with are loaded into memory.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 132 of 144
TOE SFRs TOE SFR compliance rationale
The TOE supports dm-verity to protect the integrity of the SquashFS file system firmware
images. On each boot, the TOE verifies the digital signature of the dm-verity hash tree
corresponding to a SquashFS file system image using RSA-2048 with SHA2-256. During
operation, the TOE verifies the integrity of a file system block before loading it into memory.
If the digital signature verification fails, or the integrity check of a file system block fails,
Whitelisting will reboot the HCD, and the Basic Input/Output System (BIOS) will hold on boot
with an error message displayed on the Control Panel UI.
Whitelisting uses the HP FutureSmart Firmware OpenSSL implementation for both the RSA
2048-bit and SHA2-256 algorithms. For additional details on these algorithms, see the TSS for
FCS_COP.1(b) and TSS for FCS_COP.1(c).
AA The evaluator shall examine the TSS to ensure that it details the self-tests that are run by
the TSF on start-up; this description should include an outline of what the tests are
actually doing (e.g., rather than saying "memory is tested", a description similar to
"memory is tested by writing a value to each memory location and reading it back to
ensure it is identical to what was written" shall be used). The evaluator shall ensure that
the TSS makes an argument that the tests are sufficient to demonstrate that the TSF is
operating correctly.
Resp The TOE performs Whitelisting of the SquashFS file system firmware images while
booting. If digital signature verification fails of a dm-verity hash tree corresponding to
any of the SquashFS file system firmware images, or the integrity check of file system
block fails, the TOE reboots and the BIOS will hold on boot with an error message
displayed on the Control Panel UI. More detail is provided above.
FPT_TUD_EX
T.1
(Trusted
update)
Objective(s): O.UPDATE_VERIFICATION
Summary: The TOE's firmware can be updated by an administrator by downloading an update
image and installing it on the TOE.
Each update image is digitally signed by the HCD manufacturer using the RSA 2048-bit and
SHA2-256 algorithms. Each HCD has a factory-installed public key certificate from HP used by
the TOE for verifying the update image's digital signature.
Once the update image is downloaded from the kiosk and loaded onto the Administrative
Computer, the update image can be uploaded to the TOE through the TOE’s EWS interface.
Once uploaded, the TOE performs digital signature verification on each update image prior to
installing using the RSA 2048-bit and SHA2-256 algorithms and the factory installed certificate.
If the TOE's signature verification fails, the TOE won't allow the update to proceed. The TOE
uses the HP FutureSmart Firmware OpenSSL implementation of these algorithms. The RSA
2048-bit algorithm is defined in FCS_COP.1(b). The SHA2-256 hash algorithm is defined in
FCS_COP.1(c). The [CCECG] section Updating TOE firmware describes the steps to update the
TOE.
The current version of both the System firmware and the Jetdirect Inside firmware can be
obtained through the following interfaces.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 133 of 144
TOE SFRs TOE SFR compliance rationale
• Control Panel
• EWS
How to obtain the firmware versions using the EWS is described in the [CCECG] section Check
version of installed TOE firmware.
Note: The HP Inc. Software Depot kiosk provides a SHA2-256 published hash of the update
image and a Windows OS utility program that can be downloaded and used to verify the hash.
Once downloaded, the update image can be verified on a separate computer prior to installation
on the TOE using the published hash and the Windows OS utility program. Because the
published hash verification is not performed by the TSF, the SHA2-256 published hash
verification method is excluded from this SFR.
AA The evaluator shall check to ensure that the TSS contains a description of mechanisms
that verify software for update when performing updates, which is consistent with the
definition of the SFR.
The evaluator shall check to ensure that the TSS identifies interfaces for administrators
to obtain the current version of the TOE as well as interfaces to perform updates.
Resp The TOE uses a digital signature to verify update images. The signature uses RSA 2048-
bit and SHA2-256. The public key certificate used to validate the signatures is factory-
installed on the TOE.
The TOE's update images can be downloaded from the HP Inc. Software Depot kiosk
and installed using the TOE's EWS interface in the evaluated configuration.
The current version of both the System firmware and the Jetdirect Inside firmware can
be obtained through the following interfaces.
• Control Panel
• EWS
FTA_SSL.3
(Interactive
session
termination)
Objective(s): O.USER_I&A
Summary: This SFR applies to the interactive sessions for the Control Panel and EWS. The
TOE's REST interface does not support the concept of sessions.
Control Panel
The TOE supports an inactivity timeout for Control Panel sessions. If a signed in user is inactive
for longer than the specified period, the user is automatically signed off of the TOE. The
inactivity period is configurable by the administrator via the EWS (HTTP) and Control Panel
interfaces. A single Control Panel inactivity period setting exists per TOE. This setting is
separate from the EWS setting. For more information on configuring the Control Panel's session
timeout, see the TSS for FMT_MTD.1.
EWS
The TOE supports an inactivity timeout for EWS interactive sessions. The EWS session timeout
setting is used to set the inactivity timeout period. This setting is configurable via the EWS
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 134 of 144
TOE SFRs TOE SFR compliance rationale
interface. This setting is separate from the Control Panel setting. For more information on
configuring the EWS's session timeout, see the TSS for FMT_MTD.1.
AA The evaluator shall check to ensure that the TSS describes the types of user sessions to
be terminated (e.g., user sessions via operation panel or Web interfaces) after a
specified period of user inactivity.
Resp All Control Panel and EWS sessions support session termination. Both have
administratively configurable timeout periods.
FTP_ITC.1
(Trusted
channel)
Objective(s): O.AUDIT, O.COMMS_PROTECTION
Summary: The TOE uses IPsec to provide a trusted communications channel between itself and
all authorized IT entities. Each channel is logically distinct from other communication channels
and provides assured identification of its end points and protection of the channel data from
disclosure and detection of modification of the channel data.
The TOE provides and initiates trusted communication channels to the following authorized IT
entities.
• authentication server
• DNS server
• NTS server
• SMB server
• SMTP server
• syslog server (audit server)
• WINS server
For more information on IPsec, see the TSS for FCS_IPSEC_EXT.1.
AA The evaluator shall examine the TSS to determine that, for all communications with
authorized IT entities identified in the requirement, each communications mechanism is
identified in terms of the allowed protocols for that IT entity. The evaluator shall also
confirm that all protocols listed in the TSS are specified and included in the
requirements in the ST. The evaluator shall confirm that the operational guidance
contains instructions for establishing the allowed protocols with each authorized IT
entity, and that it contains recovery instructions should a connection be unintentionally
broken.
Resp All trusted communications channels to authorized IT entities use IPsec.
FTP_TRP.1(a)
(Administrator
trusted path)
Objective(s): O.COMMS_PROTECTION
Summary: The TOE uses IPsec to provide a trusted communication path between itself and
remote administrators. Each path is logically distinct from other communication paths and
provides assured identification of its end points and protection of the communicated data from
disclosure and detection of modification of the communicated data.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 135 of 144
TOE SFRs TOE SFR compliance rationale
The following interfaces are the remote administrative interfaces of the TOE in the evaluated
configuration.
• EWS (via a web browser)
• REST
For more information on IPsec, see the TSS for FCS_IPSEC_EXT.1.
AA The evaluator shall examine the TSS to determine that the methods of remote TOE
administration are indicated, along with how those communications are protected. The
evaluator shall also confirm that all protocols listed in the TSS in support of TOE
administration are consistent with those specified in the requirement, and are included
in the requirements in the ST.
Resp All remote administrative interfaces use IPsec. The remote administrative interfaces are
EWS and REST.
FTP_TRP.1(b)
(User trusted
path)
Objective(s): O.COMMS_PROTECTION
Summary: The TOE uses IPsec to provide a trusted communication path between itself and
remote, non-administrative users. Each path is logically distinct from other communication
paths and provides assured identification of its end points and protection of the communicated
data from disclosure and detection of modification of the communicated data.
The TOE supports the connection of multiple remote non-administrative users. The following
interface is the remote non-administrative interface of the TOE in the evaluated configuration.
• PJL
For more information on IPsec, see the TSS for FCS_IPSEC_EXT.1.
AA The evaluator shall examine the TSS to determine that the methods of remote TOE
access for non-administrative users are indicated, along with how those
communications are protected.
The evaluator shall also confirm that all protocols listed in the TSS in support of remote
TOE access are consistent with those specified in the requirement, and are included in
the requirements in the ST.
Resp All remote non-administrative users connect through the PJL interface. The TOE
requires all PJL connections to use IPsec.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 136 of 144
8 Abbreviations, Terminology and References
8.1 Abbreviations
AA Assurance Activity
AES Advanced Encryption Standard
AH Authentication Header (IPsec)
Arm Advanced RISC Machine
ASCII American Standard Code for Information Interchange
BEV Border Encryption Value
CA Certificate Authority
CBC Cipher Block Chaining
CC Common Criteria
CCEVS Common Criteria Evaluation and Validation Scheme
CCITT Consultative Committee for International Telephony and Telegraphy
cert certificate
cPP Collaborative Protection Profile
CSEC The Swedish Certification Body for IT Security
CSP Critical Security Parameter
CTR Counter mode
CTR_DRBG Counter mode DRBG
CVL Component Validation List
DEK Data Encryption Key
DH Diffie-Hellman
DLL Dynamic-Link Library
DNS Domain Name System
DRBG Deterministic Random Bit Generator
DSA Digital Signature Algorithm
DSS Digital Sending Software
EAL Evaluated Assurance Level
ECB Electronic Code Book
EE Encryption Engine (FDE)
EEPROM Electrically Erasable Programmable Read-Only Memory
EIA Electronic Industries Alliance
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 137 of 144
ESN Extended Sequence Numbers (IPsec)
ESP Encapsulating Security Payload (IPsec)
EWS Embedded Web Server
FDE Full Drive Encryption
FFC Finite Field Cryptography
FIPS Federal Information Processing Standard
HCD Hardcopy Device
HCDPP Hardcopy Device Protection Profile
HMAC Hashed Message Authentication Code
HP Hewlett-Packard
I&A Identification and Authentication
IETF Internet Engineering Task Force
IKE Internet Key Exchange (IPsec)
IP Internet Protocol
IPv4 IP version 4
IPv6 IP version 6
IPsec Internet Protocol Security
ISAKMP Internet Security Association Key Management Protocol (IPsec)
ITU-T International Telegraph Union Telecommunication Standardization Sector
KAS Key Agreement Scheme
kbps Kilobits Per Second
KDF Key Derivation Function
LAN Local Area Network
LCD Liquid-crystal Display
LDAP Lightweight Directory Access Protocol
MFP Multifunction Printer
MODP Modular Exponential
n/a Not applicable
NFC Near Field Communication
NIAP National Information Assurance Partnership
NIST National Institute of Standards and Technology
NTLM Microsoft NT LAN Manager
NTS Network Time Service
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 138 of 144
OSP Organizational Security Policy
OXP Open Extensibility Platform
OXPd OXP device layer
PDF Portable Document Format
PJL Printer Job Language
PKCS Public-Key Cryptography Standards
PP Protection Profile
PS Permission Set
PSK Pre-Shared Key
PSTN Public Switched Telephone Network
REST Representational State Transfer
RFC Request for Comments
RSA Rivest-Shamir-Adleman
SA Security Association
SAR Security Assurance Requirement
SATA Serial AT Attachment
SED Self-Encrypting Drive
SFP Single-Function Printer
SFR Security Functional Requirement
SHA Secure Hash Algorithm
SHS Secure Hash Standard
SMB Server Message Block
SMTP Simple Mail Transfer Protocol
SNMP Simple Network Management Protocol
SP Special Publication
SPD Security Policy Database (IPsec)
SPD Security Problem Definition (CC)
SPI Serial Peripheral Interface
SSC Security Subsystem Class
SSH Secure Shell
ST Security Target
TCG Trusted Computing Group
TIA Telecommunications Industry Association
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 139 of 144
TLS Transport Layer Security
TOE Target of Evaluation
TSF TOE Security Functionality
TSP TOE Security Policy
TSS TOE Summary Specification
UI User Interface
USB Universal Serial Bus
W3C World Wide Web Consortium
WINS Windows Internet Name Service
WLAN Wireless Local Area Network
WS Web Services
8.2 Terminology
This section contains definitions of technical terms that are used with a meaning specific to this document. Terms
defined in the [CC] are not reiterated here, unless stated otherwise.
Administrative User This term refers to a user with administrative control of the TOE.
Authentication Data This includes the Access Code and/or password for each user of the product.
Border Encryption Value (BEV) A secret value passed to a storage encryption component such as a self-
encrypting storage device.
Control Panel Application An application that resides in the firmware and is selectable by the user via
the Control Panel.
Data Encryption Key (DEK) A key used to encrypt data-at-rest.
Device Administrator Password The password used to restrict access to administrative tasks via EWS, REST,
and the Control Panel interfaces. This password is also required to associate
a user with the Administrator role. In product documentation, it may also be
referred to as the Local Device Administrator Password, Local Device
Administrator Access Code, the Device Password, or the Administrator
Password.
External Interface A non-hardcopy interface where either the input is being received from
outside the TOE or the output is delivered to a destination outside the TOE.
Hardcopy Device (HCD) This term generically refers to the product models in this Security Target.
Intermediate Key A key used in a point between the initial user authorization and the DEK.
Near Field Communication (NFC) Proximity (within a few inches) radio communication between two or more
devices.
Submask A submask is a bit string that can be generated and stored in a number of
ways, such as passphrases, tokens, etc.
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 140 of 144
TOE Owner A person or organizational entity responsible for protecting TOE assets and
establishing related security policies.
User Security Attributes Defined by functional requirement FIA_ATD.1, every user is associated with
one or more security attributes which allow the TOE to enforce its security
functions on this user.
8.3 References
CC Common Criteria for Information Technology Security Evaluation
Version 3.1R5
Date April 2017
Location http://www.commoncriteriaportal.org/files/ccfiles/CCPART1V3.1R5.pdf
Location http://www.commoncriteriaportal.org/files/ccfiles/CCPART2V3.1R5.pdf
Location http://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R5.pdf
CCECG Common Criteria Evaluated Configuration Guide for HP Single-function Printers
HP Color LaserJet Enterprise 5700,
HP Color LaserJet Enterprise 6700/6701,
HP Color LaserJet Enterprise X55745,
HP Color LaserJet Enterprise X65455/X65465
Author(s) HP Inc.
Edition 1
Date 6/2024
CCEVS-TD0157 FCS_IPSEC_EXT.1.1 - Testing SPDs
Date 2017-06-15
Location https://www.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?td_id=161
CCEVS-TD0176 FDP_DSK_EXT.1.2 - SED Testing
Date 2017-04-11
Location https://www.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?td_id=180
CCEVS-TD0219 NIAP Endorsement of Errata for HCD PP v1.0
Date 2017-07-07
Location https://www.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?td_id=224
CCEVS-TD0253 Assurance Activities for Key Transport
Date 2017-11-08
Location https://www.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?td_id=259
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 141 of 144
CCEVS-TD0261 Destruction of CSPs in flash
Date 2017-11-14
Location https://www.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?td_id=267
CCEVS-TD0299 Update to FCS_CKM.4 Assurance Activities
Date 2018-03-16
Location https://www.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?td_id=305
CCEVS-TD0393 Require FTP_TRP.1(b) only for printing
Date 2019-02-26
Location https://www.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?td_id=403
CCEVS-TD0474 Removal of Mandatory Cipher Suite in FCS_TLS_EXT.1
Date 2019-12-04
Location https://www.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?TD=0474
CCEVS-TD0494 Removal of Mandatory SSH Ciphersuite for HCD
Date 2020-02-20
Location https://www.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?TD=0494
CCEVS-TD0562 Test activity for Public Key Algorithms
Date 2021-01-27
Location https://m.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?TD=0562
CCEVS-TD0642 FCS_CKM.1(a) Requirement; P-384 keysize moved to selection
Date 2022-06-17
Location https://www.niap-ccevs.org/Documents_and_Guidance/view_td.cfm?TD=0642
FIPS180-4 Secure Hash Standard (SHS)
Date 2015-08-04
Location https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf
FIPS186-4 Digital Signature Standard (DSS)
Date 2013-07-19
Location https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf
FIPS197 Advanced Encryption Standard (AES)
Date 2001-11-26
Location https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 142 of 144
FIPS198-1 The Keyed-Hash Message Authentication Code (HMAC)
Date 2008-07-16d
Location https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.198-1.pdf
HCDPP Protection Profile for Hardcopy Devices; IPA, NIAP, and the MFP Technical Community
Version 1.0
Date 2015-09-10
Location https://www.niap-ccevs.org/pp/pp_hcd_v1.0.pdf
HCDPP-ERRATAProtection Profile for Hardcopy Devices - v1.0, Errata #1, June 2017
Version 1.0
Date 2017-06
Location https://www.niap-ccevs.org/pp/pp_hcd_v1.0-err.pdf
ISO-10118-3 Information technology -- Security techniques -- Hash-functions -- Part 3: Dedicated hash-
functions
Version ISO/IEC 10118-3:2004
Date 2004-03
Location https://www.iso.org/standard/39876.html
KMD Key Management Description for HP Hardcopy Devices with 5.7.1.1 Firmware and Linux
4.9.230
HP Color LaserJet Enterprise 5700,
HP Color LaserJet Enterprise 6700/6701,
HP Color LaserJet Enterprise X55745,
HP Color LaserJet Enterprise X65455/X65465
Author(s) HP Inc.
Version 1.2
Date 2024-03-22
QuickSec73 IPsec Toolkit Feature Guide
Release 7.3
Author(s) INSIDE Secure
Date December 5, 2018
RFC2407 The Internet IP Security Domain of Interpretation for ISAKMP
Author(s) D. Piper
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 143 of 144
Date 1998-11-01
Location http://www.ietf.org/rfc/rfc2407.txt
RFC2408 Internet Security Association and Key Management Protocol (ISAKMP)
Author(s) D. Maughan, M. Schertler, M. Schneider, J. Turner
Date 1998-11-01
Location http://www.ietf.org/rfc/rfc2408.txt
RFC2409 The Internet Key Exchange (IKE)
Author(s) D. Harkins, D. Carrel
Date 1998-11-01
Location http://www.ietf.org/rfc/rfc2409.txt
RFC3526 More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange
(IKE)
Author(s) Tero Kivinen, Mika Kojo
Date May 2003
Location https://www.ietf.org/rfc/rfc3526.txt
RFC3602 The AES-CBC Cipher Algorithm and Its Use with IPsec
Author(s) S. Frankel, R. Glenn, S. Kelly
Date 2003-09-01
Location http://www.ietf.org/rfc/rfc3602.txt
RFC4109 Algorithms for Internet Key Exchange version 1 (IKEv1)
Author(s) P. Hoffman
Date 2005-05-01
Location http://www.ietf.org/rfc/rfc4109.txt
RFC4301 Security Architecture for the Internet Protocol
Author(s) S. Kent, K. Seo
Date 2005-12-01
Location http://www.ietf.org/rfc/rfc4301.txt
RFC4303 IP Encapsulating Security Payload (ESP)
Author(s) S. Kent
Date 2005-12-01
Location http://www.ietf.org/rfc/rfc4303.txt
HP EH HCDPP
Security Target
Version: 1.0
Last Update: 2024-05-22
Classification: Public © Copyright 2024 HP Development Company, L.P. Page 144 of 144
RFC4304 Extended Sequence Number (ESN) Addendum to IPsec Domain of Interpretation (DOI)
for Internet Security Association and Key Management Protocol (ISAKMP)
Author(s) S. Kent
Date December 2005
Location https://www.ietf.org/rfc/rfc4304.txt
RFC4868 Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
Author(s) S. Kelly, S. Frankel
Date 2007-05-01
Location http://www.ietf.org/rfc/rfc4868.txt
SP800-38A Recommendation for Block Cipher Modes of Operation: Methods and Techniques
Date 2001-12-01
Location https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf
SP800-56A-Rev3 Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm
Cryptography
Date April 2018
Location https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf