Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0 10/25/2022 Prepared for: Extreme Networks, Inc. 6480 Via Del Oro, San Jose, CA 95119 Prepared By: www.gossamersec.com Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 2 of 48 1. SECURITY TARGET INTRODUCTION........................................................................................................4 1.1 SECURITY TARGET REFERENCE......................................................................................................................5 1.2 TOE REFERENCE............................................................................................................................................6 1.3 TOE OVERVIEW .............................................................................................................................................6 1.4 TOE DESCRIPTION .........................................................................................................................................6 1.4.1 TOE Architecture.................................................................................................................................13 1.4.2 TOE Documentation ............................................................................................................................18 2. CONFORMANCE CLAIMS............................................................................................................................19 2.1 CONFORMANCE RATIONALE.........................................................................................................................20 3. SECURITY OBJECTIVES ..............................................................................................................................21 3.1 SECURITY OBJECTIVES FOR THE OPERATIONAL ENVIRONMENT ...................................................................21 4. EXTENDED COMPONENTS DEFINITION ................................................................................................22 5. SECURITY REQUIREMENTS.......................................................................................................................23 5.1 TOE SECURITY FUNCTIONAL REQUIREMENTS .............................................................................................23 5.1.1 Security audit (FAU)............................................................................................................................24 5.1.2 Cryptographic support (FCS)..............................................................................................................26 5.1.3 Identification and authentication (FIA) ...............................................................................................29 5.1.4 Security management (FMT) ...............................................................................................................31 5.1.5 Protection of the TSF (FPT) ................................................................................................................32 5.1.6 TOE access (FTA)................................................................................................................................33 5.1.7 Trusted path/channels (FTP)...............................................................................................................33 5.2 TOE SECURITY ASSURANCE REQUIREMENTS...............................................................................................34 5.2.1 Development (ADV).............................................................................................................................34 5.2.2 Guidance documents (AGD)................................................................................................................35 5.2.3 Life-cycle support (ALC) .....................................................................................................................36 5.2.4 Tests (ATE) ..........................................................................................................................................36 5.2.5 Vulnerability assessment (AVA)...........................................................................................................36 6. TOE SUMMARY SPECIFICATION..............................................................................................................38 6.1 SECURITY AUDIT ..........................................................................................................................................38 6.2 CRYPTOGRAPHIC SUPPORT ...........................................................................................................................39 6.3 IDENTIFICATION AND AUTHENTICATION.......................................................................................................44 6.4 SECURITY MANAGEMENT .............................................................................................................................45 6.5 PROTECTION OF THE TSF .............................................................................................................................46 6.6 TOE ACCESS.................................................................................................................................................47 6.7 TRUSTED PATH/CHANNELS ...........................................................................................................................48 LIST OF TABLES Table 1 x440-G2 Series................................................................................................................................................7 Table 2 x460-G2 Series................................................................................................................................................9 Table 3 x435 Series ....................................................................................................................................................10 Table 4 x465 Series ....................................................................................................................................................11 Table 5 x695 Series ....................................................................................................................................................11 Table 6 5520 Series ....................................................................................................................................................12 Table 7 TOE Models and Processors .......................................................................................................................16 Table 8 Technical Decisions......................................................................................................................................20 Table 9 TOE Security Functional Components ......................................................................................................24 Table 10 Audit Events ...............................................................................................................................................26 Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 3 of 48 Table 11 Assurance Components .............................................................................................................................34 Table 12 Audit Targets..............................................................................................................................................38 Table 13: ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Cryptography ..........................................................................................................................40 Table 14: Key Establishment Schemes ....................................................................................................................41 Table 15: ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Platforms CSPs........................................................................................................................42 Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 4 of 48 1. Security Target Introduction This section identifies the Security Target (ST) and Target of Evaluation (TOE) identification, ST conventions, ST conformance claims, and the ST organization. The TOE is the Extreme Networks ExtremeSwitching Series (x440- G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS (Extreme Networks ExtremeXOS) 31.3.100 provided by Extreme Networks, Inc. The TOE is being evaluated as a network device. The Security Target contains the following additional sections: • Conformance Claims (Section 2) • Security Objectives (Section 3) • Extended Components Definition (Section 4) • Security Requirements (Section 5) • TOE Summary Specification (Section 6) Conventions The following conventions have been applied in this document: • Security Functional Requirements – Part 2 of the CC defines the approved set of operations that may be applied to functional requirements: iteration, assignment, selection, and refinement. o Iteration: allows a component to be used more than once with varying operations. In the ST, iteration is indicated by a parenthetical number placed at the end of the component. For example FDP_ACC.1(1) and FDP_ACC.1(2) indicate that the ST includes two iterations of the FDP_ACC.1 requirement. o Assignment: allows the specification of an identified parameter. Assignments are indicated using bold and are surrounded by brackets (e.g., [assignment]). Note that an assignment within a selection would be identified in italics and with embedded bold brackets (e.g., [[selected-assignment]]). o Selection: allows the specification of one or more elements from a list. Selections are indicated using bold italics and are surrounded by brackets (e.g., [selection]). o Refinement: allows the addition of details. Refinements are indicated using bold, for additions, and strike-through, for deletions (e.g., “… all objects …” or “… some big things …”). • Other sections of the ST – Other sections of the ST use bolding to highlight text of special interest, such as captions. Acronyms AAA AAR Authentication, Authorization and Accounting Assurance Activity Report AES Advanced Encryption Standard ARM Advanced RISC Machines CA Certificate Authority CAVP Cryptographic Algorithm Validation Program CC Common Criteria CCTL CC Testing Laboratory CEM Common Evaluation Methodology Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 5 of 48 CI Configuration Item CLI Command line interface CM Configuration Management CSP Critical Security Parameter DoD Department of Defense DTR Detailed Test Report EXOS Extreme Networks ExtremeXOS (the TOE operating system) ETR Evaluation Technical Report FOM FIPS Object Module FSP Functional Specification IT Information Technology MIPS Microprocessor without Interlocked Pipelined Stages NDcPP22e collaborative Protection Profile for Network Devices NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology NSA National Security Agency NTP Network Time Protocol OCSP Online certificate status protocol OS Operating System PP Protection Profile RBAC Role-based Access Control SAR Security Assurance Requirement SFR Security Functional Requirement SSHv2 Secure shell version 2 ST Security Target TLS Transport Layer security TOE Target of Evaluation TSF TOE Security Functions TSS TOE Summary Specification 1.1 Security Target Reference ST Title – Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target ST Version – Version 1.0 ST Date – 10/25/2022 Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 6 of 48 1.2 TOE Reference TOE Identification – Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 TOE Developer – Extreme Networks, Inc. Evaluation Sponsor – Extreme Networks, Inc 1.3 TOE Overview The TOE is the Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS (Extreme Networks ExtremeXOS) 31.3.100. The TOE provides high density layer 2/3 switching with low latency cut-through switching and IPv4 and IPv6 unicast and multicast routing to enable enterprise aggregation and core backbone deployments. The TOE consists of a hardware appliance with embedded software components. All TOE appliances are shipped ready for immediate access through a Command Line Interface [CLI], with some basic features enabled by default. However, to ensure secure use the product must be configured prior to being put into a production environment as specified in the TOE guidance. 1.4 TOE Description The TOE consists of both hardware and software components. The TOE consists of the following series of appliances all running EXOS (Extreme Networks ExtremeXOS) software version 31.3.100: • ExtremeSwitching Series x440-G2 • ExtremeSwitching Series x460-G2 • ExtremeSwitching Series x435 • ExtremeSwitching Series x465 • ExtremeSwitching Series x695 • 5520 Series Each hardware profile provides a defined set of performance characteristics - switching bandwidth, latency, and port density while offering the same level of security features. ExtremeSwitching x440-G2 Series: The ExtremeSwitching x440-G2 series is a scalable family of edge switches powered by Extreme Networks ExtremeXOS (EXOS), an operating system providing continuous uptime, manageability and operational efficiency. The x440-G2 series switches provide routing and switching, flexible stacking, PoE+ support and comprehensive security, while extending the benefits of EXOS to the campus edge. The ExtremeSwitching x440-G2 Series consists of the following switches: Models Model Specifications X440-G2-12t-10GE4 X440-G2 12 10/100/1000BASE-T, 4 1GbE unpopulated SFP upgradable to 10GbE SFP+, 1 Fixed AC PSU, 1 RPS port X440-G2-12p-10GE4 X440-G2 12 10/100/1000BASE-T POE+, 4 1GbE unpopulated SFP upgradable to 10GbE SFP+, 1 Fixed AC PSU, 1 RPS port Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 7 of 48 Models Model Specifications X440-G2-24t-10GE4 X440-G2 24 10/100/1000BASE-T, 4 SFP combo, 4 1GbE unpopulated SFP upgradable to 10GbE SFP+, 1 Fixed AC PSU, 1 RPS port X440-G2-24p-10GE4 X440-G2 24 10/100/1000BASE-T POE+, 4 SFP combo, 4 1GbE unpopulated SFP upgradable to 10GbE SFP+, 1 Fixed AC PSU, 1 RPS port X440-G2-48t-10GE4 X440-G2 48 10/100/1000BASE-T, 4 SFP combo, 4 1GbE unpopulated SFP upgradable to 10GbE SFP+ (2 combo/2 non-combo), 2 1GbE copper combo upgradable to 10GbE, 1 Fixed AC PSU, 1 RPS port X440-G2-48p-10GE4 X440-G2 48 10/100/1000BASE-T POE+, 4 SFP combo, 4 1GbE unpopulated SFP upgradable to 10GbE SFP+ (2 combo/2 non-combo), 2 1GbE copper combo upgradable to 10GbE, 1 Fixed AC PSU, 1 RPS port X440-G2-24t-10GE4-DC X440-G2 24 10/100/1000BASE-T, 4 SFP combo, 4 1GbE unpopulated SFP upgradable to 10GbE SFP+, 1 Fixed DC PSU, 1 RPS port X440-G2-48t-10GE4-DC X440-G2 48 10/100/1000BASE-T, 4 SFP combo, 4 1GbE unpopulated SFP upgradable to 10GbE SFP+ (2 combo/2 non-combo), 2 1GbE copper combo upgradable to 10GbE, 1 Fixed DC PSU, 1 RPS port X440-G2-24x-10GE4 X440-G2 24 unpopulated 1000BASE-X SFP (4 combo), 4 10/100/1000 combo, 4 1GbE unpopulated SFP upgradable to 10GbE SFP+, 1 Fixed AC PSU, 1 RPS port, X440-G2-24fx-GE4 X440-G2 24 fixed 100BASE-FX LC connectors, 4 1GBASE-X unpopulated SFP, 1 Fixed AC PSU, 1 RPS port, 0⁰C to 60⁰C operation X440-G2-12t8fx-GE4 X440-G2 12 10/100/1000BASE-T plus 8 fixed 100BASE-FX LC connectors, 4 1GBASE-X unpopulated SFP, 1 Fixed AC PSU, 1 RPS port, 0⁰C to 60⁰C operation X440-G2-24t-GE4 X440-G2 24 fixed 10/100/1000BASE-TX , 4 1GBASE-X unpopulated SFP, 1 Fixed AC PSU, 1 RPS port, 0⁰C to 60⁰C operation Table 1 x440-G2 Series ExtremeSwitching x460-G2 Series: The ExtremeSwitching x460-G2 series is based on Extreme Networks ExtremeXOS® (EXOS), an operating system that provides continuous uptime, manageability and operational efficiency. Each switch offers the same non-blocking Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 8 of 48 hardware technology. The x460-G2 series switches provide routing and switching, flexible stacking, PoE+ support and comprehensive security, while extending the benefits of EXOS to edge and aggregation deployments. The ExtremeSwitching x460-G2 Series consists of the following switches: Models Model Specifications X460-G2-24t-10GE4 X460-G2 24 10/100/1000BASE-T, 8 100/1000BASE-X unpopulated SFP (4 SFP ports shared with 10/100/1000BASE-T ports), 4 1000/10GBaseX unpopulated SFP+ ports, Rear VIM Slot (unpopulated), Rear Timing Slot (unpopulated), 2 unpopulated PSU slots, fan module slot (unpopulated) X460-G2-48t-10GE4 X460-G2 48 10/100/1000BASE-T, 4 1000/10GBaseX unpopulated SFP+ ports, Rear VIM Slot (unpopulated), Rear Timing Slot (unpopulated), 2 unpopulated PSU slots, fan module slot (unpopulated) X460-G2-24p-10GE4 X460-G2 24 10/100/1000BASE-T PoE-plus, 8 100/1000BASE-X unpopulated SFP (4 SFP ports shared with 10/100/1000BASE-T ports), 4 1000/10GBaseX unpopulated SFP+ ports, Rear VIM Slot (unpopulated), Rear Timing Slot (unpopulated), 2 unpopulated PSU slots, fan module slot (unpopulated) X460-G2-48p-10GE4 X460-G2 48 10/100/1000BASE-T PoE-plus, 4 1000/10GBaseX unpopulated SFP+ ports, Rear VIM Slot (unpopulated), Rear Timing Slot (unpopulated), 2 unpopulated PSU slots, fan module slot (unpopulated) X460-G2-24x-10GE4 X460-G2 24 100/1000BASE-X unpopulated SFP, 8 10/100/1000BASE-T (4 10/100/1000BASE-T ports shared with SFP ports), 4 1000/10GBaseX unpopulated SFP+ ports, Rear VIM Slot (unpopulated), Rear Timing Slot (unpopulated), 2 unpopulated PSU slots, fan module slot (unpopulated) X460-G2-48x-10GE4 X460-G2 48 100/1000BASE-X unpopulated SFP, 4 1000/10GBaseX unpopulated SFP+ ports, Rear VIM Slot (unpopulated), Rear Timing Slot (unpopulated), 2 unpopulated PSU slots, fan module slot (unpopulated) X460-G2-24t-GE4 X460-G2 24 10/100/1000BASE-T, 8 100/1000BASE-X unpopulated SFP (4 SFP ports shared with 10/100/1000BASE-T ports), 4 1GBase-X unpopulated SFP ports, Rear VIM Slot (unpopulated), Rear Timing Slot (unpopulated), 2 unpopulated PSU slots, fan module slot (unpopulated) X460-G2-48t-GE4 X460-G2 48 10/100/1000BASE-T, 4 1GBaseX unpopulated SFP ports, Rear VIM Slot (unpopulated), Rear Timing Slot (unpopulated), 2 unpopulated PSU slots, fan module slot (unpopulated) Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 9 of 48 Models Model Specifications X460-G2-24p-GE4 X460-G2 24 10/100/1000BASE-T PoE-plus, 8 100/1000BASE-X unpopulated SFP (4 SFP ports shared with 10/100/1000BASE-T ports), 4 1GBaseX unpopulated SFP ports, Rear VIM Slot (unpopulated), Rear Timing Slot (unpopulated), 2 unpopulated PSU slots, fan module slot (unpopulated) X460-G2-48p-GE4 X460-G2 48 10/100/1000BASE-T PoE-plus, 4 1GBaseX, Rear VIM Slot (unpopulated), Rear Timing Slot (unpopulated), 2 unpopulated PSU slots, fan module slot (unpopulated) X460-G2-16mp-32p-10GE4 X460-G2 16 x 100Mb/1/2.5GbE PoE-Plus, 32 x 10/100/1000BASE-T PoE-Plus, 4 x 10GBASE-X SFP+ (unpopulated ports), 1 x Serial (console port RJ-45), 1 x 10/100/1000BASE-T out-of-band management port, 1 x USB port for external USB flash X460-G2-24p-24hp-10GE4 X460-G2 24 x 10/100/1000BASE-T Full-Duplex PoE-Plus, 24 x 10/100/1000BASE-T Full/Half-Duplex PoE-Plus, 4 x 10GBASE-X SFP+ (unpopulated ports), 1 x Serial (console port RJ-45), 1 x 10/100/1000BASE-T out-of-band management port, 1 x USB port for external USB flash X460-G2-24ht-10GE4 X460-G2 24 10/100/1000BASE-T full duplex, 24 10/100/1000BASE-T full/half duplex, 4 1000/10GBaseX unpop’d SFP+ ports, Rear VIM Slot (unpop’d), Rear Timing Slot (unpop’d), 2 unpop’d PSU slots, fan module slot (unpop’d), Table 2 x460-G2 Series ExtremeSwitching x435 Series: The ExtremeSwitching x435 Series are standalone Ethernet switches powered by Extreme Networks ExtremeXOS (EXOS). The x435 Series offers comprehensive Layer 2 switching, static routing, advanced PoE, role=based policy and comprehensive security services. The x435 Series is ideal for enterprises looking for Ethernet connectivity in their branch/small sites or at their network edge. The ExtremeSwitching x435 Series consists of the following switches: Models Model Specifications X435-8T-4S X435 switch with 8x10/100/1000BASE-T full / half duplex ports, 4x1G/2.5G unpopulated SFP ports, 1 AC PSU, wall-mount kit (XN-WALLMOUNT-001), fanless Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 10 of 48 Models Model Specifications X435-8P-4S X435 switch with 8x10/100/1000BASE-T PoE+ full / half duplex ports, 4x1G/2.5G unpopulated SFP ports, 1 AC PSU, wall-mount kit (XN- WALLMOUNT-001), fanless X435-8P-2T-W X435 switch with 8 x 10/100/1000BASE-T PoE+ full / half duplex ports, 2x10/100/1000BASE-T 802.3bt Type 4 (30W/60W/90W) uplink ports (up to 100w PoE passthrough), wall-mount kit (XN-WALLMOUNT-001), fanless X435-24T-4S X435 switch 24x10/100/1000BASE-T full / half duplex ports, 4x1/2.5G unpopulated SFP ports, 1 AC PSU, rack-mount kit (XN-2P-RMKIT-004), fanless X435-24P-4S X435 switch 24x10/100/1000BASE-T PoE+ full / half duplex ports, 4x1/2.5G unpopulated SFP ports, 1 AC PSU, rack-mount kit (XN-2P-RMKIT-004), Table 3 x435 Series ExtremeSwitching x465 Series: The ExtremeSwitching x465 Series is a stackable switch family providing secure Gigabit and multi-Gigabit Ethernet connectivity. Powered by ExtremeXOS (EXOS), the x465 Series offers routing and switching, high-speed stacking, modular uplink options, advanced PoE, and comprehensive security. This makes the x465 Series an ideal choice for high-end wiring closet and network edge deployments. The ExtremeSwitching x465 Series consists of the following switches: Models Model Specifications X465-24W X465-24W with 24 10/ 10 0/ 10 0 0Base-T full/ half duplex 80 2.3bt Type 4 90 W PoE MACsec-capable port s, includes 2 fan modules, 1VIM5 slot, rack- mount kit X465-48T X465-48T with 48 10/ 10 0/ 10 0 0Base-T full/ half duplex MACsec-capable port s, includes 3 fan modules, 1VIM5 slot, rack-mount kit X465-48P X465-48P with 48 10/ 10 0/ 10 0 0Base-T full/ half duplex 80 2.3at 30 W PoE MACsec-capable port s, includes 3 fan modules, 1VIM5 slot, 1x 110 0 W AC PSU FB (10 941), rack-mount kit Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 11 of 48 Models Model Specifications X465-48W X465-48W with 48 10/ 10 0/ 10 0 0Base-T full/ half duplex 80 2.3bt Type 4 90 W PoE port s, MACsec-capable, includes 3 fan modules, 1VIM5 slot, rack- mount kit X465i-48W X465i-48Wi with 48 10/ 10 0/ 10 0 0Base-T full/ half duplex 80 2.3bt Type 4 90 W PoE port s, MACsec-capable, includes 120 GB SSD, 3 fan modules, 1VIM5 slot, rack-mount kit X465-24MU X465-24MU with 24 10 0 Mb/ 1Gb/ 2.5Gb/ 5Gb 80 2.3bt Type 3 60 W PoE port s, includes 2 fan modules, 1VIM5 slot, rack-mount kit X465-24MU-24W X465-24MU-24W with 24 10 0 Mb/ 1Gb/ 2.5Gb/ 5Gb 80 2.3bt Type 3 60 W PoE port s and 24 10/ 10 0/ 10 0 0 Mb full/ half-duplex 80 2.3 Type 4 90 W MACsec-capable port s, includes 3 fan modules, 1VIM5 slot, rack-mount kit X465-24S X465-24S with 24 10 0/ 10 0 0Base-X (SFP) port s, includes 2 fan modules, 1VIM5 slot, rack-mount kit X465-24XE X465-24XE with 24 10 0 M/ 1Gb/ 10 Gb (SFP+) MACsec and LRM-capable port s, includes 2 fan modules, 1VIM5 slot, rack-mount kit Table 4 x465 Series ExtremeSwitching x695 Series: The ExtremeSwitching x695 is a purpose-built 48 x 25Gb SFP28 port switch with 8 x 40/100Gb QSFP28 uplinks designed for enterprise and aggregation applications. Powered by Extreme Networks ExtremeXOS (EXOS), the x695 can support a range of interface speeds, including 1Gb, 10Gb, 25Gb, 40Gb, 50Gb and 100Gb, all in a compact 1RU form factor. This enables the ExtremeSwitching x695 to be deployed in Enterprise LAN or top-of-rack applications. The ExtremeSwitching x695 Series consists of the following switch: Models Model Specifications X695-48Y-8C X695 system with 48 x 10/25Gbps SFP28 ports, 8 x 100Gbps QSFP28 ports, 8-core CPU, 16GB RAM, 128GB SSD, 4-post rack mount kit, No PSU No Fans Table 5 x695 Series 5520 Series: The 5520 Series is a family of feature-rich edge and aggregation switches designed for the next generation digital enterprise. Powered by Extreme Networks ExtremeXOS (EXOS), the 5520 Series universal hardware provides end- Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 12 of 48 to-end secure network segmentation and advanced policy capabilities. The 5520 platform can be deployed across a range of edge, aggregation and wiring-closet environments. The 5520 Series consists of the following switches: Models Model Specifications 5520-24T 5520 Universal Switch with 24 x 10/100/1000BASE-T full/half duplex MACsec-capable ports, includes 2 x Stacking/QSFP28 ports, 2 fan modules, 1 VIM slot, 2 unpopulated modular PSU slots 5520-24W 5520 Universal Switch with 24 x 10/100/1000BASE-T full/half duplex 802.3bt 90W PoE MACseccapable ports, includes 2 x Stacking/QSFP28 ports, 3 fan modules, 1 VIM slot, 2 unpopulated modular PSU slots 5520-48T 5520 Universal Switch with 48 x 10/100/1000BASE-T full/half duplex MACsec-capable ports, includes 2 x Stacking/QSFP28 ports, 3 fan modules, 1 VIM slot, 2 unpopulated modular PSU slots 5520-48W 5520 Universal Switch with 48 x 10/100/1000BASE-T full/half duplex 802.3bt 90W PoE MACseccapable ports, includes 2 x Stacking/QSFP28 ports, 3 fan modules, 1 VIM slot, 2 unpopulated modular PSU slots 5520-12MW-36W 5520 Universal Switch with 12 x 100Mb/1Gb/2.5Gb/5Gb 802.3bt 90W PoE MACsec-capable ports plus 36 x 10/100/1000BASE-T 802.3bt 90W PoE full/half duplex MACsec-capable ports, includes 2 x Stacking/QSFP28 ports, 3 fan modules, 1VIM slot, 2 unpopulated modular PSU slots 5520-48SE 5520 Universal Switch with 48 x 100M/1Gb SFP MACsec-capable ports, includes 2 x Stacking/ QSFP28 ports, 3 fan modules, 1 VIM slot, 2 unpopulated modular PSU slots 5520-24X 5520 Universal Switch with 24 x 100Mb/1Gb/10Gb SFP+ ports, includes 2 Stacking/QSFP28 ports, 2 fan modules, 1 VIM slot, 2 unpopulated modular PSU slots Table 6 5520 Series Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 13 of 48 1.4.1 TOE Architecture The underlying architecture of each TOE appliance consists of hardware that supports physical network connections, memory, and processor and software that implements routing and switching functions, configuration information and drivers. While hardware varies between different appliance models, the EXOS software is shared across all platforms. EXOS is composed of subsystems designed to implement operational, security, management, and networking functions. Hardware-specific device drivers that reside in the kernel provide abstraction of the hardware components. A dedicated cryptographic module is integrated with protocol libraries that implement secure channel functionality. A control plane subsystem that includes Internet Protocol (IP) host stack, which can be further subdivided into protocol and control layers, implements switching and routing functions. A system management subsystem, that includes an Authentication, Authorization and Accounting (AAA) module, implements an administrative interface and maintains configuration information. The figure below outlines the TOE Architecture and subsystem interactions: Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 14 of 48 There is one management interface – a CLI accessed locally or via SSH. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 15 of 48 1.4.1.1 Physical Boundaries The physical boundary of the TOE is the Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100. EXOS is based on Linux Kernel version 4.14.200. Model CPU CPU Mfg CPU Type Micro Architecture CPU Cores X440-G2-12t-10GE4 CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-12p-10GE4 CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-24t-10GE4 CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-24p-10GE4 CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-48t-10GE4 CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-48p-10GE4 CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-24t-10GE4-DC CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-48t-10GE4-DC CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-24x-10GE4 CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-24fx-GE4 CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-12t8fx-GE4 CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X440-G2-24t-GE4 CN7010 Marvell (formerly Cavium) MIPS Octeon III 1 X460-G2-24t-10GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-48t-10GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-24p-10GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-48p-10GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-24x-10GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-48x-10GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-24t-GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-48t-GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-24p-GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-48p-GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 16 of 48 Model CPU CPU Mfg CPU Type Micro Architecture CPU Cores X460-G2-16mp-32p- 10GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-24p-24hp- 10GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X460-G2-24ht-10GE4 CN6120 Marvell (formerly Cavium) MIPS Octeon II 2 X435-8T-4S Broadcom BCM53549 ARM Cortex- A Cortex-A72 Armv7 4 X435-8P-4S Broadcom BCM53549 ARM Cortex- A Cortex-A72 Armv7 4 X435-8P-2T-W Broadcom BCM53548 ARM Cortex- A Cortex-A72 Armv7 4 X435-24T-4S Broadcom BCM53547 ARM Cortex- A Cortex-A72 Armv7 4 X435-24P-4S Broadcom BCM53547 ARM Cortex- A Cortex-A72 Armv7 4 X465-24W C3338 Intel Atom Denverton 2 X465-48T C3338 Intel Atom Denverton 2 X465-48P C3338 Intel Atom Denverton 2 X465-48W C3338 Intel Atom Denverton 2 X465i-48W C3538 Intel Atom Denverton 4 X465-24MU C3538 Intel Atom Denverton 4 X465-24MU-24W C3538 Intel Atom Denverton 4 X465-24S C3338 Intel Atom Denverton 2 X465-24XE C3538 Intel Atom Denverton 4 X695-48Y-8C C3758 Intel Atom Denverton 8 5520-24T Broadcom BCM56377 ARM Cortex- A Cortex A72 ARMv8 4 5520-24W Broadcom BCM56377 ARM Cortex- A Cortex A72 ARMv8 4 5520-48T Broadcom BCM56376 ARM Cortex- A Cortex A72 ARMv8 4 5520-48W Broadcom BCM56376 ARM Cortex- A Cortex A72 ARMv8 4 5520-12MW-36W Broadcom BCM56375 ARM Cortex- A Cortex A72 ARMv8 4 5520-48SE Broadcom BCM56376 ARM Cortex- A Cortex A72 ARMv8 4 5520-24X Broadcom BCM56375 ARM Cortex- A Cortex A72 ARMv8 4 Table 7 TOE Models and Processors Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 17 of 48 The Operational Environment of the TOE includes: • The SSH client that is used to access the management interface • The management workstation that hosts the SSH client • Audit server for external storage of audit records • NTP server for synchronizing system time • Certificate Authority and OCSP servers to support X.509 1.4.1.2 Logical Boundaries This section summarizes the security functions provided by Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100: - Security audit - Cryptographic support - Identification and authentication - Security management - Protection of the TSF - TOE access - Trusted path/channels 1.4.1.2.1 Security audit The TOE generates audit records for all security-relevant events. For each audited event, the TOE records the date and time, the type of event, the subject identity, and the outcome of the event. The resulting records are stored locally and can be sent securely to a designated audit server for archiving. Security Administrators, using the appropriate CLI commands, can also view audit records locally. The TOE provides a reliable timestamp relying on the appliance’s built-in clock or using an NTP server. 1.4.1.2.2 Cryptographic support The TOE performs the following cryptographic functionality: • Encryption, decryption, hashing, keyed-hash message authentication, random number generation, signature generation and verification utilizing a dedicated cryptographic library • Cryptographic functionality is utilized to implement secure channels o SSHv2 o TLS v1.2 • Entropy is collected and used to support seeding with full entropy • Critical Security Parameters (CSPs) internally stored and cleared when no longer in use • X509 Certificate authentication integrated with TLS protocol. The TOE uses a dedicated cryptographic module to manage CSPs and implements deletion procedures to mitigate the possibility of disclosure or modification of CSPs. Additionally, the TOE provides commands to on-demand clear CSPs (e.g. host RSA keys), that can be invoked by a Security Administrator with appropriate permissions. 1.4.1.2.3 Identification and authentication The TOE supports Role-Based Access Control (RBAC) managed by an Authentication, Authorization, and Accounting (AAA) module that stores and manages permissions of all users and their roles. The TOE requires users to provide their assigned unique username and password before any administrative access to the system is granted. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 18 of 48 Each authorized user is associated with an assigned role and role-specific permissions that determine their access to TOE features. The AAA module stores the assigned role of each user along with all other information required for that user to access the TOE. All TOE management functions are restricted to the Security Administrator. The TOE supports X509v3 certificate validation during negotiation of TLS protected syslog. Certificates are validated as part of the authentication process when they are presented to the TOE and when they are loaded into the TOE. 1.4.1.2.4 Security management The TOE allows remote administration using an SSHv2 session, and local administration using a console. Both remote and local administration are conducted over a Command Line Interface (CLI) terminal that facilitates access to all of the management functions used to administer the TOE. There are two types of administrative users within the system: Security Administrator and User. All of the management functions are restricted to Security Administrators, including: managing user accounts and roles, rebooting and applying software updates, administering the system configuration, and reviewing audit records. The term “Security Administrator” is used to refer to any administrative user with the appropriate role to perform the relevant functions. 1.4.1.2.5 Protection of the TSF The TOE implements a number of measures to protect the integrity of its security features. • The TOE protects CSPs, including stored passwords and cryptographic keys, so they are not directly viewable or accessible in plaintext. • The TOE ensures that reliable time information is available for both log accountability and synchronization with the operating environment. • The TOE performs self-tests to detect internal failures and protect itself from malicious updates. 1.4.1.2.6 TOE access The TOE will display a customizable banner when an administrator initiates an interactive local or remote session. The TOE also enforces an administrator-defined inactivity timeout after which any inactive session is automatically terminated. Once a session (local or remote) has been terminated, the TOE requires the user to re-authenticate. 1.4.1.2.7 Trusted path/channels The TOE protects remote sessions by establishing a trusted path secured using SSH between itself and the administrator. The TOE prevents disclosure or modification of audit records by establishing a trusted channel using TLS between itself and the audit server. Mutual authentication using client-side x.509v3 certificates is supported by the TOE’s TLS client for syslog over TLS. 1.4.2 TOE Documentation The following administrator guidance is available: • Extreme Networks ExtremeXOS Common Criteria Configuration Guide 31.3.100 9037401-00 Rev AA, October 2022 Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 19 of 48 2. Conformance Claims This TOE is conformant to the following CC specifications: • Common Criteria for Information Technology Security Evaluation Part 2: Security functional components, Version 3.1, Revision 5, April 2017. • Part 2 Extended • Common Criteria for Information Technology Security Evaluation Part 3: Security assurance components, Version 3.1, Revision 5, April 2017. • Part 3 Conformant • Package Claims: • collaborative Protection Profile for Network Devices, Version 2.2e, 23 March 2020 (NDcPP22e) Package Technical Decision Applied Notes CPP_ND_V2.2E TD0670 - NIT Technical Decision for Mutual and Non-Mutual Auth TLSC Testing Yes CPP_ND_V2.2E TD0639 - NIT Technical Decision for Clarification for NTP MAC Keys Yes CPP_ND_V2.2E TD0638 – NIT Technical Decision for Key Pair Generation for Authentication Yes CPP_ND_V2.2E TD0636 - NIT Technical Decision for Clarification of Public Key User Authentication for SSH No SFR not claimed (FCS_SSHC_EXT.1) CPP_ND_V2.2E TD0635 - NIT Technical Decision for TLS Server and Key Agreement Parameters No SFR not claimed (FCS_TLSS_EXT.1) CPP_ND_V2.2E TD0634 - NIT Technical Decision for Clarification required for testing IPv6 Yes FCS_TLSC_EXT.1.2 CPP_ND_V2.2E TD0633 – NIT Technical Decision for Ipsec IKE/SA Lifetimes Tolerance No SFR not claimed (FCS_IPSEC_EXT.1) CPP_ND_V2.2E TD0632 - NIT Technical Decision for Consistency with Time Data for vNDs No This ST does not include vNDs CPP_ND_V2.2E TD0631 - NIT Technical Decision for Clarification of public key authentication for SSH Server Yes FCS_SSHS_EXT.1, FMT_SMF.1 CPP_ND_V2.2E TD0592 - NIT Technical Decision for Local Storage of Audit Records Yes CPP_ND_V2.2E TD0591 - NIT Technical Decision for Virtual TOEs and hypervisors Yes CPP_ND_V2.2E TD0581 - NIT Technical Decision for Elliptic curve-based key establishment and NIST SP 800-56Arev3 Yes CPP_ND_V2.2E TD0580 - NIT Technical Decision for clarification about use of DH14 in NDcPPv2.2e Yes CPP_ND_V2.2E TD0572 - NiT Technical Decision for Restricting FTP_ITC.1 to only IP address identifiers Yes CPP_ND_V2.2E TD0571 - NiT Technical Decision for Guidance on how to handle FIA_AFL.1 Yes Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 20 of 48 CPP_ND_V2.2E TD0570 - NiT Technical Decision for Clarification about FIA_AFL.1 Yes CPP_ND_V2.2E TD0569 - NIT Technical Decision for Session ID Usage Conflict in FCS_DTLSS_EXT.1.7 No SFR not claimed CPP_ND_V2.2E TD0564 - NiT Technical Decision for Vulnerability Analysis Search Criteria Yes CPP_ND_V2.2E TD0563 - NiT Technical Decision for Clarification of audit date information Yes CPP_ND_V2.2E TD0556 - NIT Technical Decision for RFC 5077 question Yes CPP_ND_V2.2E TD0555 - NIT Technical Decision for RFC Reference incorrect in TLSS Test Yes CPP_ND_V2.2E TD0547 - NIT Technical Decision for Clarification on developer disclosure of AVA_VAN Yes CPP_ND_V2.2E TD0546 - NIT Technical Decision for DTLS - clarification of Application Note 63 No SFR not claimed CPP_ND_V2.2E TD0538 - NIT Technical Decision for Outdated link to allowed-with list Yes CPP_ND_V2.2E TD0537 - NIT Technical Decision for Incorrect reference to FCS_TLSC_EXT.2.3 Yes CPP_ND_V2.2E TD0536 - NIT Technical Decision for Update Verification Inconsistency Yes CPP_ND_V2.2E TD0528 - NIT Technical Decision for Missing EAs for FCS_NTP_EXT.1.4 Yes CPP_ND_V2.2E TD0527 - Updates to Certificate Revocation Testing (FIA_X509_EXT.1) Yes Table 8 Technical Decisions 2.1 Conformance Rationale The ST conforms to the NDcPP22e. As explained previously, the security problem definition, security objectives, and security requirements have been drawn from the PP. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 21 of 48 3. Security Objectives The Security Problem Definition may be found in the NDcPP22e and this section reproduces only the corresponding Security Objectives for operational environment for reader convenience. The NDcPP22e offers additional information about the identified security objectives, but that has not been reproduced here and the NDcPP22e should be consulted if there is interest in that material. In general, the NDcPP22e has defined Security Objectives appropriate for network devices and as such are applicable to the Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 TOE. 3.1 Security Objectives for the Operational Environment OE.ADMIN_CREDENTIALS_SECURE The administrator's credentials (private key) used to access the TOE must be protected on any other platform on which they reside. OE.NO_GENERAL_PURPOSE There are no general-purpose computing capabilities (e.g., compilers or user applications) available on the TOE, other than those services necessary for the operation, administration and support of the TOE. Note: For vNDs the TOE includes only the contents of the its own VM, and does not include other VMs or the VS. OE.NO_THRU_TRAFFIC_PROTECTION The TOE does not provide any protection of traffic that traverses it. It is assumed that protection of this traffic will be covered by other security and assurance measures in the operational environment. OE.PHYSICAL Physical security, commensurate with the value of the TOE and the data it contains, is provided by the environment. OE.RESIDUAL_INFORMATION The Security Administrator ensures that there is no unauthorized access possible for sensitive residual information (e.g. cryptographic keys, keying material, PINs, passwords etc.) on networking equipment when the equipment is discarded or removed from its operational environment. For vNDs, this applies when the physical platform on which the VM runs is removed from its operational environment. OE.TRUSTED_ADMIN TOE Administrators are trusted to follow and apply all guidance documentation in a trusted manner. For vNDs, this includes the VS Administrator responsible for configuring the VMs that implement ND functionality. For TOEs supporting X.509v3 certificate-based authentication, the Security Administrator(s) are assumed to monitor the revocation status of all certificates in the TOE's trust store and to remove any certificate from the TOE's trust store in case such certificate can no longer be trusted. OE.UPDATES The TOE firmware and software is updated by an administrator on a regular basis in response to the release of product updates due to known vulnerabilities. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 22 of 48 4. Extended Components Definition All of the extended requirements in this ST have been drawn from the NDcPP22e. The NDcPP22e defines the following extended requirements and since they are not redefined in this ST the NDcPP22e should be consulted for more information in regard to those CC extensions. Extended SFRs: - NDcPP22e:FAU_STG_EXT.1: Protected Audit Event Storage - NDcPP22e:FCS_NTP_EXT.1: NTP Protocol - NDcPP22e:FCS_RBG_EXT.1: Random Bit Generation - NDcPP22e:FCS_SSHS_EXT.1: SSH Server Protocol - NDcPP22e:FCS_TLSC_EXT.1: TLS Client Protocol Without Mutual Authentication - NDcPP22e:FCS_TLSC_EXT.2: TLS Client Support for Mutual Authentication - NDcPP22e:FIA_PMG_EXT.1: Password Management - NDcPP22e:FIA_UAU_EXT.2: Password-based Authentication Mechanism - NDcPP22e:FIA_UIA_EXT.1: User Identification and Authentication - NDcPP22e:FIA_X509_EXT.1/Rev: X.509 Certificate Validation - NDcPP22e:FIA_X509_EXT.2: X.509 Certificate Authentication - NDcPP22e:FIA_X509_EXT.3: X.509 Certificate Requests - NDcPP22e:FPT_APW_EXT.1: Protection of Administrator Passwords - NDcPP22e:FPT_SKP_EXT.1: Protection of TSF Data (for reading of all pre-shared, symmetric and private keys) - NDcPP22e:FPT_STM_EXT.1: Reliable Time Stamps - NDcPP22e:FPT_TST_EXT.1: TSF testing - NDcPP22e:FPT_TUD_EXT.1: Trusted update - NDcPP22e:FTA_SSL_EXT.1: TSF-initiated Session Locking Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 23 of 48 5. Security Requirements This section defines the Security Functional Requirements (SFRs) and Security Assurance Requirements (SARs) that serve to represent the security functional claims for the Target of Evaluation (TOE) and to scope the evaluation effort. The SFRs have all been drawn from the NDcPP22e. The refinements and operations already performed in the NDcPP22e are not identified (e.g., highlighted) here, rather the requirements have been copied from the NDcPP22e and any residual operations have been completed herein. Of particular note, the NDcPP22e made a number of refinements and completed some of the SFR operations defined in the Common Criteria (CC) and that PP should be consulted to identify those changes if necessary. The SARs are also drawn from the NDcPP22e. The NDcPP22e should be consulted for the assurance activity definitions. 5.1 TOE Security Functional Requirements The following table identifies the SFRs that are satisfied by Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 TOE. Requirement Class Requirement Component FAU: Security audit NDcPP22e:FAU_GEN.1: Audit Data Generation NDcPP22e:FAU_GEN.2: User identity association NDcPP22e:FAU_STG_EXT.1: Protected Audit Event Storage FCS: Cryptographic support NDcPP22e:FCS_CKM.1: Cryptographic Key Generation NDcPP22e:FCS_CKM.2: Cryptographic Key Establishment NDcPP22e:FCS_CKM.4: Cryptographic Key Destruction NDcPP22e:FCS_COP.1/DataEncryption: Cryptographic Operation (AES Data Encryption/Decryption) NDcPP22e:FCS_COP.1/Hash: Cryptographic Operation (Hash Algorithm) NDcPP22e:FCS_COP.1/KeyedHash: Cryptographic Operation (Keyed Hash Algorithm) NDcPP22e:FCS_COP.1/SigGen: Cryptographic Operation (Signature Generation and Verification) NDcPP22e:FCS_NTP_EXT.1: NTP Protocol NDcPP22e:FCS_RBG_EXT.1: Random Bit Generation NDcPP22e:FCS_SSHS_EXT.1: SSH Server Protocol NDcPP22e:FCS_TLSC_EXT.1: TLS Client Protocol Without Mutual Authentication NDcPP22e:FCS_TLSC_EXT.2: TLS Client Support for Mutual Authentication FIA: Identification and authentication NDcPP22e:FIA_AFL.1: Authentication Failure Management NDcPP22e:FIA_PMG_EXT.1: Password Management NDcPP22e:FIA_UAU.7: Protected Authentication Feedback NDcPP22e:FIA_UAU_EXT.2: Password-based Authentication Mechanism NDcPP22e:FIA_UIA_EXT.1: User Identification and Authentication NDcPP22e:FIA_X509_EXT.1/Rev: X.509 Certificate Validation NDcPP22e:FIA_X509_EXT.2: X.509 Certificate Authentication NDcPP22e:FIA_X509_EXT.3: X.509 Certificate Requests Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 24 of 48 FMT: Security management NDcPP22e:FMT_MOF.1/ManualUpdate: Management of security functions behaviour NDcPP22e:FMT_MTD.1/CoreData: Management of TSF Data NDcPP22e:FMT_MTD.1/CryptoKeys: Management of TSF Data NDcPP22e:FMT_SMF.1: Specification of Management Functions NDcPP22e:FMT_SMR.2: Restrictions on Security Roles FPT: Protection of the TSF NDcPP22e:FPT_APW_EXT.1: Protection of Administrator Passwords NDcPP22e:FPT_SKP_EXT.1: Protection of TSF Data (for reading of all pre-shared, symmetric and private keys) NDcPP22e:FPT_STM_EXT.1: Reliable Time Stamps NDcPP22e:FPT_TST_EXT.1: TSF testing NDcPP22e:FPT_TUD_EXT.1: Trusted update FTA: TOE access NDcPP22e:FTA_SSL.3: TSF-initiated Termination NDcPP22e:FTA_SSL.4: User-initiated Termination NDcPP22e:FTA_SSL_EXT.1: TSF-initiated Session Locking NDcPP22e:FTA_TAB.1: Default TOE Access Banners FTP: Trusted path/channels NDcPP22e:FTP_ITC.1: Inter-TSF trusted channel NDcPP22e:FTP_TRP.1/Admin: Trusted Path Table 9 TOE Security Functional Components 5.1.1 Security audit (FAU) 5.1.1.1 Audit Data Generation (NDcPP22e:FAU_GEN.1) NDcPP22e:FAU_GEN.1.1 The TSF shall be able to generate an audit record of the following auditable events: a) Start-up and shut-down of the audit functions; b) All auditable events for the not specified level of audit; and c) All administrative actions comprising: - Administrative login and logout (name of user account shall be logged if individual user accounts are required for administrators). - Changes to TSF data related to configuration changes (in addition to the information that a change occurred it shall be logged what has been changed). - Generating/import of, changing, or deleting of cryptographic keys (in addition to the action itself a unique key name or key reference shall be logged). - Resetting passwords (name of related user account shall be logged). - [no other actions]; d) Specifically defined auditable events listed in Table 10. Requirement Auditable Events Additional Content NDcPP22e:FAU_GEN.1 None None NDcPP22e:FAU_GEN.2 None None NDcPP22e:FAU_STG_EXT.1 None None NDcPP22e:FCS_CKM.1 None None NDcPP22e:FCS_CKM.2 None None NDcPP22e:FCS_CKM.4 None None NDcPP22e:FCS_COP.1/DataEncryption None None NDcPP22e:FCS_COP.1/Hash None None NDcPP22e:FCS_COP.1/KeyedHash None None NDcPP22e:FCS_COP.1/SigGen None None Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 25 of 48 NDcPP22e:FCS_NTP_EXT.1 Configuration of a new time server Removal of configured time server Identity if new/removed time server NDcPP22e:FCS_RBG_EXT.1 None None NDcPP22e:FCS_SSHS_EXT.1 Failure to establish an SSH session. Reason for failure. NDcPP22e:FCS_TLSC_EXT.1 Failure to establish a TLS Session. Reason for failure. NDcPP22e:FCS_TLSC_EXT.2 None None NDcPP22e:FIA_AFL.1 Unsuccessful login attempt limit is met or exceeded. Origin of the attempt (e.g., IP address). NDcPP22e:FIA_PMG_EXT.1 None None NDcPP22e:FIA_UAU.7 None None NDcPP22e:FIA_UAU_EXT.2 All use of identification and authentication mechanism. Origin of the attempt (e.g., IP address). NDcPP22e:FIA_UIA_EXT.1 All use of identification and authentication mechanism. Origin of the attempt (e.g., IP address). NDcPP22e:FIA_X509_EXT.1/Rev Unsuccessful attempt to validate a certificate Any addition, replacement or removal of trust anchors in the TOE's trust store Reason for failure of certificate validation Identification of certificates added, replaced or removed as trust anchor in the TOE's trust store NDcPP22e:FIA_X509_EXT.2 None None NDcPP22e:FIA_X509_EXT.3 None None NDcPP22e:FMT_MOF.1/ManualUpdate Any attempt to initiate a manual update. None NDcPP22e:FMT_MTD.1/CoreData None None NDcPP22e:FMT_MTD.1/CryptoKeys None None NDcPP22e:FMT_SMF.1 All management activities of TSF data. None NDcPP22e:FMT_SMR.2 None None NDcPP22e:FPT_APW_EXT.1 None None NDcPP22e:FPT_SKP_EXT.1 None None NDcPP22e:FPT_STM_EXT.1 Discontinuous changes to time - either Administrator actuated or changed via an automated process. (Note that no continuous changes to time need to be logged. See also application note on FPT_STM_EXT.1) For discontinuous changes to time: The old and new values for the time. Origin of the attempt to change time for success and failure (e.g., IP address). NDcPP22e:FPT_TST_EXT.1 None None NDcPP22e:FPT_TUD_EXT.1 Initiation of update; result of the update attempt (success or failure). None NDcPP22e:FTA_SSL.3 The termination of a remote session by the session locking mechanism. None NDcPP22e:FTA_SSL.4 The termination of an interactive session. None NDcPP22e:FTA_SSL_EXT.1 (if 'lock the session' is selected) Any attempts at unlocking of an None Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 26 of 48 interactive session. (if 'terminate the session' is selected) The termination of a local session by the session locking mechanism. NDcPP22e:FTA_TAB.1 None None NDcPP22e:FTP_ITC.1 Initiation of the trusted channel. Termination of the trusted channel. Failure of the trusted channel functions. Identification of the initiator and target of failed trusted channels establishment attempt. NDcPP22e:FTP_TRP.1/Admin Initiation of the trusted path. Termination of the trusted path. Failure of the trusted path functions. None Table 10 Audit Events NDcPP22e:FAU_GEN.1.2 The TSF shall record within each audit record at least the following information: a) Date and time of the event, type of event, subject identity, and the outcome (success or failure) of the event; and b) For each audit event type, based on the auditable event definitions of the functional components included in the cPP/ST, information specified in column three of Table 10. 5.1.1.2 User identity association (NDcPP22e:FAU_GEN.2) NDcPP22e:FAU_GEN.2.1 For audit events resulting from actions of identified users, the TSF shall be able to associate each auditable event with the identity of the user that caused the event. 5.1.1.3 Protected Audit Event Storage (NDcPP22e:FAU_STG_EXT.1) NDcPP22e:FAU_STG_EXT.1.1 The TSF shall be able to transmit the generated audit data to an external IT entity using a trusted channel according to FTP_ITC.1. NDcPP22e:FAU_STG_EXT.1.2 The TSF shall be able to store generated audit data on the TOE itself. In addition [The TOE shall consist of a single standalone component that stores audit data locally] NDcPP22e:FAU_STG_EXT.1.3 The TSF shall [overwrite previous audit records according to the following rule: [events are written to a circular buffer and oldest events are overwritten first]] when the local storage space for audit data is full. 5.1.2 Cryptographic support (FCS) 5.1.2.1 Cryptographic Key Generation (NDcPP22e:FCS_CKM.1) NDcPP22e:FCS_CKM.1.1 The TSF shall generate asymmetric cryptographic keys in accordance with a specified cryptographic key generation algorithm: [ - RSA schemes using cryptographic key sizes of 2048-bit or greater that meet the following: FIPS PUB 186-4, 'Digital Signature Standard (DSS)', Appendix B.3, - ECC schemes using 'NIST curves' [P-256, P-384, P-521] that meet the following: FIPS PUB 186-4, 'Digital Signature Standard (DSS)', Appendix B.4, -FFC schemes using cryptographic key sizes of 2048-bit or greater that meet the following: FIPS PUB 186-4, 'Digital Signature Standard (DSS)', Appendix B.1 Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 27 of 48 - FFC Schemes using ‘safe-prime’ groups that meet the following: NIST Special Publication 800-56A Revision 3, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography and [RFC 3526]]. 5.1.2.2 Cryptographic Key Establishment (NDcPP22e:FCS_CKM.2) NDcPP22e:FCS_CKM.2.1 The TSF shall perform cryptographic key establishment in accordance with a specified cryptographic key establishment method: [ - RSA-based key establishment schemes that meet the following: RSAES-PKCS1-v1_5 as specified in Section 7.2 of RFC 3447, Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1, - Elliptic curve-based key establishment schemes that meet the following: NIST Special Publication 800-56A Revision 3, 'Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography' (TD0581 applied), - Finite field-based key establishment schemes that meet the following: NIST Special Publication 800-56A Revision 2, 'Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography' - FFC Schemes using safe-prime groups that meet the following: NIST Special Publication 800-56A Revision 3, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography and [groups listed in RFC 3526] (TD0580 applied)] 5.1.2.3 Cryptographic Key Destruction (NDcPP22e:FCS_CKM.4) NDcPP22e:FCS_CKM.4.1 The TSF shall destroy cryptographic keys in accordance with a specified cryptographic key destruction method - For plaintext keys in volatile storage, the destruction shall be executed by a [single overwrite consisting of [zeroes]]; - For plaintext keys in non-volatile storage, the destruction shall be executed by the invocation of an interface provided by a part of the TSF that [logically addresses the storage location of the key and performs a [single] overwrite consisting of [zeroes]] that meets the following: No Standard. 5.1.2.4 Cryptographic Operation (AES Data Encryption/Decryption) (NDcPP22e:FCS_COP.1/DataEncryption) NDcPP22e:FCS_COP.1.1/DataEncryption The TSF shall perform encryption/decryption in accordance with a specified cryptographic algorithm AES used in [CBC, CTR] mode and cryptographic key sizes [128 bits, 256 bits] that meet the following: AES as specified in ISO 18033-3, [CBC as specified in ISO 10116, CTR as specified in ISO 10116]. 5.1.2.5 Cryptographic Operation (Hash Algorithm) (NDcPP22e:FCS_COP.1/Hash) NDcPP22e:FCS_COP.1.1/Hash The TSF shall perform cryptographic hashing services in accordance with a specified cryptographic algorithm [SHA-1, SHA-256, SHA-512] and message digest sizes [160, 256, 512] bits that meet the following: ISO/IEC 10118-3:2004. 5.1.2.6 Cryptographic Operation (Keyed Hash Algorithm) (NDcPP22e:FCS_COP.1/KeyedHash) NDcPP22e:FCS_COP.1.1/KeyedHash The TSF shall perform keyed-hash message authentication in accordance with a specified cryptographic algorithm [HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-512] and Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 28 of 48 cryptographic key sizes [160 bits, 256 bits, 512 bits] and message digest sizes [160, 256, 512] bits that meet the following: ISO/IEC 9797-2:2011, Section 7 'MAC Algorithm 2'. 5.1.2.7 Cryptographic Operation (Signature Generation and Verification) (NDcPP22e:FCS_COP.1/SigGen) NDcPP22e:FCS_COP.1.1/SigGen The TSF shall perform cryptographic signature services (generation and verification) in accordance with a specified cryptographic algorithm [- RSA Digital Signature Algorithm and cryptographic key sizes (modulus) [2048 bits, 3072 bits]] that meet the following: [- For RSA schemes: FIPS PUB 186-4, 'Digital Signature Standard (DSS)', Section 5.5, using PKCS #1 v2.1 Signature Schemes RSASSA-PSS and/or RSASSA-PKCS1v1_5; ISO/IEC 9796-2, Digital signature scheme 2 or Digital Signature scheme 3]. 5.1.2.8 NTP Protocol (NDcPP22e:FCS_NTP_EXT.1) NDcPP22e:FCS_NTP_EXT.1.1 The TSF shall use only the following NTP version(s) [NTP v3 (RFC 1305)]. NDcPP22e:FCS_NTP_EXT.1.2 The TSF shall update its system time using [Authentication using [SHA256] as the message digest algorithm(s);]. NDcPP22e:FCS_NTP_EXT.1.3 The TSF shall not update NTP timestamp from broadcast and/or multicast addresses. NDcPP22e:FCS_NTP_EXT.1.4 The TSF shall support configuration of at least three (3) NTP time sources in the Operational Environment. 5.1.2.9 Random Bit Generation (NDcPP22e:FCS_RBG_EXT.1) NDcPP22e:FCS_RBG_EXT.1.1 The TSF shall perform all deterministic random bit generation services in accordance with ISO/IEC 18031:2011 using [CTR_DRBG (AES)]. NDcPP22e:FCS_RBG_EXT.1.2 The deterministic RBG shall be seeded by at least one entropy source that accumulates entropy from [[one] platform-based noise source] with a minimum of [256 bits] of entropy at least equal to the greatest security strength, according to ISO/IEC 18031:2011Table C.1 'Security Strength Table for Hash Functions', of the keys and hashes that it will generate. 5.1.2.10 SSH Server Protocol (NDcPP22e:FCS_SSHS_EXT.1) NDcPP22e:FCS_SSHS_EXT.1.1 The TSF shall implement the SSH protocol that complies with: RFC(s) 4251, 4252, 4253, 4254, [6668, 8308 section 3.1, 8332]. NDcPP22e:FCS_SSHS_EXT.1.2 The TSF shall ensure that the SSH protocol implementation supports the following user authentication methods as described in RFC 4252: public key-based, [password-based]. NDcPP22e:FCS_SSHS_EXT.1.3 The TSF shall ensure that, as described in RFC 4253, packets greater than [262126] bytes in an SSH transport connection are dropped. NDcPP22e:FCS_SSHS_EXT.1.4 The TSF shall ensure that the SSH transport implementation uses the following encryption algorithms and rejects all other encryption algorithms: [aes128-cbc, aes256-cbc, aes128-ctr, aes256-ctr]. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 29 of 48 NDcPP22e:FCS_SSHS_EXT.1.5 The TSF shall ensure that the SSH public-key based authentication implementation uses [ssh-rsa] as its public key algorithm(s) and rejects all other public key algorithms. NDcPP22e:FCS_SSHS_EXT.1.6 The TSF shall ensure that the SSH transport implementation uses [hmac-sha1, hmac-sha2-256, hmac-sha2-512] as its MAC algorithm(s) and rejects all other MAC algorithm(s). NDcPP22e:FCS_SSHS_EXT.1.7 The TSF shall ensure that [diffie-hellman-group14-sha1] and [diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512] are the only allowed key exchange methods used for the SSH protocol. NDcPP22e:FCS_SSHS_EXT.1.8 The TSF shall ensure that within SSH connections, the same session keys are used for a threshold of no longer than one hour, and each encryption key is used to protect no more than one gigabyte of data. After any of the thresholds are reached, a rekey needs to be performed. 5.1.2.11 TLS Client Protocol Without Mutual Authentication (NDcPP22e:FCS_TLSC_EXT.1) NDcPP22e:FCS_TLSC_EXT.1.1 The TSF shall implement [TLS 1.2 (RFC 5246)] and reject all other TLS and SSL versions. The TLS implementation will support the following ciphersuites: [TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5246, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 as defined in RFC 5246, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 as defined in RFC 5289, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 as defined in RFC 5289] and no other ciphersuites. NDcPP22e:FCS_TLSC_EXT.1.2 The TSF shall verify that the presented identifier matches [the reference identifier per RFC 6125 section 6]. NDcPP22e:FCS_TLSC_EXT.1.3 When establishing a trusted channel, by default the TSF shall not establish a trusted channel if the server certificate is invalid. The TSF shall also [not implement any administrator override mechanism]. NDcPP22e:FCS_TLSC_EXT.1.4 The TSF shall [present the Supported Elliptic Curves/Supported Groups Extension with the following curves/groups: [secp256r1, secp384r1, secp521r1] and no other curves/groups] in the Client Hello. 5.1.2.12 TLS Client Support for Mutual Authentication (NDcPP22e:FCS_TLSC_EXT.2) NDcPP22e:FCS_TLSC_EXT.2.1 The TSF shall support TLS communication with mutual authentication using X.509v3 certificates. 5.1.3 Identification and authentication (FIA) 5.1.3.1 Authentication Failure Management (NDcPP22e:FIA_AFL.1) NDcPP22e:FIA_AFL.1.1 The TSF shall detect when an Administrator configurable positive integer within [1-10] unsuccessful authentication attempts occur related to Administrators attempting to authenticate remotely using a password. NDcPP22e:FIA_AFL.1.2 When the defined number of unsuccessful authentication attempts has been met, the TSF shall [prevent the offending Administrator from successfully establishing a remote session using any Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 30 of 48 authentication method that involves a password until an Administrator defined time period has elapsed]. 5.1.3.2 Password Management (NDcPP22e:FIA_PMG_EXT.1) NDcPP22e:FIA_PMG_EXT.1.1 The TSF shall provide the following password management capabilities for administrative passwords: a) Passwords shall be able to be composed of any combination of upper and lower case letters, numbers, and the following special characters: [‘!’, ‘@’, ‘#’, ‘$’, ‘%’, ‘^’, ‘&’,’*’, ’(‘, ‘)’ ]; b) Minimum password length shall be configurable to between [1] and [32] characters. 5.1.3.3 Protected Authentication Feedback (NDcPP22e:FIA_UAU.7) NDcPP22e:FIA_UAU.7.1 The TSF shall provide only obscured feedback to the administrative user while the authentication is in progress at the local console. 5.1.3.4 Password-based Authentication Mechanism (NDcPP22e:FIA_UAU_EXT.2) NDcPP22e:FIA_UAU_EXT.2.1 The TSF shall provide a local [password-based, SSH public key-based] authentication mechanism to perform local administrative user authentication. 5.1.3.5 User Identification and Authentication (NDcPP22e:FIA_UIA_EXT.1) NDcPP22e:FIA_UIA_EXT.1.1 The TSF shall allow the following actions prior to requiring the non-TOE entity to initiate the identification and authentication process: - Display the warning banner in accordance with FTA_TAB.1; - [no other actions]. NDcPP22e:FIA_UIA_EXT.1.2 The TSF shall require each administrative user to be successfully identified and authenticated before allowing any other TSF-mediated actions on behalf of that administrative user. 5.1.3.6 X.509 Certificate Validation (NDcPP22e:FIA_X509_EXT.1/Rev) NDcPP22e:FIA_X509_EXT.1.1/Rev The TSF shall validate certificates in accordance with the following rules: - RFC 5280 certificate validation and certification path validation supporting a minimum path length of three certificates. - The certification path must terminate with a trusted CA certificate designated as a trust anchor. - The TSF shall validate a certification path by ensuring that all CA certificates in the certification path contain the basicConstraints extension with the CA flag set to TRUE. - The TSF shall validate the revocation status of the certificate using [the Online Certificate Status Protocol (OCSP) as specified in RFC 6960] - The TSF shall validate the extendedKeyUsage field according to the following rules: o Certificates used for trusted updates and executable code integrity verification shall have the Code Signing purpose (id-kp 3 with OID 1.3.6.1.5.5.7.3.3) in the extendedKeyUsage field. o Server certificates presented for TLS shall have the Server Authentication purpose (id-kp 1 with OID 1.3.6.1.5.5.7.3.1) in the extendedKeyUsage field. o Client certificates presented for TLS shall have the Client Authentication purpose (id-kp 2 with OID 1.3.6.1.5.5.7.3.2) in the extendedKeyUsage field. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 31 of 48 o OCSP certificates presented for OCSP responses shall have the OCSP Signing purpose (id-kp 9 with OID 1.3.6.1.5.5.7.3.9) in the extendedKeyUsage field. NDcPP22e:FIA_X509_EXT.1.2/Rev The TSF shall only treat a certificate as a CA certificate if the basicConstraints extension is present and the CA flag is set to TRUE. 5.1.3.7 X.509 Certificate Authentication (NDcPP22e:FIA_X509_EXT.2) NDcPP22e:FIA_X509_EXT.2.1 The TSF shall use X.509v3 certificates as defined by RFC 5280 to support authentication for [TLS], and [no additional uses]. NDcPP22e:FIA_X509_EXT.2.2 When the TSF cannot establish a connection to determine the validity of a certificate, the TSF shall [not accept the certificate]. 5.1.3.8 X.509 Certificate Requests (NDcPP22e:FIA_X509_EXT.3) NDcPP22e:FIA_X509_EXT.3.1 The TSF shall generate a Certification Request as specified by RFC 2986 and be able to provide the following information in the request: public key and [Common Name, Organization, Organizational Unit, Country]. NDcPP22e:FIA_X509_EXT.3.2 The TSF shall validate the chain of certificates from the Root CA upon receiving the CA Certificate Response. 5.1.4 Security management (FMT) 5.1.4.1 Management of security functions behaviour (NDcPP22e:FMT_MOF.1/ManualUpdate) NDcPP22e:FMT_MOF.1.1/ManualUpdate The TSF shall restrict the ability to enable the functions to perform manual updates to Security Administrators. 5.1.4.2 Management of TSF Data (NDcPP22e:FMT_MTD.1/CoreData) NDcPP22e:FMT_MTD.1.1/CoreData The TSF shall restrict the ability to manage the TSF data to Security Administrators. 5.1.4.3 Management of TSF Data (NDcPP22e:FMT_MTD.1/CryptoKeys) NDcPP22e:FMT_MTD.1.1/CryptoKeys The TSF shall restrict the ability to manage the cryptographic keys to Security Administrators. 5.1.4.4 Specification of Management Functions (NDcPP22e:FMT_SMF.1) NDcPP22e:FMT_SMF.1.1 The TSF shall be capable of performing the following management functions: - Ability to administer the TOE locally and remotely; - Ability to configure the access banner; - Ability to configure the session inactivity time before session termination or locking; - Ability to update the TOE, and to verify the updates using [digital signature] capability prior to installing those updates; - Ability to configure the authentication failure parameters for FIA_AFL.1; Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 32 of 48 [Ability to modify the behaviour of the transmission of audit data to an external IT entity; Ability to manage the cryptographic keys; Ability to configure the cryptographic functionality; Ability to configure thresholds for SSH rekeying; Ability to set the time which is used for time-stamps; Ability to configure NTP; Ability to configure the reference identifier for the peer; Ability to import X509v3 certificates to the TOE's trust store; Ability to manage the TOE’s trust store and designate X509.v3 certificates as trust anchors; Ability to manage the trusted public keys database ]. 5.1.4.5 Restrictions on Security Roles (NDcPP22e:FMT_SMR.2) NDcPP22e:FMT_SMR.2.1 The TSF shall maintain the roles: - Security Administrator. NDcPP22e:FMT_SMR.2.2 The TSF shall be able to associate users with roles. NDcPP22e:FMT_SMR.2.3 The TSF shall ensure that the conditions - The Security Administrator role shall be able to administer the TOE locally; - The Security Administrator role shall be able to administer the TOE remotely are satisfied. 5.1.5 Protection of the TSF (FPT) 5.1.5.1 Protection of Administrator Passwords (NDcPP22e:FPT_APW_EXT.1) NDcPP22e:FPT_APW_EXT.1.1 The TSF shall store administrative passwords in non-plaintext form. NDcPP22e:FPT_APW_EXT.1.2 The TSF shall prevent the reading of plaintext administrative passwords. 5.1.5.2 Protection of TSF Data (for reading of all pre-shared, symmetric and private keys) (NDcPP22e:FPT_SKP_EXT.1) NDcPP22e:FPT_SKP_EXT.1.1 The TSF shall prevent reading of all pre-shared keys, symmetric keys, and private keys. 5.1.5.3 Reliable Time Stamps (NDcPP22e:FPT_STM_EXT.1) NDcPP22e:FPT_STM_EXT.1.1 The TSF shall be able to provide reliable time stamps for its own use. NDcPP22e:FPT_STM_EXT.1.2 The TSF shall [allow the Security Administrator to set the time, synchronise time with an NTP server]. 5.1.5.4 TSF testing (NDcPP22e:FPT_TST_EXT.1) NDcPP22e:FPT_TST_EXT.1.1 The TSF shall run a suite of the following self-tests [during initial start-up (on power on]] to demonstrate the correct operation of the TSF: [ Power-up self-tests: Integrity check of the cryptographic module Known Answer Tests (KAT) of cryptographic primitives]. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 33 of 48 5.1.5.5 Trusted update (NDcPP22e:FPT_TUD_EXT.1) NDcPP22e:FPT_TUD_EXT.1.1 The TSF shall provide Security Administrators the ability to query the currently executing version of the TOE firmware/software and [the most recently installed version of the TOE firmware/software]. NDcPP22e:FPT_TUD_EXT.1.2 The TSF shall provide Security Administrators the ability to manually initiate updates to TOE firmware/software and [no other update mechanism]. NDcPP22e:FPT_TUD_EXT.1.3 The TSF shall provide means to authenticate firmware/software updates to the TOE using a [digital signature] prior to installing those updates. 5.1.6 TOE access (FTA) 5.1.6.1 TSF-initiated Termination (NDcPP22e:FTA_SSL.3) NDcPP22e:FTA_SSL.3.1 The TSF shall terminate a remote interactive session after a Security Administrator-configurable time interval of session inactivity. 5.1.6.2 User-initiated Termination (NDcPP22e:FTA_SSL.4) NDcPP22e:FTA_SSL.4.1 The TSF shall allow Administrator-initiated termination of the Administrator's own interactive session. 5.1.6.3 TSF-initiated Session Locking (NDcPP22e:FTA_SSL_EXT.1) NDcPP22e:FTA_SSL_EXT.1.1 The TSF shall, for local interactive sessions, [terminate the session] after a Security Administrator-specified time period of inactivity. 5.1.6.4 Default TOE Access Banners (NDcPP22e:FTA_TAB.1) NDcPP22e:FTA_TAB.1.1 Before establishing an administrative user session the TSF shall display a Security Administrator- specified advisory notice and consent warning message regarding use of the TOE. 5.1.7 Trusted path/channels (FTP) 5.1.7.1 Inter-TSF trusted channel (NDcPP22e:FTP_ITC.1) NDcPP22e:FTP_ITC.1.1 The TSF shall be capable of using [TLS] to provide a trusted communication channel between itself and authorized IT entities supporting the following capabilities: audit server, [no other capabilities] that is logically distinct from other communication channels and provides assured identification of its end points and protection of the channel data from disclosure and detection of modification of the channel data. NDcPP22e:FTP_ITC.1.2 The TSF shall permit the TSF or the authorized IT entities to initiate communication via the trusted channel. NDcPP22e:FTP_ITC.1.3 The TSF shall initiate communication via the trusted channel for [transmitting audit records to an audit server]. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 34 of 48 5.1.7.2 Trusted Path (NDcPP22e:FTP_TRP.1/Admin) NDcPP22e:FTP_TRP.1.1/Admin The TSF shall be capable of using [SSH] to provide a communication path between itself and authorized remote Administrators that is logically distinct from other communication paths and provides assured identification of its end points and protection of the communicated data from disclosure and provides detection of modification of the channel data. NDcPP22e:FTP_TRP.1.2/Admin The TSF shall permit remote Administrators to initiate communication via the trusted path. NDcPP22e:FTP_TRP.1.3/Admin The TSF shall require the use of the trusted path for initial Administrator authentication and all remote administration actions. 5.2 TOE Security Assurance Requirements The SARs for the TOE are the components as specified in Part 3 of the Common Criteria. Note that the SARs have effectively been refined with the assurance activities explicitly defined in association with both the SFRs and SARs. Requirement Class Requirement Component ADV: Development ADV_FSP.1: Basic Functional Specification AGD: Guidance documents AGD_OPE.1: Operational User Guidance AGD_PRE.1: Preparative Procedures ALC: Life-cycle support ALC_CMC.1: Labelling of the TOE ALC_CMS.1: TOE CM Coverage ATE: Tests ATE_IND.1: Independent Testing - Conformance AVA: Vulnerability assessment AVA_VAN.1: Vulnerability Survey AVA_VLA.1: Additional Flaw Hypotheses Table 11 Assurance Components 5.2.1 Development (ADV) 5.2.1.1 Basic Functional Specification (ADV_FSP.1) ADV_FSP.1.1d The developer shall provide a functional specification. ADV_FSP.1.2d The developer shall provide a tracing from the functional specification to the SFRs. ADV_FSP.1.1c The functional specification shall describe the purpose and method of use for each SFR-enforcing and SFR-supporting TSFI. ADV_FSP.1.2c The TSF shall support mutual authentication of TLS clients using X.509v3 certificates. ADV_FSP.1.3c The functional specification shall provide rationale for the implicit categorization of interfaces as SFR-non-interfering. ADV_FSP.1.4c The tracing shall demonstrate that the SFRs trace to TSFIs in the functional specification. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 35 of 48 ADV_FSP.1.1e The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. ADV_FSP.1.2e The evaluator shall determine that the functional specification is an accurate and complete instantiation of the SFRs. 5.2.2 Guidance documents (AGD) 5.2.2.1 Operational User Guidance (AGD_OPE.1) AGD_OPE.1.1d The developer shall provide operational user guidance. AGD_OPE.1.1c The operational user guidance shall describe, for each user role, the user-accessible functions and privileges that should be controlled in a secure processing environment, including appropriate warnings. AGD_OPE.1.2c The operational user guidance shall describe, for each user role, how to use the available interfaces provided by the TOE in a secure manner. AGD_OPE.1.3c The operational user guidance shall describe, for each user role, the available functions and interfaces, in particular all security parameters under the control of the user, indicating secure values as appropriate. AGD_OPE.1.4c The operational user guidance shall, for each user role, clearly present each type of security- relevant event relative to the user-accessible functions that need to be performed, including changing the security characteristics of entities under the control of the TSF. AGD_OPE.1.5c The operational user guidance shall identify all possible modes of operation of the TOE (including operation following failure or operational error), their consequences, and implications for maintaining secure operation. AGD_OPE.1.6c The operational user guidance shall, for each user role, describe the security measures to be followed in order to fulfill the security objectives for the operational environment as described in the ST. AGD_OPE.1.7c The operational user guidance shall be clear and reasonable. AGD_OPE.1.1e The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 5.2.2.2 Preparative Procedures (AGD_PRE.1) AGD_PRE.1.1d The developer shall provide the TOE, including its preparative procedures. AGD_PRE.1.1c The preparative procedures shall describe all the steps necessary for secure acceptance of the delivered TOE in accordance with the developer's delivery procedures. AGD_PRE.1.2c The preparative procedures shall describe all the steps necessary for secure installation of the TOE and for the secure preparation of the operational environment in accordance with the security objectives for the operational environment as described in the ST. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 36 of 48 AGD_PRE.1.1e The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. AGD_PRE.1.2e The evaluator shall apply the preparative procedures to confirm that the TOE can be prepared securely for operation. 5.2.3 Life-cycle support (ALC) 5.2.3.1 Labelling of the TOE (ALC_CMC.1) ALC_CMC.1.1d The developer shall provide the TOE and a reference for the TOE. ALC_CMC.1.1c The TOE shall be labelled with its unique reference. ALC_CMC.1.1e The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 5.2.3.2 TOE CM Coverage (ALC_CMS.1) ALC_CMS.1.1d The developer shall provide a configuration list for the TOE. ALC_CMS.1.1c The configuration list shall include the following: the TOE itself; and the evaluation evidence required by the SARs. ALC_CMS.1.2c The configuration list shall uniquely identify the configuration items. ALC_CMS.1.1e The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. 5.2.4 Tests (ATE) 5.2.4.1 Independent Testing - Conformance (ATE_IND.1) ATE_IND.1.1d The developer shall provide the TOE for testing. ATE_IND.1.1c The TOE shall be suitable for testing. ATE_IND.1.1e The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. ATE_IND.1.2e The evaluator shall test a subset of the TSF to confirm that the TSF operates as specified. 5.2.5 Vulnerability assessment (AVA) 5.2.5.1 Vulnerability Survey (AVA_VAN.1) AVA_VAN.1.1d The developer shall provide the TOE for testing. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 37 of 48 AVA_VAN.1.1c The TOE shall be suitable for testing. AVA_VAN.1.1e The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence. AVA_VAN.1.2e The evaluator shall perform a search of public domain sources to identify potential vulnerabilities in the TOE. AVA_VAN.1.3e The evaluator shall conduct penetration testing, based on the identified potential vulnerabilities, to determine that the TOE is resistant to attacks performed by an attacker possessing Basic attack potential. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 38 of 48 6. TOE Summary Specification This chapter describes the security functions: - Security audit - Cryptographic support - Identification and authentication - Security management - Protection of the TSF - TOE access - Trusted path/channels 6.1 Security audit The TOE has the capability to generate audit records. For each audit captured, the generated record contains: the date and time, the type of event, the subject identity (e.g. IP address or User Name), and the outcome. The TOE implements configurable audit filters, with a global filter called DefaultFilter that provides the defining default audit behavior for all targets. Authorized administrators can add, remove, or apply different filters for each target. The TOE implements the following audit targets, each with its own unique behavior: Target Description console Local CLI session Remote CLI memory-buffer Volatile local storage, wiped on reboot nvram Non-volatile local storage syslog External audit storage Table 12 Audit Targets The TOE categorizes audit records by severity levels as follows: critical, error, warning, notice, informational and extended debugging. By default, the memory-buffer and syslog targets are configured to capture log information at levels debug-data through critical, while nvram captures log information at levels warning through critical. An authorized administrator can configure log information levels and apply filters using the configure log target command. The TOE is a standalone TOE that stores audit data locally and can also export all logs to an external audit server. The audit trail consists of individual audit records, with a unique audit record generated for each event that occurred. An administrator-configurable number of log messages can be stored locally on the appliance. Approximately, 20KB for nvram and 200-20000 records for memory-buffer can be stored locally. All local audit records exist in a circular buffer, FIFO manner; when the buffer gets full, the oldest message is overwritten first. There is no access to audit data storage; the CLI allows displaying of logs but there is no access to log files. Only Security Administrators can view the audit records. In this way, the audit records are protected against unauthorized access and deletion. Clearing the local audit trail is done per target and it wipes all audit records for that target. The transmission of audit logs to the external audit server is done in real time, with audit records transferred as they are generated. If the connection to the external audit server is lost, the TOE continues to save local audit logs so there Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 39 of 48 is no loss of audit. There is automated log reconciliation process (syncing) between the locally stored records with the external audit server upon the re-establishment of the connection. The TOE audits the following administrative tasks related to cryptographic keys and certificates: • Association of a public RSA key with an administrative identity • Installation of a trusted authority certificate • Generation of a CSR and import of a signed TOE certificate • Generation of a TOE’s RSA key pair In the audit logs, the X509 certificates are identified by “CN” and RSA keys by a hash. The Security audit function satisfies the following security functional requirements: • NDcPP22e:FAU_GEN.1: The TOE can generate all the required auditable events as specified in Table 10 Audit Events. Within each audit event is date/time, event type, outcome of the event, responsible subject/user, as well as the additional event-specific content indicated in Table 10 Audit Events. For cryptographic keys, the act of generating, importing, changing or deleting a key is audited by key name and the associated administrator account is identified. • NDcPP22e:FAU_GEN.2: The TOE identifies the responsible user for each event based on the specific administrator or network entity (identified by IP address) that caused the event. • NDcPP22e:FAU_STG_EXT.1: The TOE can be configured to export audit records to an external SYSLOG server. This communication is protected with the use of TLS. 6.2 Cryptographic support The EXOS utilizes Extreme Networks FIPS Object Module, a firmware cryptographic module based on OpenSSL. Extreme Networks FIPS Object Module (FOM) Version 2.0.16m is used in the Cavium Octeon (MIPS) platforms, while Extreme Networks FIPS Object Module (FOM) Version 2.0.16i is used in the Intel and ARM platforms. Both versions of this module have the same algorithm code. This cryptographic module operates in FIPS mode and exclusively implements all cryptographic functionality. The cryptographic library is capable of supporting additional, outside of the scope, cryptographic primitives but such functionality is disabled in the evaluated configuration. The following Cryptographic Algorithm Validation Program (CAVP) certificates are applicable to the TOE: Requirement Component Capabilities Certificate # Cavium Octeon II (FOM v2.0.16m) Cavium Octeon III (FOM v2.0.16m) Intel Atom C3338 (FOM v2.0.16i) Broadcom BCM 53549 BCM 56375 (FOM v2.0.16i) FCS_CKM.1 Cryptographic Key Generation RSA KeyGen Mod: 2048, 3072 DSA KeyGen Mod: 2048, 3072 ECDSA KeyGen P-256, P-384, P-512 C1154 A2782 C1156 A1391 Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 40 of 48 FCS_CKM.2 Cryptographic Key Establishment KAS FFC KAS ECC A2782 A2782 A1391 A1391 FCS_COP.1/ DataEncryption Cryptographic Operation (AES Data Encryption / Decryption) AES-CBC, CTR Key Length: 128, 256 C1154 A2782 C1156 A1391 FCS_COP.1/SigGen Cryptographic Operation (Signature Generation and Verification) RSA SigGen (FIPS186-4) PKCS 1.5 Mod: 2048, 3072 RSA SigVer (FIPS186-4) PKCS 1.5 Mod: 2048, 3072 C1154 A2782 A2782 C1156 A1391 A1391 FCS_COP.1/Hash Cryptographic Operation (Hash Algorithm) SHA-1, SHA2-256, SHA-512 C1154 A2782 C1156 A1391 FCS_COP.1/ KeyedHash Cryptographic Operation HMAC-SHA-1, HMAC-SHA2-256, HMAC-SHA-512 C1154 A2782 C1156 A1391 FCS_RBG.1 Random Bit Generation Counter DRBG Mode: AES-256 C1154 A2782 C1156 A1391 Table 13: ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Cryptography The TSF supports RSA key generation scheme using cryptographic key sizes of 2048 bit or greater that meet the FIPS PUB 186-4, “Digital Signature Standard (DSS)”, Appendix B.3; standard. The TSF also supports ECDSA (appendix B.4), FFC key generation (appendix B.1) and FFC schemes using ‘safe-prime’ groups that meet NIST SP 800-56A Revision 3 and RFC 3526. The key pairs can be used to generate a Certificate Signing Request (CSR). In support of secure cryptographic protocols, the TOE supports key establishment schemes, including: • RSA key establishment as specified in Section 7.2 of RFC 3447, Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1, • ECC key establishment as specified in NIST SP 800-56A Revision 3, ‘Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography’, • FFC key establishment in as specified in NIST SP 800-56A Revision 2, ‘Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography’, • FFC Schemes using ‘safe-prime’ groups that meet the following: NIST SP 800-56A Revision 3, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography and groups listed in RFC 3526. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 41 of 48 The TOE is fully compliant with the recommendations outlined in the schemes listed above. The following table outlines key establishment schemes used in the TOE: Scheme SFRs Service ECC FCS_TLSC_EXT.1 Remote Audit Server (client) RSA FCS_SSHS_EXT.1 Remote Administration (server) FFC FCS_TLSC_EXT.1 FCS_SSHS_EXT.1 Remote Audit Server (client) Remote Administration (server) Table 14: Key Establishment Schemes The TOE is designed to destroy Critical Security Parameters (CSPs) when no longer required for use to mitigate the possibility of disclosure. Volatile memory (RAM) is cleared with overwriting zeros. Non-volatile EEPROM, is destructed with overwrite consisting of zeros. For non-volatile flash memory, destruction is done by direct overwrite consisting of zeros. The table below describes each type of plaintext key material and its origin and storage location and the method of zeroization. Identifier Name Generation / Algorithm Purpose Storage Location Zeroization Summary CSP1 SSH Server Private Key RSA RSA based host private key. SSH session establishment NVRAM, RAM (plain text), FLASH The following are done upon execution of the “unconfigure switch all/erase” command. • The Key in NVRAM is zeroized by overwriting it with zeros. • The Key in RAM is zeroized by memset with 0. Keys are stored in FLASH temporarily. Once it is loaded into RAM, a key stored in FLASH- is zeroized. CSP2 SSH Server Public Key RSA RSA based host public key. SSH session establishment RAM (plain text) Zeroized by memset with 0 upon execution of the “unconfigure switch all/erase” command. No read verification is done. Keys are stored in FLASH temporarily. Once it is loaded into RAM, a key stored in FLASH- is zeroized. CSP3 SSH Session Keys Generated using SSH KDF SSH keys – server to client, client to server RAM (plain text) Session keys are cleared with 0x00 on session termination. CSP4 Diffie-Hellman shared secret DH Key agreement for SSH sessions RAM (plain text) Overwritten with zeroes after being used by the consuming application CSP5 Diffie-Hellman private and public parameters DH Key agreement for SSH sessions RAM (plain text) Overwritten with zeroes after key exchange completion CSP6 TLS Client key X509v3 TLS session establishment NVRAM Zeroized upon execution of the “unconfigure switch erase” command Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 42 of 48 Identifier Name Generation / Algorithm Purpose Storage Location Zeroization Summary CSP7 Administrative Passwords AES-CBC Credentials used to authenticate the administrator login. FLASH (ciphertext) Encrypted passwords exist locally in a startup configuration file and are replaced when that file is edited and saved. The passwords are stored in the file in protected form only. Overwritten with zeroes when the “unconfigure switch erase” command is run CSP8 PRNG Seed key /dev/random Seed key for PRNG RAM (plain text) Cleared when device is powered down or during reboot by the new seed. Table 15: ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Platforms CSPs The TOE uses SSH for to facilitate secure remote administrative sessions (CLI). The TOE's SSH implementation supports the following: • Use of 2048-bit RSA keys in support of SSH_RSA for public key-based authentication; • Dropping SSH packets greater than 262126 bytes. This is accomplished by buffering all data for a particular SSH packet transmission until the buffer limit is reached and then dropping the packet; • Strict compliance with RFCs 4251, 4252, 4253, 4254, 6668, 8308 section 3.1, and 8332. • No options included in the RFCs have been implemented; • Encryption algorithms aes128-cbc, aes256-cbc, aes128-ctr and aes256-ctr to ensure confidentiality of the session; • Password based authentication; • Public key-based authentication. The TOE ensures and verifies that the SSH client's presented public key matches one that is stored within the TOE's SSH server's authorized keys database; • Hashing algorithm hmac-sha1, hmac-sha2-256, and hmac-sha2-512 to ensure the integrity of the session; • Enforcement of diffie-hellman-group14-sha1, diffie-hellman-group14-sha256, diffie-hellman-group16- sha512, diffie-hellman-group18-sha512 as allowed key exchange methods. • SSH session rekey limits are administrator configurable such that an SSH connection is rekeyed before 60 minutes of connection time or 1 GB of data traffic, whichever threshold is met first. The TOE exclusively supports TLS v1.2 secure communication protocol that complies with RFC 5246. The TOE supports mutual X509v3 certificate-based authentication and the following ciphers: • TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 • TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 The TOE implements reference identifier matching according to RFC 6125. The reference identifier is specified during configuration of the TLS connection. Supported reference identifiers are DNS names for the SAN and CN. As part of negotiating TLS connections, the TOE will verify that the peer certificate’s Subject Alternative Name (SAN) or Common Name (CN) contains the expected identifier. The CN is checked only if the SAN is absent. The TOE only establishes a connection if the peer certificate is valid, trusted, and has a matching reference identifier and if the Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 43 of 48 revocation check passed. The TOE does not implement certificate pinning. The TOE does not support identifiers that include wildcards or IP addresses. The TOE supports X509v3 certificates as defined by RFC 5280 to mutually authenticate TLS connections. By default, the TOE presents the Elliptic Curves/ Groups Extension in the Client Hello with the following curves/groups: secp256r1, secp384r1and secp521r1. The Cryptographic support function satisfies the following security functional requirements: • NDcPP22e:FCS_CKM.1: The TOE supports asymmetric key generation using RSA, ECDSA and FFC key establishment as part of TLS and SSH as described in the section above. The TOE acts as a client for TLS (ECDSA, FFC) and a server for SSH (RSA, FFC). The TOE supports DH group 14 key establishment scheme that meets standard RFC 3526, section 3 for interoperability. • NDcPP22e:FCS_CKM.2: See FCS_CKM.1 • NDcPP22e:FCS_CKM.4: All data is cleared as identified above • NDcPP22e:FCS_COP.1/DataEncryption: The TOE provides symmetric encryption and decryption capabilities using AES in CBC and CTR modes (128, 256 bits). AES is implemented in support of the following protocols: TLS, and SSH. • NDcPP22e:FCS_COP.1/Hash: The TOE supports hashing using SHA-1, SHA-256, and SHA-512 validated conforming to ISO/IEC 10118-3:2004. SHS hashing is used within several services including, NTP hashing, TLS, and SSH. SHA-256 is used in conjunction with RSA signatures for verification of software image integrity. • NDcPP22e:FCS_COP.1/KeyedHash: The TOE supports keyed hash HMAC-SHA1, HMAC-SHA256, and HMAC-SHA512 conforming to ISO/IEC 9797-2:2011 with cryptographic key sizes: 160, 256, 512 bits, message digest sizes: 160, 256, 512 bits and a 160/256/512 output MAC. The SHA-1/256 and 512 algorithms have block sizes of 512 and 1024 bits respectively. • NDcPP22e:FCS_COP.1/SigGen: The TOE supports RSA signature generation and verification according to RSASSA-PKCS1v1_5 with 2048-bit and 3072-bit key sizes utilizing SHA-1, SHA-256, SHA-512. • NDcPP22e:FCS_NTP_EXT.1: The TOE implements the NTPv3 protocol to synchronize with an external time server. The TOE authenticates updates using an administrator-configured SHA256-based message authentication. The TOE does not synchronize based on broadcast and multicast time updates. The TOE supports configuration of multiple simultaneous time servers and follows RFC 5905 algorithm to prioritize them. • NDcPP22e:FCS_RBG_EXT.1: The TOE implements a NIST-approved platform-based AES-CTR Deterministic Random Bit Generator (DRBG), in accordance with ISO/IEC 18031:2011. The DRBG is seeded by an entropy source that is at least 256-bit value. The TOE implements a random bit generator in support of various cryptographic operations, including, RSA key establishment schemes, Diffie-Hellman key establishment schemes and SSH session establishment. All random number generation functionality is continuously health tested as per the tests defined in section 11.3 of SP 900-90A. Any initialization or system errors during bring-up or processing of this system causes a reboot resulting in the DRBG being reseeded. • NDcPP22e:FCS_SSHS_EXT.1: The TOE supports SSHv2 as described above for CLI management. • NDcPP22e:FCS_TLSC_EXT.1: The TOE supports TLS v1.2 with the ciphersuites listed above for its syslog connections. • NDcPP22e:FCS_TLSC_EXT.2: The TOE supports mutual authentication when connecting to a syslog server using TLS. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 44 of 48 6.3 Identification and authentication The TOE requires any user to be identified and authenticated before any management action. In the evaluated configuration, the TOE does not allow unauthenticated configuration of the TOE’s network routing/switching services and does not allow any unauthenticated management action. A requesting user will be prompted to enter a user name and password upon establishing a successful connection. The TOE will then compare the entered credentials against the known user database. If the combinations match, the TOE will then attribute (bind) the administratively-assigned role (a predetermined group of privileges that dictate access to TOE functions) to that user for the duration of their logged-in management session. For remote administration (implemented as a CLI over SSH) the TOE can be configured to authenticate using a public key mechanism (RSA), or a password-based mechanism. If a user attempts public key-based authentication and it succeeds, the authentication process is completed and the user is granted access. If the user fails to authenticate using a public key certificate, then the TOE falls back to password-based authentication and requires the user to enter a valid username and password. When a user attempts to authenticate using password based authentication, they are prompted to enter in a valid username and password. If the user succeeds, the authentication process is completed and the user is granted access to the command line prompt for the CLI. If the authentication process fails, then the user will be prompted to re-enter their credentials. When RSA authentication is used, the TOE checks the presented public key against its authorized keys database and verifies the user’s possession of a private key by negotiating a secure channel using the public key associated with that private key. For local administration, the CLI is accessed by connecting to the console port with the provided RJ45-to-DB9 cable. Local administration supports only password-based authentication. Upon successful authentication, the TOE assigns an administratively defined role to the user for the duration of the user’s logged-in session. The TOE facilitates all administrative actions through the CLI. Successful login is indicated by TOE offering a CLI command prompt. A user account will be locked after an administrator-configurable (1 to 10) number of unsuccessful authentication attempts. Once the user is locked out, all further authentication attempts are reported as unsuccessful, even when correct information is provided. To regain access, the user has to wait an administrator-configurable time duration before being allowed to successfully authenticate. The TOE ensures that authentication failures by remote administrators cannot lead to a situation where no administrator access is available, by distinguishing between local and remote login attempts. The TOE supports the use of X.509v3 certificates as defined by RFC 5280 to mutually authenticate external IT entities. When a X509 certificate is presented during a TLS handshake, the TOE verifies the trust chain, performing validation of the certificates and carries out revocation checking of each certificate. The revocation check is performed by sending an OCSP request to a trusted OCSP responder and verifying the signed response. If the TOE cannot establish a connection to the OCSP Responder to determine the revocation status of a certificate, it will not accept the certificate and the session will not be established. Certificate pinning is not supported. The TOE supports the use of X.509v3 certificates as defined by RFC 5280 to authenticate connections with authorized IT entities. When certificate based authentication is used, the TOE validates the presented certificate, checking its chain of trust against the TOE’s internal trusted store, and performs a certificate revocation check. Certificate validation includes path validation (including checking CA certificates) certificate processing (including validating the extendedKeyUsage field), and extension processing (including checking the BasicConstraints extension). Verifying the chain of trust includes validating each certificate in the chain, verifying that the certificate path consists of trusted CA certificates, and performing revocation checks on all certificates in the path. Revocation checking is implemented using OCSP. If any part of the authentication fails, the connection is terminated at the handshake stage. Specifically, the TOE implements a mutually authenticated secure channel, using TLSv1.2, to connect to a trusted external audit server. The TOE supports the following methods to obtain a certificate from a trusted CA: • Manually import certificates in PEM format from an external server. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 45 of 48 Once the CA certificate is downloaded, and prior to adding it to an existing list of trusted certificates, the TOE verifies the following: • The Basic constraints extension with the CA flag is set to true • The Key usage extension with the “keyCertSign” bit is set • The Certificate is not expired All certificates are stored in a private, persistent location on the TOE. There is no direct access to stored certificates using regular interfaces. The Identification and authentication function satisfies the following security functional requirements: • NDcPP22e:FIA_AFL.1: The administrator can set a maximum remote login failure from 1-10 unsuccessful authentication attempts. If that is exceeded, the account is locked until a configured amount of time passes. • NDcPP22e:FIA_PMG_EXT.1: Passwords can be composed of any combination of upper and lower case letters, numbers, and the following special characters: “!”, “@”, “#”, “$”, “%”, “^”, “&”,“*”, “(“, and “)”. The minimum password length is settable by the Authorized Administrator and is configurable to between 1 and 32 characters. In the evaluated configuration, a minimum password length of 15 characters is recommended. • NDcPP22e:FIA_UAU.7: For a local administrative session, password character entries are not echoed to the screen. For a remote administrative session, user credentials are protected by a secure channel. • NDcPP22e:FIA_UAU_EXT.2: The TOE uses local password-based authentication and SSH public key to login authorized administrative users remotely and locally. • NDcPP22e:FIA_UIA_EXT.1: The TOE does not offer any services or access to its functions, except for the displaying a message of the day banner, without requiring a user to be identified and authenticated. • NDcPP22e:FIA_X509_EXT.1/Rev: OCSP is supported for X509v3 certificate validation for TLS. Certificates are validated as part of the authentication process when they are presented to the TOE and when they are loaded into the TOE. • NDcPP22e:FIA_X509_EXT.2: Certificates are checked and if found not valid are not accepted or if the OCSP server cannot be contacted for validity checks, then the certificate is not accepted. • NDcPP22e:FIA_X509_EXT.3: The TOE generates certificate requests and validates the CA used to sign the certificates. Once the certificate has been issued, the administrator can import the X.509v3 certificate into the TOE. This allows the TOE to determine which CA certificate(s) to use during the validation process. In order to verify the revocation status of the presented certificates Online Certificate Status Protocol (OCSP) is used. If the connection to determine the certificate validity cannot be established, the TOE does not accept the certificate. 6.4 Security management The TOE allows remote administration via SSHv2 session and local administration via a directly connected console cable. Both remote and local administration utilize a Command-Line Interface (CLI). The CLI provides access to all management functions used to administer the TOE. The TOE requires each user to be successfully authenticated before allowing any other action on behalf of that user. All other remote management interfaces (e.g. Secure HTTP) are not evaluated and are disabled in the evaluated configuration. The TOE supports two separate privilege levels: User and Security Administrator. There is no way to enable a “privileged” or “supervisor” level from a User account. All of the management functions are restricted to the Security Administrators of the TOE. A user-level account has viewing access to all manageable parameters, and changing their password, with the exception of no access to: Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 46 of 48 • The user account database • SNMP community strings A person with an administrator-level account can view and change all switch parameters. With this level, users can be added and deleted, and the password associated with any account name can be changed. The term “Security Administrator” is used to refer to any administrative user with the appropriate role with sufficient privilege to perform all relevant functions. All administrators have the same permissions and all users have the same permissions. The privilege level determines the functions the user can perform. The Security management function satisfies the following security functional requirements: • NDcPP22e:FMT_MOF.1/ManualUpdate: The TOE does not provide automatic updates to the software version running on the TOE. The TOE restricts the ability to perform manual update to the Security Administrator. The Security Administrators can query the software version running on the TOE and can manually initiate updates. • NDcPP22e:FMT_MTD.1/CoreData: Security management is restricted to administrators. The trust store is accessed when administrators import/remove certificates as described in the Admin Guide. The trust store is protected by default and is restricted such that only administrators have access. • NDcPP22e:FMT_MTD.1/CryptoKeys: Only administrators can perform management operations including the command to generate and delete cryptographic keys. Administrators can also import and delete CA certificates and their keys into the trust store. All of these administrative actions on keys are described by the Admin Guide. • NDcPP22e:FMT_SMF.1: The TOE provides administrative interfaces to perform the functions identified in section 5.1.4.4. • NDcPP22e:FMT_SMR.2: The TOE support two roles: Security Administrator and User. A user-level account has viewing access to all manageable parameters, and can change their own password. A person with an administrator-level account can view and change all switch parameters can add and delete users, and change the password associated with any account name. 6.5 Protection of the TSF The TOE protects Critical Security Parameters (CSP) such as stored passwords and cryptographic keys so they are not directly accessible via normal administrative interfaces. All passwords are encrypted using AES256-CBC. Passwords are stored in the TOE’s configuration file in encrypted format. The master key used for AES encryption of passwords is generated randomly; the salt part involved in the key generation is also random. This key is generated afresh for every usage and stored in RAM. The salt is generated using cryptographically strong pseudo-random bytes. The fixed string, salt and the cipher name (AES) are passed to OpenSSL’s EVP_BytesToKey key derivation function. EVP_BytesToKey will return the derived key and initialization vector (IV) that will be used by the cipher AES-CBC to encrypt the password(s). Additionally, when login-related configuration information is accessed through regular TOE interfaces, it is obfuscated with a series of asterisks. The TOE performs diagnostic self-tests during start-up and generates audit records to capture any failures. Some low- level critical failure modes can prevent TOE start-up, and as a result will not generate audit records. In such cases, the TOE will enter a failure mode displaying error codes, typically on the console. The TOE can be configured to reboot or to stop with errors displayed when non-critical errors are encountered. The cryptographic module performs self- tests during startup; messages from the module are displayed on the console and audit records are generated for both successful and failed tests. These self-tests comply with the FIPS 140-2 requirements for self-testing. The module performs known-answer algorithm testing (KAT), and integrity testing. For each KAT test, the TOE uses known data as inputs into each cryptographic function, computes a cryptographic result, and compares the calculated result to the expected/known value. The integrity testing verifies the digital signature of the image (as described below) to ensure that it has not been tampered with or corrupted. These self-tests cover all anticipated modes of failure, and therefore are sufficient to ensure that the TSF operates correctly. Failure of any of the FIPS mode tests during the boot process Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 47 of 48 will stop the start-up process and prompt the user to reload. For all start-up tests, successful completion is indicated by the TOE reaching operational status. The TOE is a hardware appliance that implements a hardware-based real-time clock that is managed by the embedded OS, which also controls the exposure of administrative functions. This clock is used to produce reliable timestamps that are available for audit trail generation, synchronization with the operational environment, session inactivity checks, and certificate expiration validation. The TOE also has the option to use NTP for network time. The TOE implements two boot partitions - primary and secondary. An authorized administrator can configure the partition that is to be used after rebooting of the TOE. Firmware updates are always installed into the inactive partition. The default patching behavior is to upload the image, verify image, install it into the inactive partition, change the boot partition, and reboot the TOE. Administrators can override this behavior but are trusted not to. Upgrading EXOS is a multi-step process performed by a Security Administrator. An authorized user must authenticate to the Extreme Portal website at https://extremeportal.force.com where the software downloads are available. The downloaded image must be transferred to the appliance using a method such as TFTP. The TOE image files are digitally signed using a RSA mechanism. SHA-256 is used in conjunction with RSA signatures for verification of software image integrity. The TOE uses a public key to verify the digital signature; upon successful verification of this signature the TOE will apply the new image upon rebooting. If the signature verification cannot be carried out then the installation is terminated. The digital certificate used by the update verification mechanism is contained on the TOE. The version of the software can be queried by issuing the command: “show version”. The Protection of the TSF function satisfies the following security functional requirements: • NDcPP22e:FPT_APW_EXT.1: No passwords are ever stored as clear text. All passwords are encrypted using AES256-CBC. Passwords are stored in the TOE’s configuration file in encrypted format. • NDcPP22e:FPT_SKP_EXT.1: The TOE does not offer any functions that will disclose to any users a stored cryptographic key. • NDcPP22e:FPT_STM_EXT.1: The TOE includes its own hardware clock and can synchronize with a NTP server. • NDcPP22e:FPT_TST_EXT.1: : The TOE includes a number of power-on diagnostics and cryptographic self- tests that will serve to ensure the TOE is functioning properly. The tests are described above. • NDcPP22e:FPT_TUD_EXT.1: The TOE provides functions to query the version and upgrade the software embedded in the TOE appliance. When installing updated software, digital signatures are used to authenticate the update to ensure it is the update intended and originated by Extreme Networks. 6.6 TOE access The TOE implements remote and local administrative access via the CLI. The TOE’s minimum lockout value must be configured to a non-zero value to enforce an administrator-defined inactivity timeout, after which the inactive session is automatically terminated. The inactivity timeout value is between 1-240 minutes, and the default value is 20 minutes. Once a session (local or remote) has been terminated, the TOE requires the user to re-authenticate. The administrator can force termination of current session by issuing the logout function: exit. The TOE will display a customizable banner when a user initiates an interactive session either locally or remotely. The TOE access function satisfies the following security functional requirements: • NDcPP22e:FTA_SSL.3: The TOE terminates remote sessions that have been inactive for an administrator- configured period of time. • NDcPP22e:FTA_SSL.4: The TOE provides the function to terminate both local and remote user sessions as directed by the user using the ‘logout’ or ‘exit’ command. Extreme Networks ExtremeSwitching Series (x440-G2, x460-G2, x465, x435, x695) and 5520 Series Switches running EXOS 31.3.100 Security Target Version 1.0, 10/25/2022 Page 48 of 48 • NDcPP22e:FTA_SSL_EXT.1: The TOE terminates local sessions that have been inactive for an administrator-configured period of time. • NDcPP22e:FTA_TAB.1: The TOE can be configured to display administrator-defined advisory banners when administrators successfully establish interactive sessions with the TOE, allowing administrators to terminate their session prior to performing any functions. 6.7 Trusted path/channels The TOE protects communications with the external audit server by establishing a trusted channel between itself and the audit server. To implement this trusted channel, the TOE uses TLS v1.2 protocol with certificate-based authentication. For certificate-based authentication, the X.509v3 certificate presented by the external audit server is first validated and then compared to the authorized certificates database. The TOE protects remote management sessions by establishing a trusted path (using SSH) between itself and the administrator. The SSHv2 session is encrypted using AES encryption. The remote administrators are able to initiate the SSHv2 secure channel with the TOE. The Trusted path/channels function satisfies the following security functional requirements: • NDcPP22e:FTP_ITC.1: In the evaluated configuration, the TOE must be configured to use TLS to ensure that exported audit records are sent only to the configured server so they are not subject to inappropriate disclosure or modification as the TOE validates the audit server against the TOE configuration using the certificates presented during TLS negotiation. • NDcPP22e:FTP_TRP.1/Admin: The TOE provides SSH to ensure secure remote administration. The administrator can initiate the remote session, the remote session is secured (disclosure and modification) using CAVP tested cryptographic operations, and all remote security management functions require the use of this secure channel.