Re: [2600] question on FMT_MSA.1 and FMT_MSA.3
The problem is that the SFRs are poorly worded. They should say
something like "The TSF shall support the [assignment: SFPs]
by restricting the ability to ...". For some reason the
wording has never been changed in CC Part 2.
The SFRs in the PP are stated according to the accepted usage of
FMT_MSA.1 so they should be Ok.
Tom
At 07:43 PM 11/12/2008, Lida Wang wrote:
Hi
all,
I think there are some problems with FMT_MSA.1 and FMT_MSA.3. If I have
made a mistake, please clarify me.
Based on FMT_MSA.1.1(a) the TSF shall enforce the Common Access
Control SFP, [assignment: access control SFP(s), information flow
control SFP(s)] to restrict the ability to [selection: change_default,
query, modify, delete, [assignment: other operations]] the security
attributes [assignment: list of security attributes] to [assignment: the
authorized identified roles].
Here I think the security attributes is TSF data. However Common
Access Control SFP is used to protect user data. The object of
Common Access Control SFP is user document data and user
functional data. Therefore I think we should not use Common Access
Control SFP here.
There are the same problem with FMT_MSA.1.1(b), FMT_MSA.1.3(a), and
FMT_MSA.1.3(b).
Thanks,
Lida,
Principle engineer,
Kyocera technology development
Tom Benkart
Common Criteria Consulting LLC
work: 301-570-9308
cell: 240-401-1173
tom.benkart@xxxxxxxxxxxxxxxxx
http://www.consulting-cc.com