STMicroelectronics ## Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Common Criteria for IT security evaluation SMD_NL_PQML_02.1_ST33K_ST_25_002 Rev A01.3 May 2026 BLANK ### Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition life.augmented #### Common Criteria for IT security evaluation ## 1 Introduction (ASE_INT) ### 1.1 Security Target reference - 1 Document identification: Cryptographic Library NesLib-PQML 2.1 A01 on ST33K SECURITY TARGET FOR COMPOSITION. - 2 Version number: Rev A01.3, issued in May 2026. - 3 - Registration: registered at ST Microelectronics under number SMD_NL_PQML_02.1_ST33K_ST_25_002. ### 1.2 TOE reference - 4 This document presents the Security Target (ST) of the cryptographic library NesLib 6.11.6 and NesLib-PQML 2.1.3 on ST33K1M5C and ST33K1M5T C03. - 5 This TOE is a composite TOE, built up with the combination of: - The Security IC ST33K1M5C and ST33K1M5T C03 , designed by STMicroelectronics, and used as certified platform, - The cryptographic library NesLib 6.11.6 , developed by STMicroelectronics, and built to operate with this Security IC platform. - The cryptographic library NesLib-PQML 2.1.3 , developed by STMicroelectronics, and built to operate with this Security IC platform and NesLib. - 6 Therefore, this Security Target is built on the Security IC Security Target Eurosmart - Security IC Platform Protection Profile with Augmentation Packages , referenced BSI-CCPP-0084-2014 . - The Security IC Security Target is called 'Platform Security Target' in the following. - 7 The precise reference of the Target of Evaluation (TOE) is given in Section 1.4: TOE identification and the TOE features are described in Section 1.6.1: TOE hardware description . - 8 A glossary of terms and abbreviations used in this document is given in Appendix A: Glossary . May 2026 SMD_NL_PQML_02.1_ST33K_ST_25_002 Rev A01.3 3/76 [www.st.com](http://www.st.com/) Contents Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition ### Contents | 1 | Introduction (ASE_INT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | Introduction (ASE_INT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | Introduction (ASE_INT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 3 | |-----|------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------|--------------------------------------------| | | 1.1 | Security Target reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . | Security Target reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . 3 | | | 1.2 | TOE reference . . . . . . . . . . . | . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . 3 | | | 1.3 | Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . 9 | | | 1.4 | TOE identification . . . . . . . . . . . . . . | . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . 9 | | | 1.5 | TOE overview . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . 10 | | | 1.6 | TOE description . . . . . . | . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . .11 | | | | 1.6.1 | TOE hardware description . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . 11 | | | | 1.6.2 | TOE software description . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . 11 | | | | 1.6.3 | TOE documentation . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . 13 | | | | 1.6.4 | Delivery format and method . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . 13 | | | 1.7 | TOE life cycle . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . 13 | | | | 1.7.1 | TOE intended usage . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . 15 | | 2 | Conformance claims (ASE_CCL, ASE_ECD) . . . . . . . . . . . . . . . . . . . . | Conformance claims (ASE_CCL, ASE_ECD) . . . . . . . . . . . . . . . . . . . . | Conformance claims (ASE_CCL, ASE_ECD) . . . . . . . . . . . . . . . . . . . . | 16 | | | 2.1 | Common Criteria conformance claims . . . . | . . . . . . | . . . . . . . . . . . . . . . . . 16 | | | 2.2 | PP Claims . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | PP Claims . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . 16 | | | | 2.2.1 | PP Reference . . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . 16 | | | | 2.2.2 | PP Additions . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . 17 | | | | 2.2.3 | PP Claims rationale . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . 17 | | | | 2.2.4 | Rationale regarding CC:2022 and PP-0084 . | . . . . . . . . . . . . . . . . . . . . 17 | | 3 | Security problem definition (ASE_SPD) . . . . . . . . . . . . . . . . . . . . . . | Security problem definition (ASE_SPD) . . . . . . . . . . . . . . . . . . . . . . | Security problem definition (ASE_SPD) . . . . . . . . . . . . . . . . . . . . . . | . . 21 | | | 3.1 | Description of assets . . | . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . 22 | | | 3.2 | Threats . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . 22 | | | 3.3 | Organisational security policies . . . . . | . . . . . . . . . . | . . . . . . . . . . . . . . . . . 23 | | | 3.4 | Assumptions . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . 24 | | 4 | Security objectives (ASE_OBJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | Security objectives (ASE_OBJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | Security objectives (ASE_OBJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 25 | | | 4.1 | Security objectives for the TOE . . . . . . . . . . | . . . . . | . . . . . . . . . . . . . . . . . 27 | | | 4.2 | Security objectives for the environment . . . . . . . | . . | . . . . . . . . . . . . . . . . . 28 | | | 4.3 | Security objectives rationale . | . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . 29 | 4/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Contents | | | 4.3.1 | Organisational security policy "Additional Specific Security Functionality" . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 31 | |----|---------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------| | 5 | Extended Components Definition (ASE_ECD) . . . . . . . . . . . . . . | Extended Components Definition (ASE_ECD) . . . . . . . . . . . . . . | . . . . . | 32 | | | 5.1 | Secure basic operation on data (FDP_SBO) . . . . . . . . . . . . . . . . | . . . . . . | 32 | | | | Family behaviour . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . | . 32 | | | | Component levelling. . . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . | . 32 | | 6 | Security requirements (ASE_REQ) . . . . . . . . . . . . . . . . . . . . . . . . | Security requirements (ASE_REQ) . . . . . . . . . . . . . . . . . . . . . . . . | . . . . | 33 | | | 6.1 | Security Functional Requirements for the TOE . . . . . . . . . . . . . . . . | . . . . | 33 | | | | 6.1.1 | Security Functional Requirements for the secure data manipulation services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 37 | | | | 6.1.2 | Security Functional Requirements for the cryptographic services . . . . | . 37 | | | 6.2 | TOE security assurance requirements . . . . . . . . . . . . . . . . | . . . . . . . . . . . | 42 | | | 6.3 | Refinement of the security assurance requirements . . . . . . . . . . . . | . . . . | 44 | | | 6.4 | Security Requirements rationale . . . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . | 44 | | | | 6.4.1 | Rationale for the Security Functional Requirements . . . . . . . . . . . . . . | . 44 | | | | 6.4.2 | Additional security objectives are suitably addressed . . . . . . . . . . . . . | . 49 | | | | 6.4.3 | Additional security requirements are consistent . . . . . . . . . . . . . . . . . | . 49 | | | | 6.4.4 | Dependencies of Security Functional Requirements . . . . . . . . . . . . . . | . 50 | | | | 6.4.5 | Rationale for the Assurance Requirements . . . . . . . . . . . . . . . . . . . . . | . 53 | | 7 | TOE summary specification (ASE_TSS) . . . . . . . . . . . . . . . . . . . | TOE summary specification (ASE_TSS) . . . . . . . . . . . . . . . . . . . | . . . . . | 55 | | | 7.1 | TOE Security Functional Requirements realisation . . . . . . . . . | . . . . . . . . | 55 | | | | 7.1.1 | Secure basic operation on data: Copy (FDP_SBO.1) / Copy . . . . . . . | . 55 | | | | 7.1.2 | Secure basic operation on data: Compare (FDP_SBO.1) / Compare . | . 55 | | | | 7.1.3 | Secure basic operation on data: Swap (FDP_SBO.1) / Swap . . . . . . . | . 55 | | | | 7.1.4 | Secure basic operation on data: Shift (FDP_SBO.1) / Shift . . . . . . . . | . 55 | | | | 7.1.5 | Secure basic operation on data: XOR (FDP_SBO.1) / XOR . . . . . . . . | . 55 | | | | 7.1.6 | Cryptographic operation: DES and Triple DES operation (FCS_COP.1) SW-DES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | / 56 | | | | 7.1.7 | Cryptographic operation: AES operation (FCS_COP.1) / SW-AES . . . | . 56 | | | | 7.1.8 | Cryptographic operation: RSA operation (FCS_COP.1) / RSA . . . . . . | . 56 | | | | 7.1.9 | Cryptographic operation: Elliptic Curves Cryptography operation (FCS_COP.1) / ECC-WC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 57 | | | | 7.1.10 | Cryptographic operation: Elliptic Curves Cryptography operation (FCS_COP.1) / ECC-EC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 57 | | | | | SMD_NL_PQML_02.1_ST33K_ST_25_002 | 5/76 | Contents Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition | | | 7.1.11 | Cryptographic operation: Elliptic Curves Cryptography operation (FCS_COP.1) / ECC-MC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 57 | |----------|----------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------| | | | 7.1.12 | Cryptographic operation: SHA-1 & SHA-2 operation (FCS_COP.1) / SHA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 58 | | | | 7.1.13 | Cryptographic operation: Keccak & SHA-3 operation (FCS_COP.1) / Keccak . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 58 | | | | 7.1.14 | Cryptographic operation: Keccak-p operation (FCS_COP.1) / Keccak-p | 59 | | | | 7.1.15 | Cryptographic operation: Diffie-Hellman operation (FCS_COP.1) / Diffie- Hellman . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 59 | | | | 7.1.16 | Cryptographic operation: LMS signature verification (FCS_COP.1) / SFH- DSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 59 | | | | 7.1.17 | Cryptographic operation: ML-KEM operation (FCS_COP.1) / ML-KEM . | 59 | | | | 7.1.18 | Cryptographic operation: ML-DSA operation (FCS_COP.1) / ML-DSA . | 59 | | | | 7.1.19 | Cryptographic operation: DRBG operation (FCS_COP.1) / DRBG . . . | . 60 | | | | 7.1.20 | Cryptographic key generation: Prime generation (FCS_CKM.1) / Prime- generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 60 | | | | 7.1.21 | Cryptographic key generation: RSA key generation (FCS_CKM.1) / RSA- key-generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 60 | | | | 7.1.22 | Cryptographic key generation: ML-KEM key generation (FCS_CKM.1) ML-KEM-key-generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | / . 60 | | | | 7.1.23 | Cryptographic key generation: ML-DSA key generation (FCS_CKM.1) / ML-DSA-key-generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 60 | | | | 7.1.24 | Limited fault tolerance (FRU_FLT.2) . . . . . . . . . . . . . . . . . . . . . . . . . . | . 60 | | | | 7.1.25 | Failure with preservation of secure state (FPT_FLS.1) . . . . . . . . . . . . | . 60 | | | | 7.1.26 | Basic internal transfer protection (FDP_ITT.1), Basic internal TSF data transfer protection (FPT_ITT.1) & Subset information flow control (FDP_IFC.1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 61 | | | 7.2 | | Statement of compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 61 | | | | 7.2.1 | Compatibility of security objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 61 | | | | 7.2.2 | Compatibility of Security Functional Requirements . . . . . . . . . . . . . . . | . 62 | | | | 7.2.3 | Compatibility of Security Assurance Requirements . . . . . . . . . . . . . . . | . 65 | | 8 | Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . | 66 | | 9 | References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . | 68 | | Appendix | A | Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . | 72 | | | A.1 | Terms. . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 72 | | | A.2 | Abbreviations. . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | 74 | 6/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition List of ta - #### List of tables | Table 1. | TOE components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 10 | |------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------| | Table 2. | Composite product life cycle phases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 14 | | Table 3. | CC:2022 rationale. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 18 | | Table 4. | Summary of security aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 21 | | Table 5. | Summary of security objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 25 | | Table 6. | Security Objectives versus Assumptions, Threats or Policies . . . . . . . . . . . . . . . . . . . . . | . 29 | | Table 7. | Summary of Security Functional Requirements for the TOE . . . . . . . . . . . . . . . . . . . . . . | . 33 | | Table 8. | FCS_COP.1 iterations (cryptographic operations) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 38 | | Table 9. | FCS_CKM.1 iterations (cryptographic key generation). . . . . . . . . . . . . . . . . . . . . . . . . . . | . 42 | | Table 10. | TOE security assurance requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 42 | | Table 11. | Impact of EAL5 selection on BSI-CC-PP-0084-2014 refinements . . . . . . . . . . . . . . . . . . | . 44 | | Table 12. | Security Requirements versus Security Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 44 | | Table 13. | Dependencies of security functional requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 50 | | Table 14. | Platform Security Objectives vs. TOE Security Objectives. . . . . . . . . . . . . . . . . . . . . . . . | . 61 | | Table 15. | Platform Security Objectives for the Environment vs. TOE Security Objectives for the Envi ronment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | - 62 | | Table 16. | Platform Security Functional Requirements vs. TOE Security Functional Requirements. . | 63 | | Table 17. | TOE components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 66 | | Table 18. | Guidance documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 66 | | Table 19. | Sites list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 66 | | Table 20. | Common Criteria. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 68 | | Table 21. | Platform Security Target . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 68 | | Table 22. | Protection Profile and other related standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 68 | | Table 23. | Other standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 69 | | Table 24. | List of abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . 74 | SMD_NL_PQML_02.1_ST33K_ST_25_002 7/76 List of figures Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for compo - ### List of figures | Figure 1. | TOE overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 | |-------------|-----------------------------------------------------------------------------------------------------------------------------------------| | Figure 2. | Security IC Life-Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 | 8/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition ### 1.3 Context - 9 The Target of Evaluation (TOE) referred to in Section 1.4: TOE identification , is evaluated under the French IT Security Evaluation and Certification Scheme and is developed by the Connected Security sub-group of STMicroelectronics (ST). - 10 The assurance level of the performed Common Criteria (CC) IT Security Evaluation is EAL5 augmented by ALC_DVS.2, AVA_VAN.5 and ALC_FLR.2 and the composite product package (COMP). - 11 The intent of this Security Target is to specify the Security Functional Requirements (SFRs) and Security Assurance Requirements (SARs) applicable to the TOE, and to summarise its - chosen TSF services and assurance measures. Since the TOE is a composite TOE, this Security Target is built on the Security IC Security Target ST33K1M5C and ST33K1M5T C03 Security Target for composition , referenced SMD_ST33K1M5_ST_21_002 . - 12 This ST claims to be an instantiation of the " Eurosmart - Security IC Platform Protection Profile with Augmentation Packages " (PP) registered and certified under the reference BSICC-PP-0084-2014 in the German IT Security Evaluation and Certification Scheme, with the following augmentations : - Addition #1: 'Support of Cipher Schemes' from [AUG] - Addition #4: 'Area based Memory Access Control' - from [AUG] . - Additions specific to the Platform Security Target, some in compliance with [JILSR] and ANSSI-PP0084.03 . The original text of this PP is typeset as indicated here, its augmentations from [AUG] as indicated here, and text originating in [JILSR] as indicated here, when they are reproduced in this document. - 13 Extensions introduced in this ST to the SFRs of the Protection Profile (PP) are detailed in Section 5 . - 14 This ST makes various refinements to the above mentioned PP and [AUG] . They are all properly identified in the text typeset as indicated here or here. The original text of the PP is repeated as scarcely as possible in this document for reading convenience. All PP identifiers have been however prefixed by their respective origin label: BSI for BSI-CC-PP0084-2014 , AUG1 for Addition #1 of [AUG] , AUG4 for Addition #4 of [AUG] and JIL for [JILSR] . ### 1.4 TOE identification - 15 The Target of Evaluation (TOE) is the Cryptographic Library NesLib-PQML 2.1 A01 on ST33K. - 16 'Cryptographic Library NesLib-PQML 2.1 A01 on ST33K' completely identifies the TOE including its components listed in Table 1: TOE components detailed in Table 18: Guidance documentation , its guidance documentation , and its development and production sites indicated in Table 19: Sites list . Refer also to the corresponding tables in the ST33K1M5C and ST33K1M5T C03 Security Target for composition . SMD_NL_PQML_02.1_ST33K_ST_25_002 9/76 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Table 1. TOE components | Platform identification - IC Maskset name | Platform identification - Master identification number | Platform identification - IC version | Platform identification - Firmware version | Library identification - NesLib cryptographic library version | Library identification - NesLib-PQML cryptographic library version | |---------------------------------------------|----------------------------------------------------------|----------------------------------------|----------------------------------------------|-----------------------------------------------------------------|----------------------------------------------------------------------| | K460 | 0x0227 and 0x0247 | B | 3.1.3 | 6.11.6 | 2.1.3 | | K460 | 0x0227 and 0x0247 | C | 3.1.4 | 6.11.6 | 2.1.3 | | K4A0 | 0x0227 and 0x0247 | D | 3.1.4 | 6.11.6 | 2.1.3 | - 17 All along the product life, the marking on the die, a set of accessible registers and a set of specific instructions allow the customer to check the product information, providing the identification elements, as listed in Table 1: TOE components , and the configuration elements as detailed in the Data Sheet, referenced in the ST33K1M5C and ST33K1M5T C03 Security Target for composition . - 18 The NesLib and NesLib-PQML User Manuals, referenced in Table 18: Guidance documentation, details how to check both libraries integrity and version. ### 1.5 TOE overview - 19 This TOE consists of a certified hardware platform and a secure cryptographic library, built on this platform. - 20 The hardware platform is the ST33K1M5C and ST33K1M5T with its firmware. It is identified as ST33K1M5C and ST33K1M5T C03 which means it includes the components listed in the 'Platform identification' columns in Table 1: TOE components , and detailed in the Security IC Security Target ST33K1M5C and ST33K1M5T C03 Security Target for composition , referenced SMD_ST33K1M5_ST_21_002 . This Platform Security Target also references the guidance documentation directly related to the hardware platform. - 21 Figure 1 provides an overview of the TOE. - 22 The hardware platform is not fully described in the present Security Target, all useful information can be found in its dedicated Platform Security Target [PF-ST] . Nevertheless, Figure 1. TOE overview 10/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition the related assets, assumptions, threats, objectives and SFRs are reproduced in this document. The secure cryptographic library NesLib 6.11.6 is a software library, with its own guidance documentation, listed in Table 18: Guidance documentation . It provides additional cryptographic functions that can be operated on the hardware platform. Detail on the algorithms provided by the NesLib 6.11.6 is given in Section 1.6.2: TOE software description . - 23 The library NesLib-PQML 2.1.3 is the Post-Quantum Module-Lattice add-on of the NesLib cryptographic library for ML-KEM and ML-DSA. It is a software library with its own guidance documentation, listed in Table 18: Guidance documentation . It provides additional functions to NesLib 6.11.6 for Post-Quantum Module-Lattice based cryptography that can be operated on the hardware platform. It is also dependent from NesLib 6.11.6. Detail on the algorithms provided by the NesLib-PQML 2.1.3 is given in Section 1.6.2: TOE software description . - 24 Both libraries are part of the Embedded Software (ES). The rest of the ES is not part of the TOE. - 25 The TOE doesn't need non-TOE hardware, software or firmware, but the developer of the Embedded Software will have to link the secure cryptographic libraries NesLib 6.11 and NesLib-PQML 2.1.3 into his applicative code, in order to exercise their functionalities. ### 1.6 TOE description #### 1.6.1 TOE hardware description - 26 The ST33K1M5C and ST33K1M5T C03 is described in the Platform Security Target ST33K1M5C and ST33K1M5T C03 Security Target for composition . - 27 Note that the usage of the hardware platform and associated firmware is not limited or constrained when the cryptographic library is embedded. The functions provided by the Security IC platform remain normally accessible to the ES. #### 1.6.2 TOE software description - 28 The ST33K1M5C and ST33K1M5T C03 firmware, included in the platform evaluation is described in the ST33K1M5C and ST33K1M5T C03 Security Target for composition . - 29 The cryptographic libraries NesLib and NesLib-PQML are both applicative Embedded Software comprised in the ST33K1M5C and ST33K1M5T User NVM. NesLib and NesLib-PQML are cutting edge cryptographic libraries in terms of security and performance. - 30 NesLib and NesLib-PQML are embedded by the ES developer in his applicative code. SMD_NL_PQML_02.1_ST33K_ST_25_002 11/76 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition - 31 NesLib is a cryptographic toolbox supporting the most common standards and protocols: - a symmetric key cryptographic support module whose base algorithm is the Data Encryption Standard cryptographic algorithm (DES) and Triple DES [3] , - a symmetric key cryptographic support module whose base algorithm is the Advanced Encryption Standard cryptographic algorithm (AES) [6] , - a cryptographic support module that provides hash functions (SHA-1, SHA-2 [4] ), SHA3, Keccak and a toolbox for cryptography based on Keccak-p, the permutation underlying SHA-3 [24] , - an asymmetric key cryptographic support module, supporting secure modular arithmetic with large integers, with specialized functions for Rivest, Shamir & Adleman Standard cryptographic algorithm (RSA [15] ), and Diffie-Hellman [22] , - an asymmetric key cryptographic support module that provides very efficient basic functions to build up protocols using Elliptic Curves Cryptography on prime fields GF(p) with elliptic curves in short Weierstrass form [13] , and provides support for ECDH key agreement [19] and ECDSA generation and verification [5] , - a module for supporting elliptic curve cryptography on curve edwards25519, in particular ed25519 signature generation, verification and point decompression [25] , - a module for supporting elliptic curve cryptography on curve edwards448, in particular ed448 signature generation, verification and point decompression [25] [5] , - a module for supporting elliptic curve cryptography on curve curve25519, in particular X25519 for key agreement [26] , - a module for supporting elliptic curve cryptography on curve Curve448, in particular X448 for key agreement [26] , - a module for supporting the (post-quantum) stateful hash-based LMS signature scheme [20] , - support for Deterministic Random Bit Generators (DRBG) [17] , - prime number generation and RSA key pairs generation [6] . - 32 NesLib also provides a set of basic functions to securely manipulate data: - Copy, - Compare, - Swap, - Shift, - XOR. NesLib-PQML is an asymmetric key post quantum cryptographic add-on to NesLib supporting the Module-Lattice based Key-Encapsulation Mechanism (ML-KEM) and the Module-Lattice based Digital Signature Algorithm (ML_DSA) for the following algorithms: - ML-KEM encapsulation and decapsulation methods [29] , sections 6.2 and 6.3: MLKEM-512, ML-KEM-768 and ML-KEM-1024. - ML-KEM key generation methods [29] , section 6.1 for ML-KEM-512, ML-KEM-768 and ML-KEM-1024. - ML-DSA key generation methods [30] , section 6.1 for ML-DSA-44, ML-DSA-65 and ML-DSA-87. - ML-DSA signature and verification methods [30] , sections 6.2 and 6.3: ML-DSA-44, ML-DSA-65 and ML-DSA-87. 12/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition #### 1.6.3 TOE documentation - 33 The user guidance documentation, part of the TOE, consists of: - the platform user guidance documentation listed in the ST33K1M5C and ST33K1M5T C03 Security Target for composition , - the Cryptographic library NesLib 6.11 - User manual , - the ST33K Secure MCU platforms NesLib 6.11 security recommendations - Application note , - the NesLib 6.11.6 for ST33K Platforms - Release note , - the NesLib-PQML 2.1.3 for ST33K platforms - Release note , - the ST33K secure MCU platforms - NesLib-PQML 2.1 security , - the ST33K secure MCU platforms - NesLib-PQML 2.1 security . - 34 The complete list and details of guidance documents is provided in Table 18 , except those of the platform, listed in the ST33K1M5C and ST33K1M5T C03 Security Target for composition . #### 1.6.4 Delivery format and method | 35 | The Security IC platform can be delivered in form of wafers, micromodules or packages, as described in the ST33K1M5C and ST33K1M5T C03 Security Target for composition . All the possible forms of delivery are equivalent from a security point of view. | |------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 36 | The NesLib cryptographic library is specifically delivered in form of a ciphered and signed binary file, so that the ES developer embeds it and links it to his applicative code. | | 37 | The NesLib-PQML cryptographic library is specifically delivered in form of a ciphered and signed binary file, so that the ES developer embeds it and links it to his applicative code. | | 38 | All the guidance documents are delivered as ciphered pdf files. | | 39 | Each deliverable has a reference identifier. Each delivery is registered and done encrypted for each customer by email or using a secure file transfer system. | ### 1.7 TOE life cycle - 40 This Security Target is fully conform to the claimed PP. In the following, just a summary and some useful explanations are given. For complete details on the TOE life cycle, please refer to the Eurosmart - Security IC Platform Protection Profile with Augmentation Packages ( BSI-CC-PP-0084-2014 ), section 1.2.3. - 41 The composite product life cycle is decomposed into 7 phases. Each of these phases has the very same boundaries as those defined in the claimed Protection Profile. SMD_NL_PQML_02.1_ST33K_ST_25_002 13/76 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Figure 2. Security IC Life-Cycle - 42 The life cycle phases are summarized in Table 2 . - 43 The security IC platform life cycle is described in the Platform Security Target, as well as its delivery format. - 44 All the sites likely to be involved in the complete TOE life cycle are listed in Table 19 , except those dedicated to the Security IC platform, already detailed in the Platform Security Target. In Table 19 , the development centers are denoted by the activity 'ES_DEV'. The IT support centers are denoted by the activity "IT". - 45 NesLib and NesLib-PQML are both delivered as part of Phase 1, as a software package for each, downloaded by ST entitled employees, from a controlled centralized system, then sent encrypted to the customer. Table 2. Composite product life cycle phases | Phase | Name | Description | |---------|-------------------------------------------|------------------------------------------------------------------------------------------------| | 1 | Security IC embedded software development | security IC embedded software development specification of IC pre-personalization requirements | | 2 | IC development | IC design IC dedicated software development | 14/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Table 2. Composite product life cycle phases (continued) | Phase | Name | Description | |---------|---------------------------------------|------------------------------------------------------------------------------------------| | 3 | IC manufacturing and testing | integration and photomask fabrication IC manufacturing IC testing IC pre-personalisation | | 4 | IC packaging | security IC packaging (and testing) pre-personalisation if necessary | | 5 | Security IC product finishing process | composite product finishing process composite product testing | | 6 | Security IC personalisation | composite product personalisation composite product testing | | 7 | Security IC end usage | composite product usage by its issuers and consumers | #### 1.7.1 TOE intended usage - 46 The cryptographic libraries NesLib and NesLib-PQML are both intended to be used in support to the development of secure embedded software in phase 1, then embedded on the ST33K1M5C and ST33K1M5T. - 47 In Phase 7, the TOE is in the end-user environments. Depending on the application, the composite products are used in a wide range of applications to assure authorised conditional access. Examples of such are pay-TV, banking cards, brand protection, portable communication SIM cards, health cards, transportation cards, access management, identity and passport cards. - 48 The end-user environment therefore covers a wide range of very different functions. The TOE is designed to be used in unsecured and unprotected environments. SMD_NL_PQML_02.1_ST33K_ST_25_002 15/76 Conformance claims (ASE_CCL, ASE_ECD) Cryptographic Library NesLib-PQML 2.1 A01 on ## 2 Conformance claims (ASE_CCL, ASE_ECD) ### 2.1 Common Criteria conformance claims - 49 The Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target claims to be conformant to the Common Criteria 2022 revision 1. - 50 Mre precisely the Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition is: - CC Part 2 extended, where CCMB-2022-11-002 R1 is extended with FAU_SAS.1 and FDP_SBO.1, and - CC Part 3 conformant, cf. CCMB-2022-11-003 R1 . - The extended Security Functional Requirements FAU_SAS Audit data storage is defined in the Eurosmart - Security IC Platform Protection Profile with Augmentation Packages ( BSI-CC-PP-0084-2014 ). The reader can find their certified definitions in the text of the " Eurosmart - Security IC Platform Protection Profile with Augmentation Packages ". - 51 This Security Target defines an additional extended Security Functional Requirement, FDP_SBO.1 'Secure basic operation on data', described in Section 5 . - 52 The assurance level for the Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target is EAL5 augmented by ALC_DVS.2, AVA_VAN.5, ALC_FLR.2 and the composite product package (COMP). - 53 The composite product package is defined in CCMB-2022-11-005 R1 . - 54 The ST33K1M5C and ST33K1M5T C03 platform has been evaluated according to the evaluation level EAL6 augmented by ALC_FLR.2, thus ensuring compatibility between the assurance levels chosen for the platform and the composite evaluations. ### 2.2 PP Claims #### 2.2.1 PP Reference - 55 The Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target claims strict conformance to the Eurosmart - Security IC Platform Protection Profile with Augmentation Packages ( BSI-CC-PP-0084-2014 ), as required by this Protection Profile. - 56 The following packages have been selected from the BSI-CC-PP-0084-2014 , and addressed by the Security IC platform: - Package 'Authentication of the Security IC', - Packages for Loader: - Package 1: Loader dedicated for usage in Secured Environment only, - Package 2: Loader dedicated for usage by authorized users only. 16/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Confor - #### 2.2.2 PP Additions | 57 | The main additions operated on the BSI-CC-PP-0084-2014 are: • Those described in the ST33K1M5C and ST33K1M5T C03 Security Target for composition , • Addition #1: 'Support of Cipher Schemes' from . | |------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 58 | [AUG] This addition is used to address additional functionality provided by the TOE, and not covered by the Eurosmart - Security IC Platform Protection Profile with Augmentation Packages , nor by the Platform Security Target ST33K1M5C and ST33K1M5T C03 Security Target for composition . It addresses the additional functionalities provided by the NesLib and the NesLib-PQML. | | 59 | All refinements are indicated with type setting text as indicated here , original text from the BSI-CC-PP-0084-2014 being typeset as indicated here and here. Text originating in [AUG] is typeset as indicated here. Text originating in [JILSR] is typeset as indicated here. | | 60 | The security environment additions relative to the PP are summarized in Table 4 . | | 61 | The additional security objectives relative to the PP are summarized in Table 5 . | | 62 | The additional SFRs for the TOE relative to the PP are summarized in Table 7 . | | 63 | The additional SARs relative to the PP are summarized in Table 10 . | #### 2.2.3 PP Claims rationale | 64 | The differences between this Security Target security objectives and requirements and those of BSI-CC-PP-0084-2014 , to which conformance is claimed, have been identified and justified in Section 4 and in Section 6 . They have been introduced in the previous section. | |------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 65 | In the following, the statements of the security problem definition, the security objectives, and the security requirements are consistent with those of the BSI-CC-PP-0084-2014 . | | 66 | The security problem definition presented in Section 3 , clearly shows the additions to the security problem statement of the PP. | | 67 | The security objectives rationale presented in Section 4.3 clearly identifies modifications and additions made to the rationale presented in the BSI-CC-PP-0084-2014 . | | 68 | Similarly, the security requirements rationale presented in Section 6.4 has been updated with respect to the Protection Profile. | | 69 | All PP requirements have been shown to be satisfied in the extended set of requirements whose completeness, consistency and soundness have been argued in the rationale sections of the present document. | #### 2.2.4 Rationale regarding CC:2022 and PP-0084 - 70 The SFRs defined in BSI-CC-PP-0084-2014 , including the functional packages , were conformant to the CC version 3.1. Since this Security Target conforms to the CC:2022, the SFRs have been updated to both comply with CC:2022 and meet BSI-CC-PP-0084-2014 . SMD_NL_PQML_02.1_ST33K_ST_25_002 17/76 Conformance claims (ASE_CCL, ASE_ECD) Cryptographic Library NesLib-PQML 2.1 A01 on 71 The Table 3 provides the rationale of the changes. Table 3. CC:2022 rationale | SFR | BSI-CC-PP-0084-2014 and CCMB-2017-04-002 R5 definition | CCMB-2022-11-002 R1 definition | Change | |-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | FMT_LIM.1 | The TSF shall be designed and implemented in a manner that limits its capabilities so that in conjunction with 'Lim - ited availability (FMT_LIM.2)' the following policy is enforced [assignment: Limited capabil - ity policy]. | The TSF shall limit its capabil - ities so that in conjunction with 'Limited availability (FMT_LIM.2)' the following policy is enforced [assign - ment: Limited capability and availability policy]. | The CC:2022 defini - tion modifies the wording of the SFR to emphasize that the TSF shall limit its capabilities. The new SFR modi - fies the assignment to limit availability. The CC:2022 ver - sion explicitly links the limited capability and limited availabil - ity policies, not only at the level of the dependencies. Any instantiation to the CC:2022 SFR meets the CC3.1 SFR. | | FMT_LIM.2 | The TSF shall be designed in a manner that limits its availability so that in conjunction with 'Limited capabilities (FMT_LIM.1)' the following policy is enforced [assignment: Limited availability policy]. | The TSF shall be designed in a manner that limits its availability so that in conjunction with 'Limited capabilities (FMT_LIM.1)' the following policy is enforced [assignment: Limited capability and availability policy]. | The new SFR modi - fies the assignment to limit capability. The CC:2022 ver - sion explicitly links the limited capability and limited availabil - ity policies, not only at the level of the dependencies. Any instantiation to the CC:2022 SFR meets the CC3.1 SFR. | | FDP_SDC.1 | The TSF shall ensure the confidentiality of the information of the user data while it is stored in the [assignment: memory area ]. | The TSF shall ensure the confidentiality of [selection: all user data, the following user data [assignment: list of user data ]] while it is stored in the [selection: temporary memory, persistent memory, any memory ]. | The new SFR pro - vides the option to select the type of data and memory type. Any instantiation to the CC:2022 SFR meets the CC3.1 SFR. | 18/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Confor - Table 3. CC:2022 rationale (continued) | SFR | BSI-CC-PP-0084-2014 and CCMB-2017-04-002 R5 definition | CCMB-2022-11-002 R1 definition | Change | |-----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | FIA_API.1 | The TSF shall provide a [assignment: authentication mechanism ] to prove the identity of the [selection: TOE, [assignment: object, authorized user or role ]] to an external entity. | The TSF shall provide an [assignment: authentication mechanism ] to prove the identity of [assignment: entity ] by including the following properties [assignment: list of properties ] to an external entity. | A selection is replaced by an assignment: the SFR in CC:2022 is more flexible than in CC 3.1. Nevertheless, the instantiation made in this Security Target meets the SFR defined in the PP. | | FAU_SAR.1 | The TSF shall provide [assignment: authorised users ] with the capability to read [assignment: list of audit information ] from the audit records. | The TSF shall provide [assignment: authorized users ] with the capability to read [assignment: list of audit information ] from the audit data. | The new definition changes the term "record" with the term "data". The change does not have any impact. | | FAU_SAR.1 | The TSF shall provide the audit records in a manner suitable for the user to interpret the information. | The TSF shall provide the audit data in a manner suitable for the user to interpret the information. | The new definition changes the term "record" with the term "data". The change does not have any impact. | | FCS_RNG.1 | The TSF shall provide a [selection: physical, hybrid physical, hybrid deterministic ] random number generator that implements: [assignment: list of security capabilities ]. | The TSF shall provide a [selection: physical, non- physical true, deterministic, hybrid physical, hybrid deterministic ] random number generator that implements: [assignment: list of security capabilities ]. | The first selection add the terms 'non physical true' and 'deterministic'. The change does not have any impact. | | FCS_RNG.1 | The TSF shall provide [selection: bits, octets of bits, numbers [assignment: format of the numbers] ] that meet [assignment: a defined quality metric ]. | The TSF shall provide [selection: bits, octets of bits, numbers [assignment: format of the numbers ]] that meet [assignment: a defined quality metric ]. | The first selection add the terms 'non physical true' and 'deterministic'. The change does not have any impact. | SMD_NL_PQML_02.1_ST33K_ST_25_002 19/76 Conformance claims (ASE_CCL, ASE_ECD) Cryptographic Library NesLib-PQML 2.1 A01 on Table 3. CC:2022 rationale (continued) | SFR | BSI-CC-PP-0084-2014 and CCMB-2017-04-002 R5 definition | CCMB-2022-11-002 R1 definition | Change | |-----------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | FCS_CKM.4 | The TSF shall destroy cryptographic keys in accordance with a specified cryptographic key destruction method [assignment: cryptographic key destruction method ] that meets the following: [assignment: list of standards ]. | Removed SFR. | FCS_CKM.6 is replacing FCS_CKM.4. FCS_COP.1 has a dependency on FCS_CKM.6. FCS_CKM.6 in CC:2022 is more | | FCS_CKM.6 | Not present. | The TSF shall destroy [assignment: list of cryptographic keys (including keying material) ] when [selection: no longer needed, [assignment: other circumstances for key or keying material destruction] ]. | flexible than FCS_CKM.4 in CC 3.1. Nevertheless, although no instantia - tion is made in this Security Target, the dependency is dis - cussed later and this change has no impact. | | FCS_CKM.6 | Not present. | The TSF shall destroy cryptographic keys and keying material specified by FCS_CKM.6.1 in accordance with a specified cryptographic key destruction method [assignment: cryptographic key destruction method ] that meets the following: [assignment: list of standards ]. | flexible than FCS_CKM.4 in CC 3.1. Nevertheless, although no instantia - tion is made in this Security Target, the dependency is dis - cussed later and this change has no impact. | 20/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security ## 3 Security problem definition (ASE_SPD) - 72 This section describes the security aspects of the environment in which the TOE is intended to be used and addresses the description of the assets to be protected, the threats, the organisational security policies and the assumptions. - 73 Since this Security Target claims strict conformance to the Eurosmart - Security IC Platform Protection Profile with Augmentation Packages ( BSI-CC-PP-0084-2014 ), all the security aspects defined in the Protection Profile apply to the TOE. In order to address complementary TOE security functionality not defined in the Protection Profile, some security aspects have been introduced in the Platform Security Target and in this one. - 74 Note that the origin of each security aspect is clearly identified in the prefix of its label. Most of these security aspects can therefore be easily found in the Eurosmart - Security IC Platform Protection Profile with Augmentation Packages ( BSI-CC-PP-0084-2014 ), section 3. - 75 A summary of all these security aspects with their respective origin and status of inclusion in the ST33K1M5C and ST33K1M5T C03 Security Target for composition is provided in Table 4 . All the security aspects defined in the ST33K1M5C and ST33K1M5T C03 Security Target for composition are valid for the present Security Target. - 76 Only the ones introduced in this Security Target, are detailed in the following sections (column 'In [PF-ST] ' = No). Table 4. Summary of security aspects | Label | Title | Origin | In [PF-ST] | |------------------------------|-------------------------------------------|----------|--------------| | BSI.T.Leak-Inherent | Inherent Information Leakage | [PP0084] | Yes | | BSI.T.Phys-Probing | Physical Probing | [PP0084] | Yes | | BSI.T.Malfunction | Malfunction due to Environmental Stress | [PP0084] | Yes | | BSI.T.Phys-Manipulation | Physical Manipulation | [PP0084] | Yes | | BSI.T.Leak-Forced | Forced Information Leakage | [PP0084] | Yes | | BSI.T.Abuse-Func | Abuse of Functionality | [PP0084] | Yes | | threats BSI.T.RND | Deficiency of Random Numbers | [PP0084] | Yes | | BSI.T.Masquerade-TOE | Masquerade the TOE | [PP0084] | Yes | | TOE AUG4.T.Mem-Access | Memory Access Violation | [AUG] | Yes | | JIL.T.Open-Samples-Diffusion | Diffusion of open samples | [JILSR] | Yes | | T.Confid-Applic-Code | Specific application code confidentiality | [PF-ST] | Yes | | T.Confid-Applic-Data | Specific application data confidentiality | [PF-ST] | Yes | | T.Integ-Applic-Code | Specific application code integrity | [PF-ST] | Yes | | T.Integ-Applic-Data | Specific application data integrity | [PF-ST] | Yes | SMD_NL_PQML_02.1_ST33K_ST_25_002 21/76 Security problem definition (ASE_SPD) Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Table 4. Summary of security aspects (continued) | | Label | Title | Origin | In [PF-ST] | |-------------|--------------------------|------------------------------------------------------------|----------|--------------| | OSPs | BSI.P.Process-TOE | Protection during TOE Development and Production | [PP0084] | Yes | | OSPs | BSI.P.Lim-Block-Loader | Limiting and blocking the loader functionality | [PP0084] | Yes | | OSPs | BSI.P.Ctrl-Loader | Controlled usage to Loader Functionality | [PP0084] | Yes | | OSPs | AUG1.P.Add-Functions | Additional Specific Security Functionality | [AUG] | Yes | | OSPs | AUG1.P.Add-Functions-Lib | Additional Specific Security Functionality | [AUG] | No | | Assumptions | BSI.A.Process-Sec-IC | Protection during Packaging, Finishing and Personalisation | [PP0084] | Yes | | Assumptions | BSI.A.Resp-Appl | Treatment of User Data | [PP0084] | Yes | ### 3.1 Description of assets - 77 Since this Security Target claims strict conformance to the Eurosmart - Security IC Platform Protection Profile with Augmentation Packages ( BSI-CC-PP-0084-2014 ), the assets defined in section 3.1 of the Protection Profile are applied and the assets regarding threats are clarified in the ST33K1M5C and ST33K1M5T C03 Security Target for composition . - 78 NesLib and NesLib-PQML compute user data as well as TSF data, which are part of the assets addressed by the Platform Security Target and the Protection Profile. ### 3.2 Threats - 79 The threats are all described in the Platform Security Target [PF-ST] , and just recalled here. | BSI.T.Leak-Inherent | Inherent Information Leakage | |------------------------------|-------------------------------------------| | BSI.T.Phys-Probing | Physical Probing | | BSI.T.Malfunction | Malfunction due to Environmental Stress | | BSI.T.Phys-Manipulation | Physical Manipulation | | BSI.T.Leak-Forced | Forced Information Leakage | | BSI.T.Abuse-Func | Abuse of Functionality | | BSI.T.RND | Deficiency of Random Numbers | | BSI.T.Masquerade-TOE | Masquerade the TOE | | AUG4.T.Mem-Access | Memory Access Violation | | JIL.T.Open-Samples-Diffusion | Diffusion of open samples | | T.Confid-Applic-Code | Specific application code confidentiality | | T.Confid-Applic-Data | Specific application data confidentiality | | T.Integ-Applic-Code | Specific application code integrity | 22/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security T.Integ-Applic-Data Specific application data integrity ### 3.3 Organisational security policies - 80 The TOE provides specific security functionality that can be used by the Security IC Embedded Software. In the following specific security functionality is listed which is not derived from threats identified for the TOE's environment because it can only be decided in the context of the Security IC application, against which threats the Security IC Embedded Software will use the specific security functionality. - 81 ST applies the Additional Specific Security Functionality policy ( AUG1.P.Add-Functions-Lib ) as specified below. Complementary to the additional specific security functionality provided to the ES by the platform, NesLib and NesLib-PQML provide the cryptographic functionalities listed in AUG1.P.Add-Functions-Lib . NesLib uses the platform hardware AES accelerator to provide AES security functionality, and the platform hardware triple DES accelerator to provide DES security functionality. NesLib also uses the platform Cryptography Accelerator (Nescrypt) to provide RSA, ECC and Diffie-Hellman functionalities. - 82 NesLib-PQML does not use such hardware accelerators and is an optimized and secure software implementation relying on standard processor resources. | BSI.P.Process-TOE | Identification during TOE Development and Production | |------------------------|--------------------------------------------------------| | BSI.P.Lim-Block-Loader | Limiting and blocking the loader functionality | | BSI.P.Ctrl-Loader | Controlled usage to Loader Functionality | | AUG1.P.Add-Functions | Additional Specific Security Functionality | SMD_NL_PQML_02.1_ST33K_ST_25_002 23/76 Security problem definition (ASE_SPD) Cryptographic Library NesLib-PQML 2.1 A01 on ST33K AUG1.P.Add-Functions-Lib Additional Specific Security Functionality: ### 3.4 Assumptions - 83 The assumptions are all described in the Platform Security Target [PF-ST] and in the BSICC-PP-0084-2014 , section 3.4. BSI.A.Process-Sec-IC BSI.A.Resp-Appl Protection during Packaging, Finishing and Personalisation Treatment of User Data of the Composite TOE The TOE shall provide the following specific security functionality to the Security IC Embedded Software: - Triple Data Encryption Standard (DES), - Advanced Encryption Standard (AES), - Secure Hashing (SHA-1, SHA-224, SHA-256, SHA-384, SHA-512), - Keccak, - Keccak-p, - Deterministic Random Bit Generator (DRBG), - Rivest-Shamir-Adleman (RSA) , - Diffie-Hellman, - Elliptic Curves Cryptography on Weierstrass curves, including ECDSA and ECDH, - Elliptic Curves Cryptography on Edwards curves, consisting of Ed25519and Edd448, - Elliptic Curves Cryptography on Montgomery curves with X25519 and X448, - Stateful hash-based LMS signature, - Module-Lattice based Key-Encapsulation Mechanism (ML-KEM) - Module-Lattice based Digital Signature Algorithm (MLDSA) - Prime Number Generation, - Secure data copy, - Secure data compare, - Secure data swap, - Secure data shift, - Secure data XOR. 24/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security ## 4 Security objectives (ASE_OBJ) - 84 The security objectives of the TOE cover principally the following aspects: - integrity and confidentiality of assets, - protection of the TOE and associated documentation during development and production phases, - provide random numbers, - provide access control functionality, - provide cryptographic support. - 85 Since this Security Target claims strict conformance to the Eurosmart - Security IC Platform Protection Profile with Augmentation Packages ( BSI-CC-PP-0084-2014 ), all the security objectives defined in the Protection Profile apply to the TOE. In order to address complementary TOE security functionality not defined in the Protection Profile, some security objectives have been introduced in the Platform Security Target and in this one. - 86 Note that the origin of each security objective is clearly identified in the prefix of its label. Most of these security aspects can therefore be easily found in the Eurosmart - Security IC Platform Protection Profile with Augmentation Packages ( BSI-CC-PP-0084-2014 ), section 3. - 87 A summary of all the TOE security objectives with their respective origin and status of inclusion in the ST33K1M5C and ST33K1M5T C03 Security Target for composition is provided in Table 5 . All the security objectives defined in the ST33K1M5C and ST33K1M5T C03 Security Target for composition are valid for the present Security Target. - 88 Only the ones introduced in this Security Target, are detailed in the following sections. Table 5. Summary of security objectives | Label | Title | Origin | In [PF-ST] | |-------------------------|-------------------------------------------------|----------|--------------| | BSI.O.Leak-Inherent | Protection against Inherent Information Leakage | [PP0084] | Yes | | BSI.O.Phys-Probing | Protection against Physical Probing | [PP0084] | Yes | | BSI.O.Malfunction | Protection against Malfunctions | [PP0084] | Yes | | BSI.O.Phys-Manipulation | Protection against Physical Manipulation | [PP0084] | Yes | | TOE BSI.O.Leak-Forced | Protection against Forced Information Leakage | [PP0084] | Yes | | BSI.O.Abuse-Func | Protection against Abuse of Functionality | [PP0084] | Yes | | BSI.O.Identification | TOE Identification | [PP0084] | Yes | | BSI.O.RND | Random Numbers | [PP0084] | Yes | | BSI.O.Cap-Avail-Loader | Capability and Availability of the Loader | [PP0084] | Yes | | BSI.O.Ctrl-Auth-Loader | Access control and authenticity for the Loader | [PP0084] | Yes | SMD_NL_PQML_02.1_ST33K_ST_25_002 25/76 Security objectives (ASE_OBJ) Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Table 5. Summary of security objectives (continued) | Label | Title | Origin | In [PF-ST] | |--------------------------------|---------------------------------------------------------|----------|--------------| | JIL.O.Prot-TSF-Confidentiality | Protection of the confidentiality of the TSF | [JILSR] | Yes | | JIL.O.Secure-Load-ACode | Secure loading of the Additional Code | [JILSR] | Yes | | JIL.O.Secure-AC-Activation | Secure activation of the Additional Code | [JILSR] | Yes | | JIL.O.TOE-Identification | Secure identification of the TOE | [JILSR] | Yes | | O.Secure-Load-AMemImage | Secure loading of the Additional Memory Image | [PF-ST] | Yes | | TOE O.MemImage-Identification | Secure identification of the Memory Image | [PF-ST] | Yes | | BSI.O.Authentication | Authentication to external entities | [PP0084] | Yes | | AUG4.O.Mem-Access | Area based Memory Access Control | [AUG] | Yes | | O.Firewall | Specific application firewall | [PF-ST] | Yes | | AUG1.O.Add-Functions | Additional Specific Security Functionality | [AUG] | Yes | | AUG1.O.Add-Functions-Lib | Additional Specific Security Functionality | [AUG] | No | | BSI.OE.Resp-Appl | Treatment of User Data of the Composite TOE | [PP0084] | Yes | | BSI.OE.Process-Sec-IC | Protection during composite product manufacturing | [PP0084] | Yes | | BSI.OE.Lim-Block-Loader | Limitation of capability and blocking the Loader | [PP0084] | Yes | | BSI.OE.Loader-Usage | Secure communication and usage of the Loader | [PP0084] | Yes | | Environment BSI.OE.TOE-Auth | External entities authenticating of the TOE | [PP0084] | Yes | | OE.Composite-TOE-Id | Composite TOE identification | [PF-ST] | Yes | | OE.TOE-Id | TOE identification | [PF-ST] | Yes | | OE.Enable-Disable-Secure- Diag | Enabling or disabling the Secure Diagnostic | [PF-ST] | Yes | | OE.Secure-Diag-Usage | Secure communication and usage of the Secure Diagnostic | [PF-ST] | Yes | 26/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security ### 4.1 Security objectives for the TOE | BSI.O.Leak-Inherent | Protection against Inherent Information Leakage | |--------------------------------|---------------------------------------------------| | BSI.O.Phys-Probing | Protection against Physical Probing | | BSI.O.Malfunction | Protection against Malfunctions | | BSI.O.Phys-Manipulation | Protection against Physical Manipulation | | BSI.O.Leak-Forced | Protection against Forced Information Leakage | | BSI.O.Abuse-Func | Protection against Abuse of Functionality | | BSI.O.Identification | TOE Identification | | BSI.O.RND | Random Numbers | | BSI.O.Cap-Avail-Loader | Capability and Availability of the Loader | | BSI.O.Ctrl-Auth-Loader | Access control and authenticity for the Loader | | BSI.O.Authentication | Authentication to external entities | | JIL.O.Prot-TSF-Confidentiality | Protection of the confidentiality of the TSF | | JIL.O.Secure-Load-ACode | Secure loading of the Additional Code | | JIL.O.Secure-AC-Activation | Secure activation of the Additional Code | | JIL.O.TOE-Identification | Secure identification of the TOE | | O.Secure-Load-AMemImage | Secure loading of the Additional Memory Image | | O.MemImage-Identification | Secure identification of the Memory Image | | AUG4.O.Mem-Access | Area based Memory Access Control | | O.Firewall | Specific application firewall | | AUG1.O.Add-Functions | Additional Specific Security Functionality | SMD_NL_PQML_02.1_ST33K_ST_25_002 27/76 Security objectives (ASE_OBJ) Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security | AUG1.O.Add-Functions-Lib | Additional Specific Security Functionality: | |----------------------------|----------------------------------------------------------------------------------------------------------| | | The TOE must provide the following specific security functionality to the Security IC Embedded Software: | | | - Triple Data Encryption Standard (DES), | | | - Advanced Encryption Standard (AES), | | | - Secure Hashing (SHA-1, SHA-224, SHA-256, SHA- 384, SHA-512), | | | - Keccak, | | | - Keccak-p, | | | - Deterministic Random Bit Generator (DRBG), | | | - Rivest-Shamir-Adleman (RSA) , | | | - Diffie-Hellman, | | | - Elliptic Curves Cryptography on Weierstrass curves, including ECDSA and ECDH, | | | - Elliptic Curves Cryptography on Edwards curves, consisting of Ed25519 and Ed448, | | | - Elliptic Curves Cryptography on Montgomery curves with X25519 and X448, | | | - Stateful hash-based LMS signature, | | | - Module-Lattice based Key-Encapsulation Mechanism (ML-KEM) | | | - Module-Lattice based Digital Signature Algorithm (ML-DSA) | | | - Prime Number Generation, | | | - Secure data copy, | | | - Secure data compare, | | | - Secure data swap, | | | - Secure data shift, | | | - Secure data XOR. | ### 4.2 Security objectives for the environment - 89 All security objectives for the environment are detailed in the ST33K1M5C and ST33K1M5T C03 Security Target for composition and still valid in the same terms for this Security Target. The clarifications made there also apply. - 90 Security Objectives for the Security IC Embedded Software development environment (phase 1): - 91 Security Objectives for the operational Environment (phase 4 up to 7): BSI.OE.Resp-Appl Treatment of User Data of the Composite TOE 28/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security | BSI.OE.Process-Sec-IC | Protection during composite product manufacturing | Up to phase 6 | |--------------------------------|---------------------------------------------------------|-----------------| | BSI.OE.Lim-Block-Loader | Limitation of capability and blocking the Loader | Up to phase 6 | | BSI.OE.Loader-Usage | Secure communication and usage of the Loader | Up to phase 7 | | BSI.OE.TOE-Auth | External entities authenticating of the TOE | Up to phase 7 | | OE.Composite-TOE-Id | Composite TOE identification | Up to phase 7 | | OE.TOE-Id | TOE identification | Up to phase 7 | | OE.Enable-Disable- Secure-Diag | Enabling or disabling the Secure Diagnostic | Up to phase 7 | | OE.Secure-Diag-Usage | Secure communication and usage of the Secure Diagnostic | Up to phase 7 | ### 4.3 Security objectives rationale - 92 The main line of this rationale is that the inclusion of all the security objectives of the BSICC-PP-0084-2014 Protection Profile, together with those in [AUG] , those already introduced in the ST33K1M5C and ST33K1M5T C03 Security Target for composition and those introduced in this ST, guarantees that all the security environment aspects identified in Section 3 are addressed by the security objectives stated in this chapter. - 93 All security objectives are already justified in the Platform Security Target [PF-ST] , except the one denoted by 'New' in Table 6 . - 94 The augmentation made in this ST introduces the following security environment aspect: - organisational security policy "Additional Specific Security Functionality, ( AUG1.P.AddFunctions-Lib )" - 95 Only this security policy and its associated objective will be detailed in the following. No threat nor assumption have been added versus the Platform Security Target [PF-ST] . - 96 The justification of this additional policy provided in the next subsection shows that it does not contradict to the rationale already given in the Protection Profile BSI-CC-PP-0084-2014 and in the ST33K1M5C and ST33K1M5T C03 Security Target for composition for the assumptions, policy and threats defined there. Table 6. Security Objectives versus Assumptions, Threats or Policies | Assumption, Threat or Organisational Security Policy | Security Objective | Notes | |--------------------------------------------------------|-----------------------|----------------------------| | BSI.A.Resp-Appl | BSI.OE.Resp-Appl | Phase 1 | | BSI.P.Process-TOE | BSI.O.Identification | Phase 2-3 optional Phase 4 | | BSI.A.Process-Sec-IC | BSI.OE.Process-Sec-IC | Phase 5-6 optional Phase 4 | SMD_NL_PQML_02.1_ST33K_ST_25_002 29/76 Security objectives (ASE_OBJ) Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Table 6. Security Objectives versus Assumptions, Threats or Policies (continued) | Assumption, Threat or Organisational Security Policy | Security Objective | Notes | |--------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------| | BSI.P.Lim-Block-Loader | BSI.O.Cap-Avail-Loader BSI.OE.Lim-Block-Loader | | | BSI.P.Ctrl-Loader | BSI.O.Ctrl-Auth-Loader JIL.O.Secure-Load-ACode JIL.O.Secure-AC-Activation JIL.O.TOE-Identification O.Secure-Load-AMemImage O.MemImage-Identification BSI.OE.Loader-Usage OE.TOE-Id OE.Composite-TOE-Id | | | AUG1.P.Add-Functions | AUG1.O.Add-Functions | | | AUG1.P.Add-Functions-Lib | AUG1.O.Add-Functions-Lib | New | | BSI.T.Leak-Inherent | BSI.O.Leak-Inherent | | | BSI.T.Phys-Probing | BSI.O.Phys-Probing | | | BSI.T.Malfunction | BSI.O.Malfunction | | | BSI.T.Phys-Manipulation | BSI.O.Phys-Manipulation | | | BSI.T.Leak-Forced | BSI.O.Leak-Forced | | | BSI.T.Abuse-Func | BSI.O.Abuse-Func OE.Enable-Disable-Secure-Diag OE.Secure-Diag-Usage | | | BSI.T.RND | BSI.O.RND | | | BSI.T.Masquerade-TOE | BSI.O.Authentication BSI.OE.TOE-Auth | | | AUG4.T.Mem-Access | AUG4.O.Mem-Access | | | JIL.T.Open-Samples-Diffusion | JIL.O.Prot-TSF-Confidentiality BSI.O.Leak-Inherent BSI.O.Leak-Forced | | | T.Confid-Applic-Code | O.Firewall | | | T.Confid-Applic-Data | O.Firewall | | | T.Integ-Applic-Code | O.Firewall | | | T.Integ-Applic-Data | O.Firewall | | 30/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security #### 4.3.1 Organisational security policy "Additional Specific Security Functionality" | 97 | The justification related to the organisational security policy "Additional Specific Security Functionality, ( AUG1.P.Add-Functions-Lib )' is as follows: | |------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 98 | Since AUG1.O.Add-Functions-Lib requires the TOE to implement exactly the same specific security functionality as required by AUG1.P.Add-Functions-Lib , and in the very same conditions, the organisational security policy is covered by the objective. | | 99 | Nevertheless the security objectives BSI.O.Leak-Inherent , BSI.O.Phys-Probing , , BSI.O.Malfunction , BSI.O.Phys-Manipulation and BSI.O.Leak-Forced define how to implement the specific security functionality required by AUG1.P.Add-Functions-Lib . (Note that these objectives support that the specific security functionality is provided in a secure way as expected from AUG1.P.Add-Functions-Lib .) Especially BSI.O.Leak-Inherent and BSI.O.Leak-Forced refer to the protection of confidential data (User Data or TSF data) in general. User Data are also processed by the specific security functionality required by AUG1.P.Add-Functions-Lib . | | 100 | The added objective for the TOE AUG1.O.Add-Functions-Lib does not introduce any contradiction in the security objectives for the TOE. | SMD_NL_PQML_02.1_ST33K_ST_25_002 31/76 Extended Components Definition (ASE_ECD) Cryptographic Library NesLib-PQML 2.1 A01 on ## 5 Extended Components Definition (ASE_ECD) - 101 The extended components included in this Security Target are mainly taken from the BSICC-PP-0084-2014 Protection Profile, and defined there. - 102 There is only one extended component specific to this Security Target. The additional family FDP_SBO of the class FDP: User data protection, is defined in Section 5.1 . This family describes the security functional requirements for secure basic operation on data. - 103 The FDP class, defined in CC Part 2 ( CCMB-2022-11-002 R1 ), specifies requirements related to protecting user data within a TOE. The additional family 'Secure basic operation on data' (FDP_SBO) of the class FDP addresses protection of user data when it is manipulated thanks to basic functions. ### 5.1 Secure basic operation on data (FDP_SBO) #### Family behaviour 104 This family defines requirements for the TOE to provide secure basic operations on data. #### Component levelling - FDP_SBO.1 Requires the TOE to provide secure basic operations on data. Management: FDP_SBO.1 Audit: There are no management activities foreseen. FDP_SBO.1 There are no actions defined to be auditable. ####### FDP_SBO.1 Secure basic operation on data Hierarchical to: Dependencies: No other components. No dependencies. FDP_SBO.1.1 The TSF shall provide a [selection: Copy, Compare, [assignment: other operation] ] function on data [selection: from [assignment: memory area] to [assignment: memory area] , stored in [assignment: memory area ]]. 32/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security ## 6 Security requirements (ASE_REQ) - 105 This chapter on security requirements contains a section on security functional requirements (SFRs) for the TOE ( Section 6.1 ), a section on security assurance requirements (SARs) for the TOE ( Section 6.2 ), a section on the refinements of these SARs ( Section 6.3 ) as required by the " BSI-CC-PP-0084-2014 " Protection Profile. This chapter includes a section with the security requirements rationale ( Section 6.4 ). ### 6.1 Security Functional Requirements for the TOE - 106 The selected security functional requirements (SFRs) for this TOE (Cryptographic Library NesLib-PQML 2.1 A01 on ST33K) are summarized in Table 7 . This table also specifies: - Their type i.e. drawn from CCMB-2022-11-002 R1 or extended, - Their origin i.e. defined in the BSI-CC-PP-0084-2014 Protection Profile, in [AUG] , or in the Platform Security Target [PF-ST] . All SFRs are inherited from [PF-ST] , except those identified by 'This ST'. - 107 Most of the extended SFRs are defined in the " BSI-CC-PP-0084-2014 " Protection Profile. The new extended SFR FDP_SBO.1, defined in this Security Target is detailed in Section 5.1 . - 108 Except FDP_SBO.1, all extensions to the SFRs of the " BSI-CC-PP-0084-2014 " Protection Profiles (PPs) are exclusively drawn from CCMB-2022-11-002 R1 . - 109 All iterations, assignments, selections, or refinements on SFRs have been performed according to section 8.2 of CCMB-2022-11-002 R1 . They are easily identified in the following text as they appear as indicated here . Note that in order to improve readability, iterations are sometimes expressed within tables. Table 7. Summary of Security Functional Requirements for the TOE | Label | Title | Addressing | Origin | Type | |------------------|-------------------------------------------|-----------------------------|------------|---------------------| | FRU_FLT.2 | Limited fault tolerance | Malfunction | BSI-CC-PP- | CCMB-2022-11-002 R1 | | FPT_FLS.1 | Failure with preservation of secure state | Malfunction | 0084-2014 | CCMB-2022-11-002 R1 | | FMT_LIM.1 / Test | Limited capabilities | Abuse of Test functionality | BSI-CC-PP- | CCMB-2022-11-002 R1 | | FMT_LIM.2 / Test | Limited availability | Abuse of Test functionality | BSI-CC-PP- | CCMB-2022-11-002 R1 | SMD_NL_PQML_02.1_ST33K_ST_25_002 33/76 Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - Table 7. Summary of Security Functional Requirements for the TOE (continued) | Label | Title | Addressing | Origin | Type | |---------------------|---------------------------------------------|----------------------------------------------|------------------------------------------|---------------------| | FAU_SAS.1 | Audit storage | Lack of TOE identification | BSI-CC-PP- 0084-2014 Operated | Extended | | FDP_SDC.1 | Stored data confidentiality | Physical manipulation & probing | BSI-CC-PP- 0084-2014 Operated | | | FDP_SDI.2 | Stored data integrity monitoring and action | Physical manipulation & probing | BSI-CC-PP- 0084-2014 Operated | | | FPT_PHP.3 | Resistance to physical attack | Physical manipulation & probing | BSI-CC-PP- 0084-2014 | | | FDP_ITT.1 | Basic internal transfer protection | Leakage | BSI-CC-PP- 0084-2014 | CCMB- | | FPT_ITT.1 | Basic internal TSF data transfer protection | Leakage | BSI-CC-PP- 0084-2014 | 2022-11- 002 R1 | | FDP_IFC.1 | Subset information flow control | Leakage | BSI-CC-PP- 0084-2014 | | | FCS_RNG.1 / PTG.2 | Random number generation - PTG.2 | Weak cryptographic quality of random numbers | BSI-CC-PP- 0084-2014 Operated / [PF- ST] | | | FDP_SBO.1 / Copy | Secure basic operation on data - Copy | Data manipulation support | This ST | | | FDP_SBO.1 / Compare | Secure basic operation on data - Compare | Data manipulation support | This ST | | | FDP_SBO.1 / Swap | Secure basic operation on data - Swap | Data manipulation support | This ST | Extended | | FDP_SBO.1 / Shift | Secure basic operation on data - Shift | Data manipulation support | This ST | | | FDP_SBO.1 / XOR | Secure basic operation on data - XOR | Data manipulation support | This ST | | | FCS_COP.1 / TDES | Cryptographic operation - TDES | Cipher scheme support | [AUG] #1 Operated / [PF-ST] | CCMB-2022-11-002 R1 | | FCS_COP.1 / AES | Cryptographic operation - AES | Cipher scheme support | [AUG] #1 Operated / [PF-ST] | CCMB-2022-11-002 R1 | | FCS_COP.1 / SW- DES | Cryptographic operation - DES & Triple DES | Cipher scheme support | [AUG] #1 Operated / This ST | CCMB-2022-11-002 R1 | | FCS_COP.1 / SW- AES | Cryptographic operation - AES | Cipher scheme support | [AUG] #1 Operated / This ST | CCMB-2022-11-002 R1 | | FCS_COP.1 / RSA | Cryptographic operation - RSA | Cipher scheme support | [AUG] #1 Operated / This ST | CCMB-2022-11-002 R1 | 34/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security Table 7. Summary of Security Functional Requirements for the TOE (continued) | Label | Title | Addressing | Origin | Type | |-------------------------------------|---------------------------------------------------------------------------|-------------------------|-----------------------------|---------------------| | FCS_COP.1 / ECC-WC | Cryptographic operation - ECC-WC | Cipher scheme support | | CCMB-2022-11-002 R1 | | FCS_COP.1 / ECC-EC | Cryptographic operation - ECC-EC | Cipher scheme support | | CCMB-2022-11-002 R1 | | FCS_COP.1 / ECC-MC | Cryptographic operation - ECC-MC | Cipher scheme support | | CCMB-2022-11-002 R1 | | FCS_COP.1 / SHA | Cryptographic operation - SHA | Cipher scheme support | | CCMB-2022-11-002 R1 | | FCS_COP.1 / Keccak | Cryptographic operation - Keccak | Cipher scheme support | | CCMB-2022-11-002 R1 | | FCS_COP.1 / Keccak-p | Cryptographic operation - Keccak-p | Cipher scheme support | [AUG] #1 Operated / This ST | CCMB-2022-11-002 R1 | | FCS_COP.1 / Diffie-Hellman | Cryptographic operation - Diffie-Hellman | Cipher scheme support | | CCMB-2022-11-002 R1 | | FCS_COP.1 / SFH-DSA | Cryptographic operation - SFH-DSA | Cipher scheme support | | CCMB-2022-11-002 R1 | | FCS_COP.1 / ML- KEM | Cryptographic operation - ML-KEM | Cipher scheme support | | CCMB-2022-11-002 R1 | | FCS_COP.1 / ML- DSA | Cryptographic operation - ML-DSA | Cipher scheme support | | CCMB-2022-11-002 R1 | | FCS_COP.1 / DRBG | Cryptographic operation - DRBG | Cipher scheme support | | CCMB-2022-11-002 R1 | | FCS_CKM.1 / Prime-generation | Cryptographic key generation - Prime generation | Cipher scheme support | This ST | CCMB-2022-11-002 R1 | | FCS_CKM.1 / RSA-key- generation | Cryptographic key generation - RSA key generation | Cipher scheme support | This ST | CCMB-2022-11-002 R1 | | FCS_CKM.1 / ML- KEM-key- generation | Cryptographic key generation - ML-KEM key generation | Cipher scheme support | This ST | CCMB-2022-11-002 R1 | | FCS_CKM.1 / ML- DSA-key- generation | Cryptographic key generation - ML-DSA key generation | Cipher scheme support | This ST | CCMB-2022-11-002 R1 | | FDP_ACC.2 / Memories | Complete access control | Memory access violation | [PF-ST] | CCMB-2022-11-002 R1 | | FDP_ACF.1 / Memories | Security attribute based access control | Memory access violation | [AUG] #4 Operated | CCMB-2022-11-002 R1 | | FMT_MSA.3 / Memories | Static attribute initialisation | Memory access violation | [AUG] #4 Operated | CCMB-2022-11-002 R1 | | FMT_MSA.1 / Memories | SMD_NL_PQML_02.1_ST33K_ST_25_002 Correct Management of security attribute | operation | [AUG] #4 Operated | CCMB-2022-11-002 R1 | Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - Table 7. Summary of Security Functional Requirements for the TOE (continued) | Label | Title | Addressing | Origin | Type | |--------------------|----------------------------------------------------|------------------------------------------|-------------------------------|---------------------| | FTP_ITC.1 / Loader | Inter-TSF trusted channel - Loader | Loader violation | BSI-CC-PP- 0084-2014 Operated | CCMB-2022-11-002 | | FDP_UCT.1 / Loader | Basic data exchange confidentiality - Loader | Loader violation | BSI-CC-PP- 0084-2014 Operated | CCMB-2022-11-002 | | FDP_UIT.1 / Loader | Data exchange integrity - Loader | Loader violation | BSI-CC-PP- 0084-2014 Operated | CCMB-2022-11-002 | | FDP_ACC.1 / Loader | Subset access control - Loader | Loader violation | BSI-CC-PP- 0084-2014 Operated | CCMB-2022-11-002 | | FDP_ACF.1 / Loader | Security attribute based access control - Loader | Loader violation | BSI-CC-PP- 0084-2014 Operated | CCMB-2022-11-002 | | FMT_MSA.3 / Loader | Static attribute initialisation - Loader | | | CCMB-2022-11-002 | | FMT_MSA.1 / Loader | Management of security attribute - Loader | | | CCMB-2022-11-002 | | FMT_SMR.1 / Loader | Security roles - Loader | | | CCMB-2022-11-002 | | FIA_UID.1 / Loader | Timing of identification - Loader | Correct Loader operation | | R1 | | FIA_UAU.1 / Loader | Timing of authentication - Loader | | [PF-ST] | CCMB-2022-11-002 | | FMT_SMF.1 / Loader | Specification of management functions - Loader | | | CCMB-2022-11-002 | | FPT_FLS.1 / Loader | Failure with preservation of secure state - Loader | | | CCMB-2022-11-002 | | FAU_SAR.1 / Loader | Audit review - Loader | Lack of TOE identification | | CCMB-2022-11-002 | | FAU_SAS.1 / Loader | Audit storage - Loader | Lack of TOE identification | | Extended | | FTP_ITC.1 / Sdiag | Inter-TSF trusted channel - Secure Diagnostic | Abuse of Secure Diagnostic functionality | [PF-ST] | CCMB-2022-11-002 R1 | | FAU_SAR.1 / Sdiag | Audit review - Secure Diagnostic | Abuse of Secure Diagnostic functionality | [PF-ST] | CCMB-2022-11-002 R1 | | FMT_LIM.1 / Sdiag | Limited capabilities - Secure Diagnostic | Abuse of Secure Diagnostic functionality | [PF-ST] | CCMB-2022-11-002 R1 | | FMT_LIM.2 / Sdiag | Limited availability - Secure Diagnostic | Abuse of Secure Diagnostic functionality | [PF-ST] | CCMB-2022-11-002 R1 | 36/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security - 110 All these SFRs have already been stated in the ST33K1M5C and ST33K1M5T C03 Security Target for composition , and are satisfied by the ST33K1M5C and ST33K1M5T platform, except the following ones, dedicated to the NesLib: - FDP_SBO.1 / Copy , FDP_SBO.1 / Compare , FDP_SBO.1 / Swap , FDP_SBO.1 / Shift , FDP_SBO.1 / XOR , - FCS_COP.1 / SW-DES , FCS_COP.1 / SW-AES , FCS_COP.1 / RSA , FCS_COP.1 / ECC-WC , FCS_COP.1 / ECC-EC , FCS_COP.1 / ECC-MC , FCS_COP.1 / SHA , FCS_COP.1 / Keccak , FCS_COP.1 / Keccak-p , FCS_COP.1 / Diffie-Hellman , FCS_COP.1 / SFH-DSA , FCS_COP.1 / DRBG , - FCS_CKM.1 / Prime-generation , FCS_CKM.1 / RSA-key-generation 111 and to the NesLib-PQML: - FCS_COP.1 / ML-KEM , - FCS_CKM.1 / ML-KEM-key-generation . - FCS_COP.1 / ML-DSA , - FCS_CKM.1 / ML-DSA-key-generation . 112 The SFRs from the Platform Security Target are detailed in the ST33K1M5C and ST33K1M5T C03 Security Target for composition [PF-ST] . #### 6.1.1 Security Functional Requirements for the secure data manipulation services ####### Secure basic operation on data (FDP_SBO.1) / Copy 113 The TSF shall provide a Copy function on data from ROM, RAM or NVM to RAM . ####### Secure basic operation on data (FDP_SBO.1) / Compare - 114 The TSF shall provide a Compare function on data stored in ROM, RAM or NVM . ####### Secure basic operation on data (FDP_SBO.1) / Swap 115 The TSF shall provide a Swap function on data stored in RAM . ####### Secure basic operation on data (FDP_SBO.1) / Shift 116 The TSF shall provide a Shift function on data stored in RAM . ####### Secure basic operation on data (FDP_SBO.1) / XOR - 117 The TSF shall provide a XOR function on data from ROM, RAM or NVM to RAM . #### 6.1.2 Security Functional Requirements for the cryptographic services ####### Cryptographic operation (FCS_COP.1) 118 The TSF shall perform the operations in Table 8 in accordance with a specified cryptographic algorithm in Table 8 and cryptographic key sizes of Table 8 that meet the standards in Table 8 . SMD_NL_PQML_02.1_ST33K_ST_25_002 37/76 Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - Table 8. FCS_COP.1 iterations (cryptographic operations) | Iteration label | [assignment: list of cryptographic operations] | [assignment: cryptographic algorithm] (1) | [assignment: cryptographic key sizes] (1) | [assignment: list of standards] | |-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------|-----------------------------------------------------------------|--------------------------------------------------------------------------| | SW-DES | * encryption and decryption with single-key DES, 2-key or 3-key Triple DES in Cipher Block Chaining (CBC) mode, * single-key DES, 2-key and 3-key Triple DES block ciphers and their inverses, which can be used by the ES developer to implement other modes of operations for encryption (e.g., ECB, CFB, OFB, CTR), authentication, authenticated encryption or key derivation | Data Encryption Standard (DES) and Triple DES (2) | 56 bits (DES), 112 (Triple DES 2 keys), 168 (Triple DES 3 keys) | NIST SP 800-67 NIST SP 800-38A | | SW-AES | * AES encryption (cipher) and decryption (inverse cipher) in Cipher Block Chaining (CBC) mode * Message authentication Code computation (CMAC) * Authenticated encryption/decryption in Galois Counter Mode (GCM) * Authenticated encryption/decryption in Counter with CBC-MAC (CCM) * AES block ciphers and their inverses, which can be used by the ES developer to implement other modes of operations for encryption (e.g., ECB, CFB, OFB, CTR), authentication, authenticated | Advanced Encryption Standard | 128, 192 and 256 bits | FIPS 197 NIST SP 800-38B NIST SP 800-38A NIST SP 800-38D NIST SP 800-38C | | RSA | encryption or key derivation * RSA public key operation * RSA private key operation without the Chinese Remainder Theorem * RSA private key operation with the Chinese Remainder Theorem * EMSA PSS and PKCS1 signature scheme coding * RSA Key Encapsulation Method (KEM) | Rivest, Shamir & Adleman's (3) | up to 4096 bits | PKCS #1 V2.1 | 38/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security Table 8. FCS_COP.1 iterations (cryptographic operations) (continued) | Iteration label | [assignment: list of cryptographic operations] | [assignment: cryptographic algorithm] (1) | [assignment: cryptographic key sizes] (1) | [assignment: list of standards] | |-------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------|---------------------------------------------------|-------------------------------------------| | ECC-WC | * private scalar multiplication * prepare Jacobian * public scalar multiplication * point validity check * convert Jacobian to affine coordinates * general point addition * point expansion * point compression | Elliptic Curves Cryptography on GF(p) on curves in Weierstrass form (4) | up to 640 bits | IEEE 1363-2000, chapter 7 IEEE 1363a-2004 | | ECC-WC | * Diffie-Hellman (ECDH) key agreement computation | Elliptic Curves Cryptography on GF(p) on curves in Weierstrass form (4) | up to 640 bits | NIST SP 800-56A | | ECC-WC | * digital signature algorithm (ECDSA) generation and verification | Elliptic Curves Cryptography on GF(p) on curves in Weierstrass form (4) | up to 640 bits | FIPS 186-5 ANSI X9.62, section 7 | | ECC-EC | * ed25519 generation * ed25519 verification * ed25519 point decompression * ed25519 scalar multiplication * Ed448 generation * Ed448 verification * Ed448 point decompression * Ed448 scalar multiplication | Elliptic Curves Cryptography on GF(p) on curves in Edwards form, with curves ed25519 and Ed448 | 256 bits 448 bits | RFC 8032 | | ECC-MC | * X25519 for key agreement * X448 for key agreement | Elliptic Curves Cryptography on GF(p) on curves in Montgomery form, with curve Curve25519 and Curve448 | 256 bits 448 bits | RFC 7748 | | SHA | * SHA-1 (5) * SHA-224 * SHA-256 * SHA-384 * SHA-512 * Protected SHA-1 (3) * Protected SHA-256 * Protected SHA-384 * Protected SHA-512 | Secure Hash Algorithm | assignment pointless because algorithm has no key | FIPS 180-4 | | SHA | * HMAC using any of the above protected hash functions (6) | Secure Hash Algorithm | up to 1024 bits | FIPS 198-1 | SMD_NL_PQML_02.1_ST33K_ST_25_002 39/76 Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - Table 8. FCS_COP.1 iterations (cryptographic operations) (continued) | Iteration label | [assignment: list of cryptographic operations] | [assignment: cryptographic algorithm] (1) | [assignment: cryptographic key sizes] (1) | [assignment: list of standards] | |-------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------| | Keccak | * SHAKE128, * SHAKE256, * SHA3-224, * SHA3-256, * SHA3-384, * SHA3-512, * Keccak[r,1600-r], * protected SHAKE128, * protected SHAKE256, * protected SHA3-224, * protected SHA3-256, * protected SHA3-384, * protected SHA3-512, * Protected Keccak[r,1600-r] | Keccak (SHA-3) | no key for plain functions, variable key length up to security level for protected functions (security level is last number in function names and 1600-c for Keccak) | FIPS 202 | | Keccak-p | * Keccak-p[1600,n_r = 24], * Keccak-p[1600, n_r=12], * protected Keccak-p[1600,n_r = 24], * protected Keccak-p[1600, n_r=12] | Keccak-p | no key for plain functions, any key length up to 256 bits for protected functions | FIPS 202 | | Diffie- Hellman | Diffie-Hellman | Diffie-Hellman | up to 4096 bits | ANSI X9.42 | | SFH- DSA | LMS signature verification | Leighton-Micali stateful hash- based digital signature algorithm | the security strength is set with the LMS parameters: LMOTS_SHA2 56_N32_W4 and LMS_SHA256 _M32_H10 | NIST SP 800-208 | | ML-KEM | * ML-KEM encapsulation * ML-KEM decapsulation | Module-Lattice- Based Key- Encapsulation Mechanism | ML-KEM-512 ML-KEM-768 ML-KEM-1024 | FIPS-203 sections 6.2 and 6.3 | | ML-DSA | * ML-DSA signature generation * ML-DSA signature verification | Module-Lattice- Based Digital Signature Algorithm | ML-DSA-44 ML-DSA-65 ML-DSA-87 | FIPS-204 sections 6.2 and 6.3 | 40/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security Table 8. FCS_COP.1 iterations (cryptographic operations) (continued) | Iteration label | [assignment: list of cryptographic operations] | [assignment: cryptographic algorithm] (1) | [assignment: cryptographic key sizes] (1) | [assignment: list of standards] | |-------------------|-----------------------------------------------------|---------------------------------------------|---------------------------------------------|-----------------------------------| | DRBG (7) | * SHA-1 (8) * SHA-224 * SHA-256 * SHA-384 * SHA-512 | Hash-DRBG | None | NIST SP 800-90A FIPS 180-4 | | DRBG (7) | *AES | CTR-DRBG | 128, 192 and 256 bits | NIST SP 800-90A FIPS 197 | Therefore, it is up to the user to satisfy the requirements of these algorithms by respecting the recommendations and rules given in these documents, for instance regarding the secrecy, the length and the minimum entropy of keys and the uniqueness of nonces. Also, some algorithms are parameterized, and for these the choice of parameters and its consequences on the algorithmic security is left to the user's appreciation. As particularly important example, elliptic curve cryptography algorithms should be used with elliptic curves that have no known weaknesses and preferably standard ones. 2. Triple DES with three keys can be used until end 2027 as recommended in ECCG ACM . However depending on the context of use, the Embedded Software that may need to use triple DES with three keys might be submit ted to a dedicated cryptographic analysis evaluation, for instance in France the use of triple DES with three keys is no t recommended anymore since end 2025, cf. ANSSI-PG-083. 3. It is recommended for RSA primitive to use modulus of size equal or higher to 3000 bits and 16-bit long public exponent since 2026 in ECCG ACM. 4. Elliptic curve cryptographic algorithms should be used with elliptic curves that have no known weaknesses and preferably standard ones. Some recommended curves are given in ECCG ACM in section 4.3. More curves can be used, the composite product certification will determine the correct use of elliptic curves during the cryptographic analysis. 5. Note that SHA-1 and SHA-224 are no longer recommended as cryptographic functions in ECCG ACM . Hence, Security IC Embedded Software may need to use another SHA to achieve a suitable strength. 6. HMAC-SHA-1 is only recommended for use until end 2030 in ECCG ACM. 7. NesLib gives support to Hash-DRBG and CTR-DRBG as specified in Section 10 of NIST SP 800-90A . The implementation is following the specification of the Section 10 of NIST SP 800-90A . 8. Note that SHA-1 and SHA-224 are no longer recommended as cryptographic functions in ECCG ACM . Hence, Security IC Embedded Software may need to use another SHA to achieve a suitable strength. ####### Cryptographic key generation (FCS_CKM.1) - 119 The TSF shall generate cryptographic keys in accordance with a specified cryptographic key generation algorithm , in Table 9 , and specified cryptographic key sizes of Table 9 that meet the following standards in Table 9 . SMD_NL_PQML_02.1_ST33K_ST_25_002 41/76 Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - Table 9. FCS_CKM.1 iterations (cryptographic key generation) | Iteration label | [assignment: cryptographic key generation algorithm] | [assignment: cryptographic key sizes] | [assignment: list of standards] | |------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------|----------------------------------------| | Prime generation (1) | prime generation and RSA prime generation algorithm, optionally protected against side channel attacks, and/or optionally with conditions | up to 2048 bits | FIPS 186-5 FIPS 140-3 | | RSA-key-generation | RSA key pair generation algorithm, optionally protected against side channel attacks, and/or optionally with conditions | From 829 bits up to 4096 bits | ISO/IEC 9796-2 PKCS #1 V2.1 FIPS 140-3 | | ML-KEM-key- generation | ML-KEM key generation algorithm | ML-KEM-512 ML-KEM-768 ML-KEM-1024 | FIPS-203 section 6.1 | | ML-DSA-key- generation | ML-DSA key generation algorithm | ML-DSA-44 ML-DSA-65 ML-DSA-87 | FIPS-204 section 6.1 | ### 6.2 TOE security assurance requirements - 120 Security Assurance Requirements for the TOE for the evaluation of the TOE are those taken from the Evaluation Assurance Level 5 ( EAL5 ) and augmented by taking the following components: - ALC_DVS.2, - AVA_VAN.5, - ALC_FLR.2, - the composite product package (COMP). Regarding application note 22 of BSI-CC-PP-0084-2014 , the continuously increasing maturity level of evaluations of Security ICs justifies the selection of a higher-level assurance package. - 121 The set of security assurance requirements (SARs) is presented in Table 10 , indicating the origin of the requirement. Table 10. TOE security assurance requirements | Label | Title | Origin | |-----------|---------------------------------------------------------------------------------|---------------------------| | ADV_ARC.1 | Security architecture description | EAL5/ BSI-CC-PP-0084-2014 | | ADV_FSP.5 | Complete semi-formal functional specification with additional error information | EAL5 | | ADV_IMP.1 | Implementation representation of the TSF | EAL5/ BSI-CC-PP-0084-2014 | 42/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security Table 10. TOE security assurance requirements (continued) | | Label | Title | Origin | |------------|-------------------------------------------------------------------------------------------------------------------------------------|---------------------------| | ADV_INT.2 | Well-structured internals | EAL5 | | ADV_TDS.4 | Semiformal modular design | EAL5 | | ADV_COMP.1 | Composite design compliance | CCMB-2022-11-003 R1 | | AGD_OPE.1 | Operational user guidance | EAL5/ BSI-CC-PP-0084-2014 | | AGD_PRE.1 | Preparative procedures | EAL5/ BSI-CC-PP-0084-2014 | | ALC_CMC.4 | Production support, acceptance procedures and automation | EAL5/ BSI-CC-PP-0084-2014 | | ALC_CMS.5 | Development tools CM coverage | EAL5 | | ALC_DEL.1 | Delivery procedures | EAL5/ BSI-CC-PP-0084-2014 | | ALC_DVS.2 | Sufficiency of security measures | BSI-CC-PP-0084-2014 | | ALC_FLR.2 | Flaw reporting procedures | Security Target | | ALC_LCD.1 | Developer defined life-cycle model | EAL5/ BSI-CC-PP-0084-2014 | | ALC_TAT.2 | Compliance with implementation standards | EAL5 | | ALC_COMP.1 | Integration of the dependent component into the related base component and Consistency check for delivery and acceptance procedures | CCMB-2022-11-003 R1 | | ASE_CCL.1 | Conformance claims | EAL5/ BSI-CC-PP-0084-2014 | | ASE_ECD.1 | Extended components definition | EAL5/ BSI-CC-PP-0084-2014 | | ASE_INT.1 | ST introduction | EAL5/ BSI-CC-PP-0084-2014 | | ASE_OBJ.2 | Security objectives | EAL5/ BSI-CC-PP-0084-2014 | | ASE_REQ.2 | Derived security requirements | EAL5/ BSI-CC-PP-0084-2014 | | ASE_SPD.1 | Security problem definition | EAL5/ BSI-CC-PP-0084-2014 | | ASE_TSS.1 | TOE summary specification | EAL5/ BSI-CC-PP-0084-2014 | | ASE_COMP.1 | Consistency of Security Target | CCMB-2022-11-003 R1 | | ATE_COV.2 | Analysis of coverage | EAL5/ BSI-CC-PP-0084-2014 | | ATE_DPT.3 | Testing: modular design | EAL5 | | ATE_FUN.1 | Functional testing | EAL5/ BSI-CC-PP-0084-2014 | | ATE_IND.2 | Independent testing - sample | EAL5/ BSI-CC-PP-0084-2014 | | ATE_COMP.1 | Composite product functional testing | CCMB-2022-11-003 R1 | | AVA_VAN.5 | Advanced methodical vulnerability analysis | BSI-CC-PP-0084-2014 | | AVA_COMP.1 | Composite vulnerability assessment | CCMB-2022-11-003 R1 | SMD_NL_PQML_02.1_ST33K_ST_25_002 43/76 Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - ### 6.3 Refinement of the security assurance requirements - 122 As BSI-CC-PP-0084-2014 defines refinements for selected SARs, these refinements are also claimed in this Security Target. - 123 Regarding application note 23 of BSI-CC-PP-0084-2014 , the refinements for all the assurance families have been reviewed for the hierarchically higher-level assurance components selected in this Security Target. - 124 An impact summary is provided in Table 11 . Table 11. Impact of EAL5 selection on BSI-CC-PP-0084-2014 refinements | Assurance Family | BSI-CC-PP- 0084-2014 Level | ST Level | Impact on refinement | |--------------------|------------------------------|------------|----------------------------------| | ALC_DVS | 2 | 2 | None | | ALC_CMS | 4 | 5 | None, refinement is still valid | | ALC_CMC | 4 | 4 | None | | ADV_ARC | 1 | 1 | None | | ADV_FSP | 4 | 5 | None, presentation style changes | | ADV_IMP | 1 | 1 | None | | ATE_COV | 2 | 2 | None | | AGD_OPE | 1 | 1 | None | | AVA_VAN | 5 | 5 | None | ### 6.4 Security Requirements rationale #### 6.4.1 Rationale for the Security Functional Requirements - 125 Just as for the security objectives rationale of Section 4.3 , the main line of this rationale is that the inclusion of all the security requirements of the BSI-CC-PP-0084-2014 Protection Profile, together with those introduced in the Platform Security Target [PF-ST] , and those introduced in this Security Target, guarantees that all the security objectives identified in Section 4 are suitably addressed by the security requirements stated in this chapter, and that the latter together form an internally consistent whole. Table 12. Security Requirements versus Security Objectives | Security Objective | TOE Security Functional and Assurance Requirements | |----------------------|----------------------------------------------------------------------------------------------------------------------------------------------| | BSI.O.Leak-Inherent | Basic internal transfer protection FDP_ITT.1 Basic internal TSF data transfer protection FPT_ITT.1 Subset information flow control FDP_IFC.1 | | BSI.O.Phys-Probing | Stored data confidentiality FDP_SDC.1 Resistance to physical attack FPT_PHP.3 | 44/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security Table 12. Security Requirements versus Security Objectives | Security Objective | TOE Security Functional and Assurance Requirements | |-------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | BSI.O.Malfunction | Limited fault tolerance FRU_FLT.2 Failure with preservation of secure state FPT_FLS.1 | | BSI.O.Phys-Manipulation | Stored data integrity monitoring and action FDP_SDI.2 Resistance to physical attack FPT_PHP.3 | | BSI.O.Leak-Forced | All requirements listed for BSI.O.Leak-Inherent FDP_ITT.1 , FPT_ITT.1 , FDP_IFC.1 plus those listed for BSI.O.Malfunction and BSI.O.Phys- Manipulation FRU_FLT.2 , FPT_FLS.1 , FDP_SDI.2 , FPT_PHP.3 | | BSI.O.Abuse-Func | Limited capabilities FMT_LIM.1 / Test Limited availability FMT_LIM.2 / Test Limited capabilities - Secure Diagnostic FMT_LIM.1 / Sdiag Limited availability - Secure Diagnostic FMT_LIM.2 / Sdiag Inter-TSF trusted channel - Secure Diagnostic FTP_ITC.1 / Sdiag Audit review - Secure Diagnostic FAU_SAR.1 / Sdiag plus those for BSI.O.Leak-Inherent, BSI.O.Phys-Probing, BSI.O.Malfunction, BSI.O.Phys-Manipulation, BSI.O.Leak-Forced FDP_ITT.1 , FPT_ITT.1 , FDP_IFC.1 , FDP_SDC.1 , FDP_SDI.2 , FPT_PHP.3 , FRU_FLT.2 , FPT_FLS.1 | | BSI.O.Identification | Audit storage FAU_SAS.1 | | BSI.O.RND | Random number generation - PTG.2 FCS_RNG.1 / PTG.2 plus those for BSI.O.Leak-Inherent, BSI.O.Phys-Probing, BSI.O.Malfunction, BSI.O.Phys-Manipulation, BSI.O.Leak-Forced FDP_ITT.1 , FPT_ITT.1 , FDP_IFC.1 , FDP_SDI.2 , FDP_SDC.1 , FPT_PHP.3 , FRU_FLT.2 , FPT_FLS.1 | | BSI.OE.Resp-Appl | Not applicable | | BSI.OE.Process-Sec-IC | Not applicable | | BSI.OE.Lim-Block-Loader | Not applicable | | BSI.OE.Loader-Usage | Not applicable | | BSI.OE.TOE-Auth | Not applicable | | OE.Enable-Disable-Secure-Diag | Not applicable | | OE.Secure-Diag-Usage | Not applicable | | BSI.O.Authentication | Authentication Proof of Identity FIA_API.1 | | BSI.O.Cap-Avail-Loader | Limited capabilities FMT_LIM.1 / Loader Limited availability FMT_LIM.2 / Loader | SMD_NL_PQML_02.1_ST33K_ST_25_002 45/76 Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - Table 12. Security Requirements versus Security Objectives | | Security Objective | TOE Security Functional and Assurance Requirements | |--------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | BSI.O.Ctrl-Auth-Loader | ' Inter-TSF trusted channel - Loader ' FTP_ITC.1 / Loader ' Basic data exchange confidentiality - Loader ' FDP_UCT.1 / Loader ' Data exchange integrity - Loader ' FDP_UIT.1 / Loader ' Subset access control - Loader ' FDP_ACC.1 / Loader ' Security attribute based access control - Loader ' FDP_ACF.1 / Loader ' Static attribute initialisation - Loader ' FMT_MSA.3 / Loader ' Management of security attribute - Loader ' FMT_MSA.1 / Loader ' Specification of management functions - Loader ' FMT_SMF.1 / Loader ' Security roles - Loader ' FMT_SMR.1 / Loader ' Timing of identification - Loader ' FIA_UID.1 / Loader ' Timing of authentication - Loader ' FIA_UAU.1 / Loader | | JIL.O.Prot-TSF-Confidentiality | ' Inter-TSF trusted channel - Loader ' FTP_ITC.1 / Loader ' Basic data exchange confidentiality - Loader ' FDP_UCT.1 / Loader ' Data exchange integrity - Loader ' FDP_UIT.1 / Loader ' Subset access control - Loader ' FDP_ACC.1 / Loader ' Security attribute based access control - Loader ' FDP_ACF.1 / Loader ' Static attribute initialisation - Loader ' FMT_MSA.3 / Loader ' Management of security attribute - Loader ' FMT_MSA.1 / Loader ' Specification of management functions - Loader ' FMT_SMF.1 / Loader ' Security roles - Loader ' FMT_SMR.1 / Loader ' Timing of identification - Loader ' FIA_UID.1 / Loader ' Timing of authentication - Loader ' FIA_UAU.1 / Loader | | JIL.O.Secure-Load-ACode | ' Inter-TSF trusted channel - Loader ' FTP_ITC.1 / Loader ' Basic data exchange confidentiality - Loader ' FDP_UCT.1 / Loader ' Data exchange integrity - Loader ' FDP_UIT.1 / Loader ' Subset access control - Loader ' FDP_ACC.1 / Loader ' Security attribute based access control - Loader ' FDP_ACF.1 / Loader ' Static attribute initialisation - Loader ' FMT_MSA.3 / Loader ' Management of security attribute - Loader ' FMT_MSA.1 / Loader ' Specification of management functions - Loader ' FMT_SMF.1 / Loader ' Security roles - Loader ' FMT_SMR.1 / Loader ' Timing of identification - Loader ' FIA_UID.1 / Loader ' Timing of authentication - Loader ' FIA_UAU.1 / Loader ' Audit storage - Loader ' FAU_SAS.1 / Loader | | JIL.O.Secure-AC-Activation | ' Failure with preservation of secure state - Loader ' FPT_FLS.1 / Loader | 46/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security Table 12. Security Requirements versus Security Objectives | | Security Objective | TOE Security Functional and Assurance Requirements | |---------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | JIL.O.TOE-Identification | ' Audit storage - Loader ' FAU_SAS.1 / Loader ' Audit review - Loader ' FAU_SAR.1 / Loader ' Stored data integrity monitoring and action ' FDP_SDI.2 | | O.Secure-Load-AMemImage | ' Inter-TSF trusted channel - Loader ' FTP_ITC.1 / Loader ' Basic data exchange confidentiality - Loader ' FDP_UCT.1 / Loader ' Data exchange integrity - Loader ' FDP_UIT.1 / Loader ' Subset access control - Loader ' FDP_ACC.1 / Loader ' Security attribute based access control - Loader ' FDP_ACF.1 / Loader ' Static attribute initialisation - Loader ' FMT_MSA.3 / Loader ' Management of security attribute - Loader ' FMT_MSA.1 / Loader ' Specification of management functions - Loader ' FMT_SMF.1 / Loader ' Security roles - Loader ' FMT_SMR.1 / Loader ' Timing of identification - Loader ' FIA_UID.1 / Loader ' Timing of authentication - Loader ' FIA_UAU.1 / Loader | | O.MemImage-Identification | ' Audit storage - Loader ' FAU_SAS.1 / Loader ' Failure with preservation of secure state - Loader ' FPT_FLS.1 / Loader ' Audit storage - Loader ' FAU_SAS.1 / Loader ' Audit review - Loader ' FAU_SAR.1 / Loader ' Stored data integrity monitoring and action ' FDP_SDI.2 | | OE.Composite-TOE-Id | Not applicable | | OE.TOE-Id | Not applicable | | AUG1.O.Add-Functions | ' Cryptographic operation - TDES ' FCS_COP.1 / TDES ' Cryptographic operation - AES ' FCS_COP.1 / AES | SMD_NL_PQML_02.1_ST33K_ST_25_002 47/76 Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - Table 12. Security Requirements versus Security Objectives | | Security Objective | TOE Security Functional and Assurance Requirements | |--------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | AUG1.O.Add-Functions-Lib | ' Cryptographic operation - DES & Triple DES ' FCS_COP.1 / SW- DES ' Cryptographic operation -AES ' FCS_COP.1 / SW-AES ' Cryptographic operation - RSA ' FCS_COP.1 / RSA ' Cryptographic operation - ECC-WC ' FCS_COP.1 / ECC-WC ' Cryptographic operation - ECC-EC ' FCS_COP.1 / ECC-EC ' Cryptographic operation - ECC-MC ' FCS_COP.1 / ECC-MC ' Cryptographic operation - SHA ' FCS_COP.1 / SHA ' Cryptographic operation - Keccak ' FCS_COP.1 / Keccak ' Cryptographic operation - Keccak-p ' FCS_COP.1 / Keccak-p ' Cryptographic operation - Diffie-Hellman ' FCS_COP.1 / Diffie- Hellman ' Cryptographic operation - SFH-DSA ' FCS_COP.1 / SFH-DSA ' Cryptographic operation - ML-KEM ' FCS_COP.1 / ML-KEM ' Cryptographic operation - ML-DSA ' FCS_COP.1 / ML-DSA ' Cryptographic operation - DRBG ' FCS_COP.1 / DRBG ' Cryptographic key generation - Prime generation ' FCS_CKM.1 / Prime-generation ' Cryptographic key generation - RSA key generation ' FCS_CKM.1 / RSA-key-generation ' Cryptographic key generation - ML-KEM key generation ' FCS_CKM.1 / ML-KEM-key-generation ' Cryptographic key generation - ML-DSA key generation ' FCS_CKM.1 / ML-DSA-key-generation ' Secure basic operation on data - Copy ' FDP_SBO.1 / Copy ' Secure basic operation on data - Compare ' FDP_SBO.1 / Compare ' Secure basic operation on data - Swap ' FDP_SBO.1 / Swap ' Secure basic operation on data - Shift ' FDP_SBO.1 / Shift ' Secure basic operation on data - XOR ' FDP_SBO.1 / XOR | | AUG4.O.Mem-Access | and underlying platform SFRs ' Complete access control ' FDP_ACC.2 / Memories ' Security attribute based access control ' FDP_ACF.1 / Memories ' Static attribute initialisation ' FMT_MSA.3 / Memories ' Management of security attribute ' FMT_MSA.1 / Memories ' Specification of management functions ' FMT_SMF.1 / Memories | | O.Firewall | ' Complete access control ' FDP_ACC.2 / Memories ' Security attribute based access control ' FDP_ACF.1 / Memories ' Static attribute initialisation ' FMT_MSA.3 / Memories ' Management of security attribute ' FMT_MSA.1 / Memories ' Specification of management functions ' FMT_SMF.1 / Memories | 126 As origins of security objectives have been carefully kept in their labelling, and origins of security requirements have been carefully identified in Table 7 and Table 12 , it can be verified that the justifications provided by the BSI-CC-PP-0084-2014 Protection Profile and [AUG] can just be carried forward to their union. 48/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security - 127 All justifications for Security Objectives and SFRs have been already provided in the Platform Security Target [PF-ST] , except for AUG1.O.Add-Functions-Lib and its associated SFRs. - 128 This rationale must show that security requirements suitably address this objective. - 129 The justification that the additional security objectives are suitably addressed, that the additional security requirements are mutually supportive and that, together with those already in BSI-CC-PP-0084-2014 and in [PF-ST] , they form an internally consistent whole, is provided in the next subsections. #### 6.4.2 Additional security objectives are suitably addressed Security objective 'Additional Specific Security Functionality ( AUG1.O.AddFunctions-Lib )' - 130 The justification related to the security objective 'Additional Specific Security Functionality ( AUG1.O.Add-Functions-Lib )' is as follows: - 131 The security functional requirements 'Cryptographic operation (FCS_COP.1)' ( FCS_COP.1 / SW-DES , FCS_COP.1 / SW-AES , FCS_COP.1 / RSA , FCS_COP.1 / ECC-WC , FCS_COP.1 / ECC-EC , FCS_COP.1 / ECC-MC , FCS_COP.1 / SHA , FCS_COP.1 / Keccak , FCS_COP.1 / Keccak-p , FCS_COP.1 / Diffie-Hellman , FCS_COP.1 / SFH-DSA , FCS_COP.1 / ML-KEM , FCS_COP.1 / ML-DSA , FCS_COP.1 / DRBG ), "Cryptographic key generation (FCS_CKM.1)" ( FCS_CKM.1 / Prime-generation , FCS_CKM.1 / RSA-keygeneration , FCS_CKM.1 / ML-KEM-key-generation , FCS_CKM.1 / ML-DSA-keygeneration ) and "Secure basic operation on data (FDP_SBO.1)" ( FDP_SBO.1 / Copy , FDP_SBO.1 / Compare , FDP_SBO.1 / Swap , FDP_SBO.1 / Shift , FDP_SBO.1 / XOR ) exactly require those functions to be implemented that are demanded by AUG1.O.AddFunctions-Lib . Therefore, all these SFRs are suitable to meet the security objective. #### 6.4.3 Additional security requirements are consistent "Cryptographic operation (FCS_COP.1)' ( FCS_COP.1 / SW-DES , FCS_COP.1 / SW-AES , FCS_COP.1 / RSA , FCS_COP.1 / ECC-WC , FCS_COP.1 / ECC-EC , FCS_COP.1 / ECC-MC , FCS_COP.1 / SHA , FCS_COP.1 / Keccak , FCS_COP.1 / Keccak-p , FCS_COP.1 / Diffie-Hellman , FCS_COP.1 / SFH-DSA , FCS_COP.1 / ML-KEM , FCS_COP.1 / ML-DSA , FCS_COP.1 / DRBG ) - 132 These security requirements have already been argued in Section : Security objective 'Additional Specific Security Functionality (AUG1.O.Add-Functions-Lib)' above. - "Cryptographic key generation (FCS_CKM.1)' ( FCS_CKM.1 / Primegeneration , FCS_CKM.1 / RSA-key-generation , FCS_CKM.1 / ML-KEM-keygeneration , FCS_CKM.1 / ML-DSA-key-generation ) - 133 These security requirements have already been argued in Section : Security objective 'Additional Specific Security Functionality (AUG1.O.Add-Functions-Lib)' above. SMD_NL_PQML_02.1_ST33K_ST_25_002 49/76 Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - "Secure basic operation on data (FDP_SBO.1)' ( FDP_SBO.1 / Copy , FDP_SBO.1 / Compare , FDP_SBO.1 / Swap , FDP_SBO.1 / Shift , FDP_SBO.1 / XOR ) 134 These security requirements have already been argued in Section : Security objective 'Additional Specific Security Functionality (AUG1.O.Add-Functions-Lib)' above. #### 6.4.4 Dependencies of Security Functional Requirements - 135 All dependencies of Security Functional Requirements have been fulfilled in this Security Target except : - those justified in the BSI-CC-PP-0084-2014 Protection Profile security requirements rationale, - those justified in the ST33K1M5C and ST33K1M5T C03 Security Target for composition [PF-ST] security requirements rationale, - those justified in [AUG] security requirements rationale, - the dependency of FCS_COP.1 and FCS_CKM.1 on FCS_CKM.6 (see discussion below). - 136 Details are provided in Table 13 below. - 137 Note that in order to avoid repetitions of the SFRs iterated in this Security Target, and improve readability, some are mentioned in a generic form in this table. Table 13. Dependencies of security functional requirements | Label | Dependencies | Fulfilled by security requirements in this Security Target | Dependency already in BSI-CC-PP-0084-2014 , in [PF-ST] or in [AUG] | |--------------------|------------------------|--------------------------------------------------------------|----------------------------------------------------------------------| | FRU_FLT.2 | FPT_FLS.1 | Yes | Yes, BSI-CC-PP-0084-2014 | | FPT_FLS.1 | None | No dependency | Yes, BSI-CC-PP-0084-2014 | | FMT_LIM.1 / Test | FMT_LIM.2 / Test | Yes | Yes, BSI-CC-PP-0084-2014 | | FMT_LIM.2 / Test | FMT_LIM.1 / Test | Yes | Yes, BSI-CC-PP-0084-2014 | | FMT_LIM.1 / Loader | FMT_LIM.2 / Loader | Yes | Yes, BSI-CC-PP-0084-2014 | | FMT_LIM.2 / Loader | FMT_LIM.1 / Loader | Yes | Yes, BSI-CC-PP-0084-2014 | | FMT_LIM.1 / Sdiag | FMT_LIM.2 / Sdiag | Yes | Yes, BSI-CC-PP-0084-2014 | | FMT_LIM.2 / Sdiag | FMT_LIM.1 / Sdiag | Yes | Yes, BSI-CC-PP-0084-2014 | | FAU_SAS.1 | None | No dependency | Yes, BSI-CC-PP-0084-2014 | | FDP_SDC.1 | None | No dependency | Yes, BSI-CC-PP-0084-2014 | | FDP_SDI.2 | None | No dependency | Yes, BSI-CC-PP-0084-2014 | | FPT_PHP.3 | None | No dependency | Yes, BSI-CC-PP-0084-2014 | | FDP_ITT.1 | FDP_ACC.1 or FDP_IFC.1 | Yes, by FDP_ACC.2 / Memories and FDP_IFC.1 | Yes, BSI-CC-PP-0084-2014 | | FPT_ITT.1 | None | No dependency | Yes, BSI-CC-PP-0084-2014 | 50/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security Table 13. Dependencies of security functional requirements (continued) | Label | Dependencies | Fulfilled by security requirements in this Security Target | Dependency already in BSI-CC-PP-0084-2014 , in [PF-ST] or in [AUG] | |----------------------|-----------------------------------------------------|--------------------------------------------------------------|----------------------------------------------------------------------| | FDP_IFC.1 | FDP_IFF.1 | No, see BSI-CC-PP- 0084-2014 | Yes, BSI-CC-PP-0084-2014 | | FCS_RNG.1 / PTG.2 | None | No dependency | Yes, BSI-CC-PP-0084-2014 | | FDP_SBO.1 | None | No dependency | No | | FCS_COP.1 | [FDP_ITC.1 or FDP_ITC.2 or FCS_CKM.1, or FCS_CKM.5] | Yes, by FCS_CKM.1, see discussion below | Yes, [AUG] #1 | | FCS_COP.1 | FCS_CKM.6 | No, see discussion below | Yes, [AUG] #1 | | FCS_CKM.1 | [FDP_CKM.2 or FCS_COP.1] | Yes, by FCS_COP.1 | Yes, [AUG] #1 | | FCS_CKM.1 | FCS_CKM.6 | No, see discussion below | Yes, [AUG] #1 | | FDP_ACC.1 / Memories | FDP_ACF.1 / Memories | Yes | Yes, [PF-ST] | | FDP_ACF.1 / Memories | FDP_ACC.1 / Memories | Yes, by FDP_ACC.1 / Memories | Yes, [PF-ST] | | FDP_ACF.1 / Memories | FMT_MSA.3 / Memories | Yes | Yes, [PF-ST] | | FMT_MSA.3 / Memories | FMT_MSA.1 / Memories | Yes | Yes, [PF-ST] | | FMT_MSA.3 / Memories | FMT_SMR.1 / Memories | No, see [AUG] #4 | Yes, [PF-ST] | | FMT_MSA.1 / Memories | [FDP_ACC.1 / Memories or FDP_IFC.1] | Yes, by FDP_ACC.1 / Memories and FDP_IFC.1 | Yes, [PF-ST] | | FMT_MSA.1 / Memories | FMT_SMF.1 / Memories | Yes | Yes, [PF-ST] | | FMT_MSA.1 / Memories | FMT_SMR.1 / Memories | No | Yes, [PF-ST] | | FMT_SMF.1 / Memories | None | No dependency | Yes, [PF-ST] | | FIA_API.1 | None | No dependency | Yes, BSI-CC-PP-0084-2014 | | FTP_ITC.1 / Loader | None | No dependency | Yes, BSI-CC-PP-0084-2014 | SMD_NL_PQML_02.1_ST33K_ST_25_002 51/76 Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - Table 13. Dependencies of security functional requirements (continued) | Label | Dependencies | Fulfilled by security requirements in this Security Target | Dependency already in BSI-CC-PP-0084-2014 , in [PF-ST] or in [AUG] | |--------------------|--------------------------------------------|--------------------------------------------------------------|----------------------------------------------------------------------| | FDP_UCT.1 / Loader | [FTP_ITC.1 / Loader or FTP_TRP.1 / Loader] | Yes, by FTP_ITC.1 / Loader | Yes, BSI-CC-PP-0084-2014 | | FDP_UCT.1 / Loader | [FDP_ACC.1 / Loader or FDP_IFC.1 / Loader] | Yes, by FDP_ACC.1 / Loader | Yes, BSI-CC-PP-0084-2014 | | FDP_UIT.1 / Loader | [FTP_ITC.1 / Loader or FTP_TRP.1 / Loader] | Yes, by FTP_ITC.1 / Loader | Yes, BSI-CC-PP-0084-2014 | | FDP_UIT.1 / Loader | [FDP_ACC.1 / Loader or FDP_IFC.1 / Loader] | Yes, by FDP_ACC.1 / Loader | Yes, BSI-CC-PP-0084-2014 | | FDP_ACC.1 / Loader | FDP_ACF.1 / Loader | Yes | Yes, [PF-ST] | | FDP_ACF.1 / Loader | FDP_ACC.1 / Loader | Yes | Yes, [PF-ST] | | FDP_ACF.1 / Loader | FMT_MSA.3 / Loader | Yes | Yes, [PF-ST] | | FMT_MSA.3 / Loader | FMT_MSA.1 / Loader | Yes | Yes, [PF-ST] | | FMT_MSA.3 / Loader | FMT_SMR.1 / Loader | Yes | Yes, [PF-ST] | | FMT_MSA.1 / Loader | [FDP_ACC.1 / Loader or FDP_IFC.1] | Yes | Yes, [PF-ST] | | FMT_MSA.1 / Loader | FDP_SMF.1 / Loader | Yes | Yes, [PF-ST] | | FMT_MSA.1 / Loader | FDP_SMR.1 / Loader | Yes | Yes, [PF-ST] | | FMT_SMR.1 / Loader | FIA_UID.1 / Loader | Yes | Yes, [PF-ST] | | FIA_UID.1 / Loader | None | No dependency | Yes, [PF-ST] | | FIA_UAU.1 / Loader | FIA_UID.1 / Loader | Yes | Yes, [PF-ST] | | FDP_SMF.1 / Loader | None | No dependency | Yes, [PF-ST] | | FPT_FLS.1 / Loader | None | No dependency | Yes, [PF-ST] | | FAU_SAS.1 / Loader | None | No dependency | Yes, BSI-CC-PP-0084-2014 | 52/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Security Table 13. Dependencies of security functional requirements (continued) | Label | Dependencies | Fulfilled by security requirements in this Security Target | Dependency already in BSI-CC-PP-0084-2014 , in [PF-ST] or in [AUG] | |--------------------|----------------|--------------------------------------------------------------|----------------------------------------------------------------------| | FAU_SAR.1 / Loader | FAU_GEN.1 | No, by FAU_SAS.1 / Loader instead, see discussion below | Yes, [PF-ST] | | FTP_ITC.1 / Sdiag | None | No dependency | Yes, [PF-ST] | | FAU_SAR.1 / Sdiag | FAU_GEN.1 | No, see discussion below | Yes, [PF-ST] | - 138 Part 2 of the Common Criteria defines the dependency of ' Cryptographic operation (FCS_COP.1)" on "Import of user data without security attributes (FDP_ITC.1)" or "Import of user data with security attributes (FDP_ITC.2)" or "Cryptographic key generation (FCS_CKM.1)". In this particular TOE, "Cryptographic key generation (FCS_CKM.1)" may be used for the purpose of creating cryptographic keys, but also, the ES has all possibilities to implement its own creation function, in conformance with its security policy. - 139 Part 2 of the Common Criteria defines the dependency of "Cryptographic operation (FCS_COP.1)" and "Cryptographic key generation (FCS_CKM.1)" on "Timing and event of cryptographic key destruction (FCS_CKM.6)". In this particular TOE, there is no specific function for the destruction of the keys. The ES has all possibilities to implement its own destruction function, in conformance with its security policy. Therefore, FCS_CKM.6 is not defined in this ST. #### 6.4.5 Rationale for the Assurance Requirements ####### Security assurance requirements added to reach EAL5 - 140 Regarding application note 22 of BSI-CC-PP-0084-2014 , this Security Target chooses EAL5 because developers and users require a high level of independently assured security in a planned development and require a rigorous development approach without incurring unreasonable costs attributable to specialist security engineering techniques. - 141 EAL5 represents a meaningful increase in assurance from EAL4 by requiring semiformal design descriptions, a more structured (and hence analyzable) architecture, extensive testing, and improved mechanisms and/or procedures that provide confidence that the TOE will not be tampered during development. - 142 The assurance components in an evaluation assurance level (EAL) are chosen in a way that they build a mutually supportive and complete set of components. The requirements chosen for augmentation do not add any dependencies, which are not already fulfilled for the corresponding requirements contained in EAL5. Therefore, these components add additional assurance to EAL5, but the mutual support of the requirements and the internal consistency is still guaranteed. - 143 The component ALC_FLR.2 is chosen as an augmentation in this ST because a solid flaw management is key for the continuous improvement of the TOE, especially on markets which need highly resistant and long lasting products. - 144 The composite product package (COMP) is chosen as an augmentation in this ST to provide assurance that the NesLib 6.11.6 on ST33K1M5C and ST33K1M5T B04 has been assembled and evaluated according to the relevant criteria defined in CCMB-2022-11-005 R1 . SMD_NL_PQML_02.1_ST33K_ST_25_002 53/76 ####### Security requirements (ASE_REQ)Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Securi - - 145 The Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition claims conformance to Common Criteria 2022 revision 1 and strict conformance to the BSICC-PP-0084-2014 Protection Profile. As the BSI-CC-PP-0084-2014 claims conformance to Common Criteria version 3.1 it does not contain 'Evaluation Methods / Evaluation Activities'. It explains there is no rationale in this Security Target for the disposition of such 'Evaluation Methods / Evaluation Activities' for the extended security assurance requirements. - 146 Note that detailed and updated refinements for assurance requirements are given in Section 6.3 . ####### Dependencies of assurance requirements - 147 Dependencies of security assurance requirements are fulfilled by the EAL5 package selection. - 148 The augmentation to this package identified in Section 6.2 does not introduce dependencies not already satisfied by the EAL5 package, and is considered as consistent augmentation: - ALC_DVS.2 and AVA_VAN.5 dependencies have been justified in BSI-CC-PP-00842014 , - ALC_FLR.2 has no dependency, - ASE_COMP.1 has no dependency, - ALC_COMP.1 has no dependency, - ADV_COMP.1 has no dependency, - ATE_COMP.1 has no dependency, - AVA_COMP.1 has no dependency. 54/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition TOE ## 7 TOE summary specification (ASE_TSS) - 149 This section demonstrates how the TOE meets each Security Functional Requirement, and includes a statement of compatibility vs. the Platform Security Target [PF-ST] . ### 7.1 TOE Security Functional Requirements realisation - 150 This section argues how the TOE meets each SFR. - 151 The TOE is evaluated as a composite TOE, made of the underlying hardware platform and the NesLib and NesLib-PQML cryptographic libraries on top of it. - 152 Consequently, the ST33K1M5C and ST33K1M5T C03 Security Target for composition details how all the platform SFRs are met, and in the following only the SFRs directly addressed by NesLib and NesLib-PQML are detailed. #### 7.1.1 Secure basic operation on data: Copy (FDP_SBO.1) / Copy - 153 The NesLib library provides to the ES developer secure copy functions from ROM, RAM or NVM memories to the RAM: - copy from a source memory buffer to a target buffer, protected against faults, - copy from a source memory buffer to a target buffer, protected against faults and side channel attacks. #### 7.1.2 Secure basic operation on data: Compare (FDP_SBO.1) / Compare - 154 The NesLib library provides to the ES developer secure compare functions, protected against faults and side channel attacks, in ROM, RAM or NVM memories: - compare a memory buffer to a constant, - compare two memory buffers. #### 7.1.3 Secure basic operation on data: Swap (FDP_SBO.1) / Swap - 155 The NesLib library provides to the ES developer a secure swap function, protected against faults and side channel attacks: - swap content of 2 buffers in RAM. #### 7.1.4 Secure basic operation on data: Shift (FDP_SBO.1) / Shift - 156 The NesLib library provides to the ES developer a secure shift function from ROM, RAM or NVM memories to the RAM, protected against faults and side channel attacks: - shift right or left content of a memory buffer. #### 7.1.5 Secure basic operation on data: XOR (FDP_SBO.1) / XOR - 157 The NesLib library provides to the ES developer a secure XOR function from ROM, RAM or NVM memories to the RAM, protected against faults and side channel attacks: - make a XOR from a source memory buffer to a target buffer. SMD_NL_PQML_02.1_ST33K_ST_25_002 55/76 TOE summary specification (ASE_TSS) Cryptographic Library NesLib-PQML 2.1 A01 on ST33K #### 7.1.6 Cryptographic operation: DES and Triple DES operation (FCS_COP.1) / SW-DES - 158 The cryptographic library NesLib provides to the ES developer the following DES functions, conformant to NIST SP 800-67 and NIST SP 800-38A with intrinsic counter-measures against attacks: - encryption and decryption with single-key DES, 2-key or 3-key Triple DES encryption in Cipher Block Chaining (CBC) mode, - single-key DES, 2-key and 3-key Triple DES block ciphers and their inverses, which can be used by the ES developer to implement other modes of operations for encryption (e.g., ECB, CFB, OFB, CTR), authentication, authenticated encryption or key derivation. - 159 For all these functions, NesLib uses the EDES+ accelerator certified in the Hardware Platform. - 160 Note that DES and triple DES with two keys are no longer recommended as encryption functions. Hence, Security IC Embedded Software may need to use triple DES with three keys to achieve a suitable strength until the end of year 2025. From 2026, it will not be recommended anymore to use DES and TDES. #### 7.1.7 Cryptographic operation: AES operation (FCS_COP.1) / SW-AES The cryptographic library NesLib provides to the ES developer the following AES functions for key sizes of 128, 192 and 256 bits, conformant to FIPS 197, NIST SP 800-38A , NIST SP 800-38B , NIST SP 800-38C, and NIST SP 800-38D with intrinsic counter-measures against attacks: - encryption and decryption with AES in Cipher Block Chaining (CBC) mode, - authentication with AES in CMAC mode, - authenticated encryption with AES in Galois Counter Mode (GCM) and its associated verification and decryption mechanism, - authenticated encryption with AES in Counter with CBC-MAC Mode (CCM) and its associated verification and decryption mechanism, - the AES-128, AES-192, AES-256 block ciphers and their inverses as a toolbox suitable for the ES to implement other modes such as encryption modes (e.g., ECB, CFB, OFB, CTR), authentication modes, authenticated encryption or key derivation modes. - 161 For all these functions, NesLib uses the AES accelerator certified in the Hardware Platform. #### 7.1.8 Cryptographic operation: RSA operation (FCS_COP.1) / RSA - 162 The cryptographic library NesLib provides to the ES developer the following RSA functions, all conformant to PKCS #1 V2.1 : - RSA public key cryptographic operation for modulus sizes from 829 bits up to 4096 bits, - RSA private key cryptographic operation with or without CRT for modulus sizes from 896 up to 4096 bits, - RSA signature formatting, - RSA Key Encapsulation Method. - 163 For these functions, NesLib uses the Cryptography Accelerator (Nescrypt) of the Hardware Platform. 56/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition TOE #### 7.1.9 Cryptographic operation: Elliptic Curves Cryptography operation (FCS_COP.1) / ECC-WC 164 The cryptographic library NesLib provides to the ES developer the following efficient basic functions for Elliptic Curves Cryptography over prime fields on curves in Weierstrass form, all conformant to IEEE 1363-2000 and IEEE 1363a-2004 , including: - private scalar multiplication, - preparation of Elliptic Curve computations in affine coordinates, - public scalar multiplication, - joint public scalar multiplication, - point validity check, - Jacobian conversion to affine coordinates, - general point addition, - point expansion and compression. - 165 Additionally, the cryptographic library NesLib provides functions dedicated to the two most used elliptic curves cryptosystems: - Elliptic Curve Diffie-Hellman (ECDH), as specified in NIST SP 800-56A , - Elliptic Curve Digital Signature Algorithm (ECDSA) generation and verification, as stipulated in FIPS 186-5 and specified in ANSI X9.62 , section 7. - 166 For these functions, NesLib uses the Cryptography Accelerator (Nescrypt) of the Hardware Platform. #### 7.1.10 Cryptographic operation: Elliptic Curves Cryptography operation (FCS_COP.1) / ECC-EC - 167 The cryptographic library NesLib provides to the ES developer the following efficient basic functions for Elliptic Curves Cryptography over prime fields on curves in Edwards form, with curve Ed25519 and curve Ed448, all conformant to RFC 8032 , including: - generation (with ephemeral key in vanilla, context or prehash flavour), - verification, - point decompression, - scalar multiplication. - 168 For these functions, NesLib uses the Cryptography Accelerator (Nescrypt) of the Hardware Platform. #### 7.1.11 Cryptographic operation: Elliptic Curves Cryptography operation (FCS_COP.1) / ECC-MC - 169 The cryptographic library NesLib provides to the ES developer functions implementing: - the X25519 primitive as specified by RFC 7748 , for key agreement using curve curve25519. - the X448 primitive as specified by RFC 7748 , for key agreement using curve Curve448. - 170 For these functions, NesLib uses the Cryptography Accelerator (Nescrypt) of the Hardware Platform. SMD_NL_PQML_02.1_ST33K_ST_25_002 57/76 TOE summary specification (ASE_TSS) Cryptographic Library NesLib-PQML 2.1 A01 on ST33K #### 7.1.12 Cryptographic operation: SHA-1 & SHA-2 operation (FCS_COP.1) / SHA - 171 The cryptographic library NesLib provides the SHA-1, SHA-224, SHA-256, SHA-384, SHA512 secure hash functions conformant to FIPS 180-4 . - 172 The cryptographic library NesLib provides the SHA-1, SHA-256, SHA-384, SHA-512 secure hash functions conformant to FIPS 180-4 , and offering resistance against side channel and fault attacks. - 173 Additionally, the cryptographic library NesLib offers support for the HMAC mode of use, as specified in FIPS 198-1 , to be used in conjunction with the protected versions of SHA-1, SHA-256, SHA-384, and SHA-512. #### 7.1.13 Cryptographic operation: Keccak & SHA-3 operation (FCS_COP.1) / Keccak - 174 The cryptographic library NesLib provides the operation of the following extendable output functions conformant to FIPS 202 : - SHAKE128, - SHAKE256, - Keccak[r,c] with choice of r < 1600 and c = 1600 - r. - 175 The cryptographic library NesLib provides the operation of the following hash functions, conformant to FIPS 202 : - SHA3-224, - SHA3-256, - SHA3-384, - SHA3-512. - 176 The cryptographic library NesLib provides the operation of the following extendable output functions conformant to FIPS 202 , offering resistance against side channel and fault attacks: - SHAKE128, - SHAKE256, - Keccak[r,c] with choice of r < 1600 and c = 1600 - r. - 177 The cryptographic library NesLib provides the operation of the following hash functions, conformant to FIPS 202 , offering resistance against side channel and fault attacks: - SHA3-224, - SHA3-256, - SHA3-384, - SHA3-512. 58/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition TOE #### 7.1.14 Cryptographic operation: Keccak-p operation (FCS_COP.1) / Keccak-p 178 The cryptographic library NesLib provides a toolbox for building modes on top of the following permutations, conformant to FIPS 202 : - Keccak-p[1600,n_r = 24], - Keccak-p[1600,n_r = 12]. - The cryptographic library NesLib provides a toolbox for building modes on top of the following permutations, conformant to FIPS 202 , offering resistance against side channel and fault attacks: - Keccak-p[1600,n_r = 24], - Keccak-p[1600,n_r = 12]. #### 7.1.15 Cryptographic operation: Diffie-Hellman operation (FCS_COP.1) / Diffie-Hellman - 179 The cryptographic library NesLib provides the Diffie-Hellman key establishment operation over GF(p) for size of modulus p up to 4096 bits, conformant to ANSI X9.42 . - 180 For these functions, NesLib uses the Cryptography Accelerator (Nescrypt) of the Hardware Platform. #### 7.1.16 Cryptographic operation: LMS signature verification (FCS_COP.1) / SFH-DSA 181 The cryptographic library NesLib provides the verification of LMS signatures based on SHA256, conformant to NIST SP 800-208 , with parameters: - LMOTS_SHA256_N32_W4 and, - LMS_SHA256_M32_H10. #### 7.1.17 Cryptographic operation: ML-KEM operation (FCS_COP.1) / ML-KEM 182 The cryptographic library NesLib-PQML provides the ML-KEM encapsulation and decapsulation methods conformant to FIPS-203 sections 6.2 and 6.3 with parameters: - ML-KEM-512 - ML-KEM-768 - ML-KEM-1024 - 183 with resistance against side channel and fault attacks . #### 7.1.18 Cryptographic operation: ML-DSA operation (FCS_COP.1) / ML-DSA 184 The cryptographic library NesLib-PQML provides the ML-DSA signature and verification algorithms conformant to FIPS-204 sections 6.2 and 6.3 with parameters: - ML-DSA-44 - ML-DSA-65 - ML-DSA-87 185 with resistance against side channel and fault attacks . SMD_NL_PQML_02.1_ST33K_ST_25_002 59/76 TOE summary specification (ASE_TSS) Cryptographic Library NesLib-PQML 2.1 A01 on ST33K #### 7.1.19 Cryptographic operation: DRBG operation (FCS_COP.1) / DRBG - 186 The cryptographic library NesLib gives support for a DRBG generator, based on cryptographic algorithms specified in NIST SP 800-90A . - 187 The cryptographic library NesLib implements two of the DRBG specified in NIST SP 80090A : - Hash-DRBG, - CTR-DRBG. #### 7.1.20 Cryptographic key generation: Prime generation (FCS_CKM.1) / Primegeneration - 188 The cryptographic library NesLib provides prime numbers generation for prime sizes up to 2048 bits conformant to FIPS 140-3 and FIPS 186-5 , optionally with conditions and/or optionally offering resistance against side channel and fault attacks . #### 7.1.21 Cryptographic key generation: RSA key generation (FCS_CKM.1) / RSA-key-generation - 189 The cryptographic library NesLib provides standard RSA public and private key computation for key sizes from 829 bits up to 4096 bits conformant to FIPS 140-3, ISO/IEC 9796-2 and PKCS #1 V2.1 , optionally with conditions and/or optionally offering resistance against side channel and fault attacks . #### 7.1.22 Cryptographic key generation: ML-KEM key generation (FCS_CKM.1) / ML-KEM-key-generation - 190 The cryptographic library NesLib-PQML provides standard ML-KEM key generation method conformant to FIPS-203 section 6.1 offering resistance against side channel and fault attacks . #### 7.1.23 Cryptographic key generation: ML-DSA key generation (FCS_CKM.1) / ML-DSA-key-generation - 191 The cryptographic library NesLib-PQML provides standard ML-DSA key generation method conformant to FIPS-204 section 6.1 offering resistance against side channel and fault attacks . #### 7.1.24 Limited fault tolerance (FRU_FLT.2) - 192 The TSF provides limited fault tolerance, by managing faults or errors related to cryptographic operations, thus preventing risk of malfunction. #### 7.1.25 Failure with preservation of secure state (FPT_FLS.1) - 193 The TSF provides preservation of secure state by generating a software reset, managed by the Platform, in case of detected fault attack on the crypto library. 60/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition TOE #### 7.1.26 Basic internal transfer protection (FDP_ITT.1), Basic internal TSF data transfer protection (FPT_ITT.1) & Subset information flow control (FDP_IFC.1) - 194 The TSF prevents the disclosure of internal and user data thanks to leakage protection. ### 7.2 Statement of compatibility - 195 This section details the statement of compatibility between this Security Target and the Platform Security Target [PF-ST] . - 196 The following mappings regarding SFRs, objectives and assurance requirements demonstrate that there is no inconsistency between this composite Security Target and the ST33K1M5C and ST33K1M5T C03 Security Target for composition . #### 7.2.1 Compatibility of security objectives - 197 There is no conflict between the security objectives of this Security Target and those of the Platform Security Target [PF-ST] : Table 14. Platform Security Objectives vs. TOE Security Objectives | Platform Security Objectives | TOE Security Objectives | |--------------------------------|-----------------------------------------------| | BSI.O.Leak-Inherent | BSI.O.Leak-Inherent | | BSI.O.Phys-Probing | BSI.O.Phys-Probing | | BSI.O.Malfunction | BSI.O.Malfunction | | BSI.O.Phys-Manipulation | BSI.O.Phys-Manipulation | | BSI.O.Leak-Forced | BSI.O.Leak-Forced | | BSI.O.Abuse-Func | BSI.O.Abuse-Func | | BSI.O.Identification | BSI.O.Identification | | BSI.O.RND | BSI.O.RND | | BSI.O.Authentication | BSI.O.Authentication | | BSI.O.Cap-Avail-Loader | BSI.O.Cap-Avail-Loader | | BSI.O.Ctrl-Auth-Loader | BSI.O.Ctrl-Auth-Loader | | JIL.O.Prot-TSF-Confidentiality | JIL.O.Prot-TSF-Confidentiality | | JIL.O.Secure-Load-ACode | JIL.O.Secure-Load-ACode | | JIL.O.Secure-AC-Activation | JIL.O.Secure-AC-Activation | | JIL.O.TOE-Identification | JIL.O.TOE-Identification | | O.Secure-Load-AMemImage | O.Secure-Load-AMemImage | | O.MemImage-Identification | O.MemImage-Identification | | AUG1.O.Add-Functions | AUG1.O.Add-Functions AUG1.O.Add-Functions-Lib | SMD_NL_PQML_02.1_ST33K_ST_25_002 61/76 TOE summary specification (ASE_TSS) Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Table 14. Platform Security Objectives vs. TOE Security Objectives | Platform Security Objectives | TOE Security Objectives | |--------------------------------|---------------------------| | AUG4.O.Mem-Access | AUG4.O.Mem-Access | | O.Firewall | O.Firewall | 198 There is no conflict between the security objectives for the environment of this Security Target and those of the Platform Security Target [PF-ST] : Table 15. Platform Security Objectives for the Environment vs. TOE Security Objectives for the Environment | Platform Security Objectives for the Environment | TOE Security Objectives for the Environment | |----------------------------------------------------|-----------------------------------------------| | BSI.OE.Resp-Appl | BSI.OE.Resp-Appl | | BSI.OE.Process-Sec-IC | BSI.OE.Process-Sec-IC | | BSI.OE.Lim-Block-Loader | BSI.OE.Lim-Block-Loader | | BSI.OE.Loader-Usage | BSI.OE.Loader-Usage | | BSI.OE.TOE-Auth | BSI.OE.TOE-Auth | | OE.Enable-Disable-Secure-Diag | OE.Enable-Disable-Secure-Diag | | OE.Secure-Diag-Usage | OE.Secure-Diag-Usage | | OE.Composite-TOE-Id | OE.Composite-TOE-Id | | OE.TOE-Id | OE.TOE-Id | #### 7.2.2 Compatibility of Security Functional Requirements 199 All platform SFRs are relevant for this Composite ST. 200 The Composite ST SFRs do not show any conflict with the platform SFRs. 201 The following platform SFRs are used by this Composite ST because of their security properties providing protection against attacks to the TOE as a whole: - FRU_FLT.2, - FDP_SDC.1, - FDP_SDI.2, - FPT_PHP.3, - FDP_ITT.1, - FPT_ITT.1, - FDP_IFC.1. 202 Complementary, the Table 16 below shows the mapping between the Platform SFRs specifically used to implement a security service and security mechanisms by SFRs of this Composite ST. 62/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition TOE Table 16. Platform Security Functional Requirements vs. TOE Security Functional Requirements | Platform SFR | Composite ST SFRs | |------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | FRU_FLT.2 | FRU_FLT.2 | | FPT_FLS.1 | FPT_FLS.1 FDP_SBO.1 / Copy FDP_SBO.1 / Compare FDP_SBO.1 / Swap FDP_SBO.1 / Shift FCS_COP.1 / SW-DES FCS_COP.1 / SW-AES FCS_COP.1 / RSA FCS_COP.1 / ECC-WC FCS_COP.1 / ECC-EC FCS_COP.1 / ECC-MC FCS_COP.1 / SHA FCS_COP.1 / Keccak FCS_COP.1 / Keccak-p FCS_COP.1 / Diffie-Hellman FCS_COP.1 / SFH-DSA FCS_COP.1 / ML-KEM FCS_COP.1 / ML-DSA FCS_COP.1 / DRBG FCS_CKM.1 / Prime-generation FCS_CKM.1 / RSA-key-generation FCS_CKM.1 / ML-KEM-key-generation FCS_CKM.1 / ML-DSA-key-generation | | FMT_LIM.1 / Test | FMT_LIM.1 / Test | | FMT_LIM.2 / Test | FMT_LIM.2 / Test | | FAU_SAS.1 | FAU_SAS.1 | | FDP_SDC.1 | FDP_SDC.1 | | FDP_SDI.2 | FDP_SDI.2 | | FPT_PHP.3 | FPT_PHP.3 | | FDP_ITT.1 | FDP_ITT.1 FCS_COP.1 / SW-DES FCS_COP.1 / SW-AES | | FPT_ITT.1 | FPT_ITT.1 FCS_COP.1 / SW-DES FCS_COP.1 / SW-AES | SMD_NL_PQML_02.1_ST33K_ST_25_002 63/76 TOE summary specification (ASE_TSS) Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Table 16. Platform Security Functional Requirements vs. TOE Security Functional Requirements (continued) | Platform SFR | Composite ST SFRs | |----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | FDP_IFC.1 | FDP_IFC.1 FCS_COP.1 / SW-DES FCS_COP.1 / SW-AES | | FCS_RNG.1 / PTG.2 | FCS_RNG.1 / PTG.2 FCS_COP.1 / SW-DES FCS_COP.1 / SW-AES FCS_COP.1 / RSA FCS_COP.1 / ECC-WC FCS_COP.1 / ECC-EC FCS_COP.1 / ECC-MC FCS_COP.1 / SHA FCS_COP.1 / Keccak FCS_COP.1 / Keccak-p FCS_COP.1 / Diffie-Hellman FCS_COP.1 / SFH-DSA FCS_COP.1 / ML-KEM FCS_COP.1 / ML-DSA FCS_COP.1 / DRBG FCS_CKM.1 / Prime-generation FCS_CKM.1 / RSA-key-generation FCS_CKM.1 / ML-KEM-key-generation | | FCS_COP.1 / TDES | FCS_CKM.1 / ML-DSA-key-generation FCS_COP.1 / TDES FCS_COP.1 / SW-DES | | FCS_COP.1 / AES | FCS_COP.1 / AES FCS_COP.1 / SW-AES FCS_COP.1 / DRBG | | FDP_ACC.2 / Memories | FDP_ACC.2 / Memories | | FDP_ACF.1 / Memories | FDP_ACF.1 / Memories | | FMT_MSA.3 / Memories | FMT_MSA.3 / Memories | | FMT_MSA.1 / Memories | FMT_MSA.1 / Memories | | FMT_SMF.1 / Memories | FMT_SMF.1 / Memories | | FIA_API.1 | FIA_API.1 | | FMT_LIM.1 / Loader | FMT_LIM.1 / Loader | | FMT_LIM.2 / Loader | FMT_LIM.2 / Loader | | FTP_ITC.1 / Loader | FTP_ITC.1 / Loader | | FDP_UCT.1 / Loader | FDP_UCT.1 / Loader | 64/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition TOE Table 16. Platform Security Functional Requirements vs. TOE Security Functional Requirements (continued) | Platform SFR | Composite ST SFRs | |--------------------|---------------------| | FDP_UIT.1 / Loader | FDP_UIT.1 / Loader | | FDP_ACC.1 / Loader | FDP_ACC.1 / Loader | | FDP_ACF.1 / Loader | FDP_ACF.1 / Loader | | FMT_MSA.3 / Loader | FMT_MSA.3 / Loader | | FMT_MSA.1 / Loader | FMT_MSA.1 / Loader | | FMT_SMR.1 / Loader | FMT_SMR.1 / Loader | | FIA_UID.1 / Loader | FIA_UID.1 / Loader | | FIA_UAU.1 / Loader | FIA_UAU.1 / Loader | | FMT_SMF.1 / Loader | FMT_SMF.1 / Loader | | FPT_FLS.1 / Loader | FPT_FLS.1 / Loader | | FAU_SAR.1 / Loader | FAU_SAR.1 / Loader | | FAU_SAS.1 / Loader | FAU_SAS.1 / Loader | | FTP_ITC.1 / Sdiag | FTP_ITC.1 / Sdiag | | FAU_SAR.1 / Sdiag | FAU_SAR.1 / Sdiag | | FMT_LIM.1 / Sdiag | FMT_LIM.1 / Sdiag | | FMT_LIM.2 / Sdiag | FMT_LIM.2 / Sdiag | #### 7.2.3 Compatibility of Security Assurance Requirements - 203 The level of assurance of the TOE is EAL5 augmented with ALC_DVS.2, AVA_VAN.5 and ALC_FLR.2, and the composite product package (COMP) while the level of assurance of the Platform is EAL6 augmented with ALC_FLR.2. - 204 Therefore, the set of Security Assurance Requirements of this composite evaluation represents a strict subset of the Security Assurance Requirements of the underlying platform. The composite product package (COMP) being dedicated to the composite evaluation it does not contradict the previous sentence. 205 There is no conflict regarding the Security Assurance Requirements. SMD_NL_PQML_02.1_ST33K_ST_25_002 65/76 IdentificationCryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composi - ## 8 Identification Table 17. TOE components | Platform identification - IC Maskset name | Platform identification - Master identification number | Platform identification - IC version | Platform identification - Firmware version | Library identification - NesLib cryptographic library version | Library identification - NesLib-PQML cryptographic library version | |---------------------------------------------|----------------------------------------------------------|----------------------------------------|----------------------------------------------|-----------------------------------------------------------------|----------------------------------------------------------------------| | K460 | 0x0227 and 0x0247 | B | 3.1.3 | 6.11.6 | 2.1.3 | | K460 | 0x0227 and 0x0247 | C | 3.1.4 | 6.11.6 | 2.1.3 | | K4A0 | 0x0227 and 0x0247 | D | 3.1.4 | 6.11.6 | 2.1.3 | Table 18. Guidance documentation | Component description | Reference | Version | |------------------------------------------------------------------------------------------|--------------------------------|-----------| | Cryptographic library NesLib 6.11 - User manual | UM_NesLib_6.11 | 2 | | ST33K Secure MCU platforms NesLib 6.11 security recommendations - Application note | AN_SECU_ST33K_NESLI B_6.11 | 1 | | NesLib 6.11.6 for ST33K Platforms - Release note | RN_ST33K_NESLIB_6.11.6 | 2 | | NesLib PQML 2.1 - User manual | UM_NesLib_PQML_2.1 | 1 | | ST33K secure MCU platforms - NesLib-PQML 2.1 security recommendations - Application note | AN_SECU_ST33K_NESLI B_PQML_2.1 | 1 | | NesLib-PQML 2.1.3 for ST33K platforms - Release note | RN_ST33K_NESLIB_PQM L_2.1.3 | 1 | Table 19. Sites list | Site | Address | Activities (1) | |-------------|---------------------------------------------------------------------------------------------|------------------| | ST Grenoble | STMicroelectronics 12 rue Jules Horowitz, BP 217 38019 Grenoble Cedex France | ES_DEV | | ST Rousset | STMicroelectronics 190 Avenue Célestin Coq ZI de Rousset-Peynier 13106 Rousset Cedex France | ES_DEV | 66/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for compositionIdentifica - Table 19. Sites list (continued) | Site | Address | Activities (1) | |-------------|------------------------------------------------------------------------------------------------------------|------------------| | ST Tunis | STMicroelectronics Elgazala Technopark, Raoued, Gouvernorat de l'Ariana, PB21, 2088 cedex, Ariana, Tunisia | IT | | ST Zaventem | STMicroelectronics Green Square, Lambroekstraat 5, Building B 3d floor 1831 Diegem/Machelen Belgium | ES_DEV | SMD_NL_PQML_02.1_ST33K_ST_25_002 67/76 References Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composi - ## 9 References Table 20. Common Criteria | Component description | Reference | Version | |---------------------------------------------------------------------------------------------------------------------------------------|---------------------|-------------| | Common Criteria for Information Technology Security Evaluation - Part 2: Security functional components, April 2017 | CCMB-2017-04-002 R5 | 3.1 Rev 5 | | Common Criteria for Information Technology Security Evaluation - Part 1: Introduction and general model, November 2022 | CCMB-2022-11-001 R1 | 2022 Rev 1 | | Common Criteria for Information Technology Security Evaluation - Part 2: Security functional components, November 2022 | CCMB-2022-11-002 R1 | 2022 Rev 1 | | Common Criteria for Information Technology Security Evaluation - Part 3: Security assurance components, November 2022 | CCMB-2022-11-003 R1 | 2022 Rev 1 | | Common Criteria for Information Technology Security Evaluation - Part 5: Pre-defined packages of security requirements, November 2022 | CCMB-2022-11-005 R1 | 2022 Rev 1 | | Errata and Interpretation for CC:2022 (Release 1) and CEM:2022 (Release 1), 15th October 2025 | Reference 001 | version 1.2 | ### Table 21. Platform Security Target | Ref | Component description | Reference | Version | |---------|-------------------------------------------------------------|-------------------------|-----------| | [PF-ST] | ST33K1M5C and ST33K1M5T C03 Security Target for composition | SMD_ST33K1M5_ST_21 _002 | C03.0 | ### Table 22. Protection Profile and other related standards | Ref | Component description | Reference | Version | |----------|---------------------------------------------------------------------------------------------------|---------------------|-----------| | [PP0084] | Eurosmart - Security IC Platform Protection Profile with Augmentation Packages | BSI-CC-PP-0084-2014 | 1.0 | | [AUG] | Smartcard Integrated Circuit Platform Augmentations, March 2002. | | 1.0 | | [JILSR] | Security requirements for post-delivery code loading, Joint Interpretation Library, February 2016 | | 1.0 | 68/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for compositionReferenc - Table 23. Other standards | Ref | Identifier | Description | |-------|-----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [1] | BSI-AIS20/AIS31 | A proposal for: Functionality classes for random number generators, W. Killmann & W. Schindler BSI, Version 2.0, 18-09-2011 | | [2] | NIST SP 800-90B | NIST special publication 800-90B, Recommendation for the Entropy Sources Used for Random Bit Generation, National Institute of Standards and Technology (NIST), January 2018 | | [3] | NIST SP 800-67 | NIST SP 800-67, Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher, revised November 2017, National Institute of Standards and Technology | | [4] | FIPS 180-4 | FIPS 180-4 Secure Hash Standard, National Institute of Standards and Technology (NIST), August 2015 | | [5] | FIPS 186-5 | FIPS 186-5, Digital Signature Standard (DSS), National Institute of Standards and Technology (NIST), February 2023 | | [6] | FIPS 197 | FIPS 197, Advanced Encryption Standard (AES), National Institute of Standards and Technology (NIST), updated May 2023 | | [7] | ISO/IEC 9796-2 | ISO/IEC 9796, Information technology - Security techniques - Digital signature scheme giving message recovery - Part 2: Integer factorization based mechanisms, ISO, 2002 | | [8] | NIST SP 800-38A | NIST SP 800-38A: Recommendation for Block Cipher Modes of Operation, 2001, with Addendum Recommendation for Block Cipher Modes of Operation: Three Variants of Ciphertext Stealing for CBC Mode, October 2010 | | [9] | NIST SP 800-38B | NIST special publication 800-38B: Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication, National Institute of Standards and Technology (NIST), June 2016 | | [10] | NIST SP 800-38C | NIST special publication 800-38C: Recommendation for Block Cipher Modes of Operation: The CCM Mode for Authentication and Confidentiality, National Institute of Standards and Technology (NIST), July 2007 | | [11] | NIST SP 800-38D | NIST special publication 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter mode (GCM) and GMAC, National Institute of Standards and Technology (NIST), November 2007 | | [12] | ISO/IEC 14888 | ISO/IEC 14888, Information technology - Security techniques - Digital signatures with appendix - Part 1: General (1998), Part 2: Identity-based mechanisms (1999), Part 3: Certificate based mechanisms (2006), ISO | | [13] | IEEE 1363-2000 | IEEE 1363-2000, Standard Specifications for Public Key Cryptography, IEEE, January 2000 | | [14] | IEEE 1363a-2004 | IEEE 1363a-2004, Standard Specifications for Public Key Cryptography - Amendment 1:Additional techniques, IEEE, 2004 | | [15] | PKCS #1 V2.1 | PKCS #1 V2.1 RSA Cryptography Standard, RSA Laboratories, June 2002 | SMD_NL_PQML_02.1_ST33K_ST_25_002 69/76 References Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composi - Table 23. Other standards | Ref | Identifier | Description | |-------|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [16] | MOV 97 | Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone, Handbook of Applied Cryptography, CRC Press, 1997 | | [17] | NIST SP 800-90A | NIST Special Publication 800-90A rev. 1: Recommendation for random number generation using deterministic random bit generators (Revised), National Institute of Standards and Technology (NIST), June 2015 | | [18] | FIPS 198-1 | FIPS 198-1, The Keyed-Hash Message Authentication Code (HMAC), National Institute of Standards and Technology (NIST), July 2008 | | [19] | NIST SP 800-56A | NIST SP 800-56A Revision 3: Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography, National Institute of Standards and Technology (NIST), April 2018 | | [20] | NIST SP 800-208 | NIST SP 800-208 Recommendation for Stateful Hash-Based Signature Schemes (NIST), October 2020 | | [21] | ANSI X9.31 | ANSI X9.31, Digital Signature Using Reversible Public Key Cryptography for the Financial Services Industry (rDSA), American National Standard for Financial Services, 1998 | | [22] | ANSI X9.42 | ANSI X9.42, Public Key Cryptography for the Financial Services Industry: Agreement of Symmetric Keys Using Discrete Logarithm Cryptography, American National Standard for Financial Services, 2003 (R2013) | | [23] | ANSI X9.62 | ANSI X9.62, Public Key Cryptography for the Financial Services Industry, The Elliptic Curve Digital Signature Algorithm (ECDSA), American National Standard for Financial Services, 2005 | | [24] | FIPS 202 | FIPS 202, SHA-3 Standard: Permutation-Based Hash and Extendable- Output Functions, National Institute of Standards and Technology (NIST), August 2015 | | [25] | RFC 8032 | S. Josefsson and I. Liusvaara, Edwards-Curve Digital Signature Algorithm (EdDSA), Internet Research Task Force (IRTF) RFC 8032, January 2017 | | [26] | RFC 7748 | A. Langley, M. Hamburg, S. Turner, Elliptic Curves for Security, Internet Research Task Force (IRTF) RFC 7748, January 2016 | | [27] | ANSSI-PP0084.03 | PP0084: Interpretations, ANSSI, April 2016 | | [28] | FIPS 140-3 | FIPS 140-3, Security Requirements for Cryptographic Modules, National Institute of Standards and Technology (NIST), March 2019 | | [29] | FIPS-203 | FIPS-203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, National Institute of Standards and Technology (NIST), August 2024 | | [30] | FIPS-204 | FIPS-204, Module-Lattice-Based Digital Signature Standard, National Institute of Standards and Technology (NIST), August 2024 | 70/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for compositionReferenc - Table 23. Other standards | Ref | Identifier | Description | |-------|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [31] | ECCG ACM | Agreed Cryptographic Mechanisms, European Cybersecurity Certification Group - Sub-group on Cryptography, Version 2.0, April 2025. | | [32] | ANSSI-PG-083 | Guide des mécanismes cryptographiques: Règles et recommendations concernant le choix et le dimensionnement des mécanismes cryptographiques. ANSSI, version 2.0.4, January 2020. | SMD_NL_PQML_02.1_ST33K_ST_25_002 71/76 Glossary Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition ## Appendix A Glossary ### A.1 Terms ####### Authorised user A user who may, in accordance with the TSP, perform an operation. #### Composite product Security IC product which includes the Security Integrated Circuit (i.e. the TOE) and the Embedded Software and is evaluated as composite target of evaluation. ####### End-consumer User of the Composite Product in Phase 7. ####### Integrated Circuit (IC) Electronic component(s) designed to perform processing and/or memory functions. ####### IC Dedicated Software IC proprietary software embedded in a Security IC (also known as IC firmware) and developed by ST . Such software is required for testing purpose (IC Dedicated Test Software) but may provide additional services to facilitate usage of the hardware and/or to provide additional services (IC Dedicated Support Software). ####### IC Dedicated Test Software That part of the IC Dedicated Software which is used to test the TOE before TOE Delivery but which does not provide any functionality thereafter. ####### IC developer Institution (or its agent) responsible for the IC development. ####### IC manufacturer Institution (or its agent) responsible for the IC manufacturing, testing, and prepersonalization. ####### IC packaging manufacturer Institution (or its agent) responsible for the IC packaging and testing. ####### Initialisation data Initialisation Data defined by the TOE Manufacturer to identify the TOE and to keep track of the Security IC's production and further life-cycle phases are considered as belonging to the TSF data. These data are for instance used for traceability and for TOE identification (identification data) ### Object An entity within the TSC that contains or receives information and upon which subjects perform operations. ####### Packaged IC Security IC embedded in a physical package such as micromodules, DIPs, SOICs or TQFPs. ####### Pre-personalization data Any data supplied by the Card Manufacturer that is injected into the non-volatile memory by the Integrated Circuits manufacturer (Phase 3). These data are for instance used for traceability and/or to secure shipment between phases. If "Package 2: Loader dedicated for usage by authorized users only" is used the Pre-personalisation Data may contain the authentication reference data or key material for the trusted channel between the TOE and the authorized users using the Loader. 72/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Glossary ####### Secret Information that must be known only to authorised users and/or the TSF in order to enforce a specific SFP. #### Security IC Composition of the TOE, the Security IC Embedded Software, User Data, and the package. ####### Security IC Embedded SoftWare (ES) Software embedded in the Security IC and not developed by the IC designer. The Security IC Embedded Software is designed in Phase 1 and embedded into the Security IC in Phase 3. ####### Security IC embedded software (ES) developer Institution (or its agent) responsible for the security IC embedded software development and the specification of IC pre-personalization requirements, if any. ####### Security attribute Information associated with subjects, users and/or objects that is used for the enforcement of the TSP. ####### Sensitive information Any information identified as a security relevant element of the TOE such as: - the application data of the TOE (such as IC pre-personalization requirements, IC and system specific data), - the security IC embedded software, - the IC dedicated software, - the IC specification, design, development tools and technology. ####### Smartcard A card according to ISO 7816 requirements which has a non volatile memory and a processing unit embedded within it. ####### Subject An entity within the TSC that causes operations to be performed. ####### Test features All features and functions (implemented by the IC Dedicated Software and/or hardware) which are designed to be used before TOE Delivery only and delivered as part of the TOE. ####### TOE Delivery The period when the TOE is delivered which is after Phase 3 or Phase 1 in this Security target . ####### TSF data Data created by and for the TOE, that might affect the operation of the TOE. ####### User Any entity (human user or external IT entity) outside the TOE that interacts with the TOE. ####### User data All data managed by the Smartcard Embedded Software in the application context. User data comprise all data in the final Smartcard IC except the TSF data. SMD_NL_PQML_02.1_ST33K_ST_25_002 73/76 Glossary Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition ### A.2 Abbreviations Table 24. List of abbreviations | Term | Meaning | |----------|------------------------------------------------------------| | AIS | Application notes and Interpretation of the Scheme (BSI). | | BSI | Bundesamt für Sicherheit in der Informationstechnik. | | CBC | Cipher Block Chaining. | | CC | Common Criteria Version 3.1. R5. | | CFB | Cipher FeedBack. | | CTR | Counter | | DES | Data Encryption Standard. | | DRBG | Deterministic Random Bit Generator. | | EAL | Evaluation Assurance Level. | | ECB | Electronic Code Book. | | EDES | Enhanced DES. | | ES | Security IC Embedded Software. | | ES_DEV | Embedded Software Development. | | FIPS | Federal Information Processing Standard. | | IC | Integrated Circuit. | | ISO | International Standards Organisation. | | IT | Information Technology. | | NESCRYPT | Next Step Cryptography Accelerator. | | NIST | National Institute of Standards and Technology. | | NVM | Non Volatile Memory. | | OFB | Output FeedBack | | OSP | Organisational Security Policy. | | PP | Protection Profile. | | PUB | Publication Series. | | RAM | Random Access Memory. | | ROM | Read Only Memory. | | RSA | Rivest, Shamir & Adleman. | | SAR | Security Assurance Requirement. | | SFP | Security Function Policy. | | SFR | Security Functional Requirement. | | ST | Context dependent : STMicroelectronics or Security Target. | 74/76 SMD_NL_PQML_02.1_ST33K_ST_25_002 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition Glossary Table 24. List of abbreviations (continued) | Term | Meaning | |--------|---------------------------------| | TDES | Triple Data Encryption Standard | | TOE | Target of Evaluation. | | TRNG | True Random Number Generator. | | TSC | TSF Scope of Control. | | TSF | TOE Security Functionality. | | TSFI | TSF Interface. | | TSP | TOE Security Policy. | | TSS | TOE Summary Specification. | SMD_NL_PQML_02.1_ST33K_ST_25_002 75/76 Cryptographic Library NesLib-PQML 2.1 A01 on ST33K Security Target for composition ####### IMPORTANT NOTICE - PLEASE READ CAREFULLY STMicroelectronics NV and its subsidiaries ('ST') reserve the right to make changes, corrections, enhancements, modifications, and improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on ST products before placing orders. ST products are sold pursuant to ST's terms and conditions of sale in place at the time of order acknowledgement. Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or the design of Purchasers' products. No license, express or implied, to any intellectual property right is granted by ST herein. Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product. ST and the ST logo are trademarks of ST. For additional information about ST trademarks, please refer to www.st.com/trademarks . All other product or service names are the property of their respective owners. Information in this document supersedes and replaces information previously supplied in any prior versions of this document. © 2026 STMicroelectronics - All rights reserved 76/76 SMD_NL_PQML_02.1_ST33K_ST_25_002