7 ms·

Just your regular reminder that for the only security certification that Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possibl

by Veserv 3y ago

Just your regular reminder that for the only security certification that Apple advertises on their website for iOS [1][2] Apple only achieved the lowest possible level of security assurance, EAL1. A level only fit for products where [3]: "some confidence in the correct operation is required, but the threats to security are not viewed as serious" which does not even require "demonstrating resistance to penetration attackers with a basic attack potential" [4]. This is four entire levels lower than "demonstrating resistance to penetration attackers with a moderate attack potential" [5]. Apple has never once, over multiple decades of failed attempts, demonstrated "resistance to penetration attackers with a moderate attack potential" for any of their products. To be fair, neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. It should be no surprise that the companies, processes, and people who lack the ability, knowledge, and experience to make systems resistant to moderate attackers despite nearly unlimited resources are regularly defeated by moderate attacks like commercial surveillance companies. They certify that they absolutely, 100% can not. [1] https://support.apple.com/guide/certifications/ios-security-certifications-apc3fa917cb49/1/web/1.0 https://support.apple.com/guide/certifications/ios-security-... [2] https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11238-ci.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... [3] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page14 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 14 [4] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page16 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 16 [5] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page20 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 20

deleted 3y ago
[deleted]
vuln 3y ago
Do you by any chance have this data on Google, Samsung, Huawei, LG, and other cell phone manufacturers? I’ve never looked into these certifications and I wouldn’t know where to start looking. Do the above companies publish the results like Apple?
- alephnerd 3y ago
  You as a private consumer wouldn't be able to buy one of these EAL4+ products without a relationship with a defense and security oriented reseller.
- selectodude 3y ago
  https://www.commoncriteriaportal.org/products/index.cfm https://www.commoncriteriaportal.org/products/index.cfm? Generally only components are EAL certified. For example, the iPhone is not on there, but the security protecting access to Apple Pay on the iPhone 13 with A15 Bionic running iOS 15.4.1 (19E258) is EAL2+.
- Veserv 3y ago
  Sure. The Common Criteria for Information Technology Security Evaluation [1] is the foremost internationally recognized standard (ISO 15408) for software security that most large companies certify against for at least some of their product portfolio. I believe there are US government procurement requirements to that effect, so many systems will have certifications of some form. For many companies you just search: "{Product} Common Criteria" and they will usually have a page for it on their website somewhere. You can also go directly to the certified products page: https://www.commoncriteriaportal.org/products/ https://www.commoncriteriaportal.org/products/ For smartphones you can see them there under "Mobility". Unfortunately, it is fairly hard to parse if you are not familiar with the terminology. The general structure of Common Criteria certifications is Security Functional Requirements (SFR) which are basically the specification of what the product is supposed to do and the Security Assurance Requirements (SAR) which are basically how you certify the SFRs are met (and what level of assurance you can have that the SFRs are met). SARs can be bundled into Evaluation Assurance Levels (EAL) which define collections that reasonably map to levels of confidence. You can add SARs beyond the current EAL which is how you get a EAL level with a +, but it is important to keep in mind that just cherry picking certain SARs does not necessarily give you a holistic assurance improvement. SARs and SFRs can be further pre-bundled into Protection Profiles (PP) which basically exist to provide pre-defined requirements and testing methodologies instead of doing it one-off every time. Some Protection Profiles support variable EAL/SAR levels, but these days people generally just certify against a Protection Profile with a fixed SAR bundle. This is what PP Compliant means. If you want to see what they certified against, you would need to look at the Protection Profile itself. For smartphones, the standard Protection Profile for the phone itself is Mobile Device Fundamentals. If you look at the SAR bundle there you will see that they correspond to EAL1 + a small number of EAL2, resulting in a overall level of EAL1+. As they are in-between EAL1 and EAL2 I just classified it as EAL1 for my earlier post. If you peruse further you will see that basically every Protection Profile that companies certify to as PP Compliant are basically the same EAL1+ or thereabouts. So, if you see PP Compliant, it probably means EAL1+ or so. Hope that helps. [1] https://www.commoncriteriaportal.org/cc/ https://www.commoncriteriaportal.org/cc/
alephnerd 3y ago
> neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. It should be no surprise that the companies, processes, and people who lack the ability, knowledge, and experience to make systems resistant to moderate attackers Companies create a separate SKU for products that meet higher levels of security assurance for Common Criteria. I know for a fact that the companies you listed offer SKUs that meet higher EA levels (EAL4+) for Common Criteria. You just gotta pay more and purchase via the relevant Systems Integrators. A consumer product line like the Apple iPhone isn't targeting DoD buyers. That's always been Blackberry Ltd's bread and butter
- Veserv 3y ago
  I said, "resistance to penetration attackers with a moderate attack potential". EAL5 is the first level at which you must demonstrate that as can be seen in my 5th link [1] which bolds the diffs from the previous level. None of those companies has ever once certified a product to that level as far as I am aware. The failure is so complete that it is generally viewed as impossible to fix the structural defects in products that failed a EAL5 certification without a total rewrite. It used to say that in the standard somewhere, but the standard revisions have moved it so I can not quote it directly. [1] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page20 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 20
  - alephnerd 3y ago
    Going EAL5 and above doesn't make sense from a cost to security ratio UNLESS the customer is open to paying more for that level of verification. Certain agencies and bureaus within the DoD do ask for this and pay for it, but most are good enough with EAL4. Most attacks can be resolved by following the bare minimum recommendations of the MITRE ATTACK framework (marketing buzzwords aside). Least Priviliged Access, Entitelement Management, Identity Enforcement, etc are all much easier wins and concepts that haven't been tackled yet. Companies will provide EAL5+ if the opportunity is large enough, but it won't be publicized. Iykyk. If not, chat with your SI.
    - 3y ago
manuelabeledo 3y ago
> Apple has never once, over multiple decades of failed attempts, demonstrated "resistance to penetration attackers with a moderate attack potential" for any of their products. To be fair, neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. So, OK I guess? It's worth noting that CC evaluation does not score the actual practical security of a device or system, but the level of testing it was submitted to, which is consistent with pretty much every single governmental certification out there.
- Veserv 3y ago
  Sure it does, it is just that EAL4+, the highest level any of them can reach, does not certify "resistance to penetration attackers with a moderate attack potential". Guess what, commercial hackers have "moderate attack potential". You are complaining that the 40 cm high jump test does not score actual jumping ability. You are right, it is a low bar that they should all be able to pass. You can not use the 40 cm high jump test to distinguish them. What you need to do is use the 100 cm high jump test. Some can pass it, but none of the large commercial vendors can. Sure, it would be nice if we had more gradations like the 60 cm and 80 cm tests, but we do not really know how to do that, so the best we can do is the 100 cm test.
  - manuelabeledo 3y ago
    I'm not really complaining, though. I'm just saying that security certifications are more about compliance than actual proof that a system cannot be easily compromised. In other words, they are more about legal requirements than guarantees. It is also misleading to assert that a device or a system are less secure because they haven't been certified. Vendors submit requests to validate against specific levels or certifications, and it is not the goal of the certification authority to determine "how high" they score.
    - Veserv 3y ago
      They can not certify against useful assurance levels. They have tried repeatedly for decades and spent huge gobs of money. It is not a choice, they are incapable of it. I am judging them by their maximum ability ever demonstrated under the most favorable circumstances and they still can certify resistance against moderate attackers. They have never developed systems that can protect against the prevailing threat landscape and they can not develop such systems. Their best is not good enough.
insanitybit 3y ago
I mean, it occurs to me that maybe all of these companies aren't doing this for a reason - because common criteria and compliance are often stupid and don't represent real security. Perhaps these policies are the exception? But I've managed SOC2 for example and I can definitely say that there are plenty of ways to get your SOC2 without giving a shit about actual security.
- Veserv 3y ago
  They failed. Repeatedly. For decades. They spent billions trying. The failed so much that the standard writers determined the only logical conclusion is that it must be practically impossible to retrofit a system that failed EAL5 certification to achieve EAL5 or higher certification without a complete rewrite and redesign. It says so right there in the standard [1]: "EAL4 is the highest level at which it is likely to be economically feasible to retrofit to an existing product line". That was added due to the decades of experience where everybody who ever tried to do that failed no matter how much time or money they spent. We also have plenty of evidence that it does matter, they just can not do it. Here is Google touting their Common Criteria certification for the Titan M2 security chip hardware which is EAL4 + AVA_VAN.5 (resistance against penetration attackers with a high attack potential) [2]. Note that this is only the hardware (software was not certified; a critical severity vulnerability was actually disclosed in the software allowing complete takeover if I remember correctly) and only cherry picks AVA_VAN.5 so is still only EAL4, not a holistic EAL6 certification. Getting that certification was a deliberate effort and cost. If they literally did not care about the Common Criteria then they would just certify to the checkbox level like everybody else. It is because they could certify it to a higher level than most other can achieve that they chose to do it because then they could tout their unique advantage. Basically everybody gets a certification and basically everybody displays their certification on their page. There is something to be said about them opting for a EAL1 over a EAL4. It is basically assumed that any serious vendor could probably get a EAL4 with some effort. So, there is no differential advantage to displaying a EAL4 since everybody could get it. It is just a zero-sum game to pay for certification if everybody knows nobody has a true advantage. However, if you can achieve EAL5 or higher, then you do have a unique advantage because basically nobody else can do it. The fact that none of the major vendors attempts EAL5, shows that they can not do it. [1] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 18 [2] https://security.googleblog.com/2022/10/google-pixel-7-and-pixel-7-pro-next.html https://security.googleblog.com/2022/10/google-pixel-7-and-p...
kramerger 3y ago
Isn't EAL1 what you get for just showing up? Basically, here is the product. Here are some design documents. We don't have anything more. Can we get our EAL1 please?
- Veserv 3y ago
  Yup. Want to have a laugh? Here is the Apple iOS certification report [1]. On PDF page 26 (document page 21) they describe the rigorous AVA_VAN.1 vulnerability analysis certification process they faced. The evaluation team basically typed in: "ios vulnerabilities" into Google and then typed in "ios iphone" into the NVD and verified that all of the search results were fixed. AVA_VAN.1 certification please. To explain why, AVA_VAN.1 does not require a independent security analysis, it only requires a survey of the public domain for known vulnerabilities [2]. You need AVA_VAN.2 (which is only required in EAL2 and EAL3) before they actually attempt to look at for vulnerabilities themselves. [1] https://www.commoncriteriaportal.org/files/epfiles/st_vid11237-vr.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid112... [2] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 154
wepple 3y ago
There is a near zero chance that being EAL4 or higher certified would’ve prevented these attacks. CC might be better than PCI-DSS, but not by much.
dang 3y ago
Please don't post "regular reminder" style comments - they're too generic, and generic discussion is consistently less interesting. Good threads require being unpredictable. The best way to get that is to respond to specific new information in an article. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- deleted 3y ago
  [deleted]
tptacek 3y ago
Common Criteria EALs have nothing whatsoever to do with practical security. I'd be surprised to hear anybody on this site who has managed a CCTL security review for a product saying anything positive about the program. A fun exercise: find a list of commercial mainstream products with "high" EAL audits, and then look at their vulnerability histories.
- Veserv 3y ago
  Since it is fun can you link some of these EAL5 or higher products with sordid vulnerability histories?
  - tptacek 3y ago
    The archetypical EAL5 product is a smartcard or cryptographic coprocessor (same thing, different package). They're certifiable because they don't do much. But if you'd like an example from the EAL4 list: start with FortiOS.
    - Veserv 3y ago
      EAL4 and under is junk (with respect to security). I already said that. The standards committee has also always maintained that there is no meaningful security at EAL4. Earlier drafts of the standards said EAL4 is only meant to protect against “casual and inadvertent attacks”. The general crappiness of EAL4 goes all the way back to the Orange Book where EAL4 maps approximately to Level C2 (contemporaneous projects got certified to those levels simultaneously). That level was intentionally meant for toys before they put on their big person pants and release a grown up product with actual security [1]. It is a mystery why anybody thinks EAL4 and security belong in the same sentence. [1] https://www.stevelipner.org/links/resources/The%20Birth%20and%20Death%20of%20the%20Orange%20Book.pdf https://www.stevelipner.org/links/resources/The%20Birth%20an...
      - tptacek 3y ago
        If you're saying "EAL4 and below is junk" (I'd say EAL* is junk, but whatever), all you're really saying is that minimal-function cryptographic coprocessors are safer than operating systems and applications. Well, yeah, sure. I don't think you needed the farce of Common Criteria to tell you that, though. But upthread, you knocked Apple for not achieving an adequate assurance level. As you can see now, and from your own last comment, that doesn't make any sense. It's possible (though deeply silly) that there's some iPhone configuration that could "achieve" EAL4, but you yourself don't believe that has any meaning. I don't either. I don't think EAL5 or EAL6 do, either, except that if you tell me your product is EAL5, I'll assume it's a small fixed-function device.

by Veserv 3y ago

deleted 3y ago

[deleted]

vuln 3y ago

Do you by any chance have this data on Google, Samsung, Huawei, LG, and other cell phone manufacturers? I’ve never looked into these certifications and I wouldn’t know where to start looking. Do the above companies publish the results like Apple?

alephnerd 3y ago
You as a private consumer wouldn't be able to buy one of these EAL4+ products without a relationship with a defense and security oriented reseller.
selectodude 3y ago
https://www.commoncriteriaportal.org/products/index.cfm https://www.commoncriteriaportal.org/products/index.cfm? Generally only components are EAL certified. For example, the iPhone is not on there, but the security protecting access to Apple Pay on the iPhone 13 with A15 Bionic running iOS 15.4.1 (19E258) is EAL2+.
Veserv 3y ago
Sure. The Common Criteria for Information Technology Security Evaluation [1] is the foremost internationally recognized standard (ISO 15408) for software security that most large companies certify against for at least some of their product portfolio. I believe there are US government procurement requirements to that effect, so many systems will have certifications of some form. For many companies you just search: "{Product} Common Criteria" and they will usually have a page for it on their website somewhere. You can also go directly to the certified products page: https://www.commoncriteriaportal.org/products/ https://www.commoncriteriaportal.org/products/ For smartphones you can see them there under "Mobility". Unfortunately, it is fairly hard to parse if you are not familiar with the terminology. The general structure of Common Criteria certifications is Security Functional Requirements (SFR) which are basically the specification of what the product is supposed to do and the Security Assurance Requirements (SAR) which are basically how you certify the SFRs are met (and what level of assurance you can have that the SFRs are met). SARs can be bundled into Evaluation Assurance Levels (EAL) which define collections that reasonably map to levels of confidence. You can add SARs beyond the current EAL which is how you get a EAL level with a +, but it is important to keep in mind that just cherry picking certain SARs does not necessarily give you a holistic assurance improvement. SARs and SFRs can be further pre-bundled into Protection Profiles (PP) which basically exist to provide pre-defined requirements and testing methodologies instead of doing it one-off every time. Some Protection Profiles support variable EAL/SAR levels, but these days people generally just certify against a Protection Profile with a fixed SAR bundle. This is what PP Compliant means. If you want to see what they certified against, you would need to look at the Protection Profile itself. For smartphones, the standard Protection Profile for the phone itself is Mobile Device Fundamentals. If you look at the SAR bundle there you will see that they correspond to EAL1 + a small number of EAL2, resulting in a overall level of EAL1+. As they are in-between EAL1 and EAL2 I just classified it as EAL1 for my earlier post. If you peruse further you will see that basically every Protection Profile that companies certify to as PP Compliant are basically the same EAL1+ or thereabouts. So, if you see PP Compliant, it probably means EAL1+ or so. Hope that helps. [1] https://www.commoncriteriaportal.org/cc/ https://www.commoncriteriaportal.org/cc/

alephnerd 3y ago

> neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. It should be no surprise that the companies, processes, and people who lack the ability, knowledge, and experience to make systems resistant to moderate attackers Companies create a separate SKU for products that meet higher levels of security assurance for Common Criteria. I know for a fact that the companies you listed offer SKUs that meet higher EA levels (EAL4+) for Common Criteria. You just gotta pay more and purchase via the relevant Systems Integrators. A consumer product line like the Apple iPhone isn't targeting DoD buyers. That's always been Blackberry Ltd's bread and butter

Veserv 3y ago
I said, "resistance to penetration attackers with a moderate attack potential". EAL5 is the first level at which you must demonstrate that as can be seen in my 5th link [1] which bolds the diffs from the previous level. None of those companies has ever once certified a product to that level as far as I am aware. The failure is so complete that it is generally viewed as impossible to fix the structural defects in products that failed a EAL5 certification without a total rewrite. It used to say that in the standard somewhere, but the standard revisions have moved it so I can not quote it directly. [1] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf#page20 https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 20
- alephnerd 3y ago
  Going EAL5 and above doesn't make sense from a cost to security ratio UNLESS the customer is open to paying more for that level of verification. Certain agencies and bureaus within the DoD do ask for this and pay for it, but most are good enough with EAL4. Most attacks can be resolved by following the bare minimum recommendations of the MITRE ATTACK framework (marketing buzzwords aside). Least Priviliged Access, Entitelement Management, Identity Enforcement, etc are all much easier wins and concepts that haven't been tackled yet. Companies will provide EAL5+ if the opportunity is large enough, but it won't be publicized. Iykyk. If not, chat with your SI.
  - 3y ago

manuelabeledo 3y ago

> Apple has never once, over multiple decades of failed attempts, demonstrated "resistance to penetration attackers with a moderate attack potential" for any of their products. To be fair, neither has Microsoft, Google, Amazon, Cisco, Crowdstrike, etc. So, OK I guess? It's worth noting that CC evaluation does not score the actual practical security of a device or system, but the level of testing it was submitted to, which is consistent with pretty much every single governmental certification out there.

Veserv 3y ago
Sure it does, it is just that EAL4+, the highest level any of them can reach, does not certify "resistance to penetration attackers with a moderate attack potential". Guess what, commercial hackers have "moderate attack potential". You are complaining that the 40 cm high jump test does not score actual jumping ability. You are right, it is a low bar that they should all be able to pass. You can not use the 40 cm high jump test to distinguish them. What you need to do is use the 100 cm high jump test. Some can pass it, but none of the large commercial vendors can. Sure, it would be nice if we had more gradations like the 60 cm and 80 cm tests, but we do not really know how to do that, so the best we can do is the 100 cm test.
- manuelabeledo 3y ago
  I'm not really complaining, though. I'm just saying that security certifications are more about compliance than actual proof that a system cannot be easily compromised. In other words, they are more about legal requirements than guarantees. It is also misleading to assert that a device or a system are less secure because they haven't been certified. Vendors submit requests to validate against specific levels or certifications, and it is not the goal of the certification authority to determine "how high" they score.
  - Veserv 3y ago
    They can not certify against useful assurance levels. They have tried repeatedly for decades and spent huge gobs of money. It is not a choice, they are incapable of it. I am judging them by their maximum ability ever demonstrated under the most favorable circumstances and they still can certify resistance against moderate attackers. They have never developed systems that can protect against the prevailing threat landscape and they can not develop such systems. Their best is not good enough.

insanitybit 3y ago

I mean, it occurs to me that maybe all of these companies aren't doing this for a reason - because common criteria and compliance are often stupid and don't represent real security. Perhaps these policies are the exception? But I've managed SOC2 for example and I can definitely say that there are plenty of ways to get your SOC2 without giving a shit about actual security.

Veserv 3y ago
They failed. Repeatedly. For decades. They spent billions trying. The failed so much that the standard writers determined the only logical conclusion is that it must be practically impossible to retrofit a system that failed EAL5 certification to achieve EAL5 or higher certification without a complete rewrite and redesign. It says so right there in the standard [1]: "EAL4 is the highest level at which it is likely to be economically feasible to retrofit to an existing product line". That was added due to the decades of experience where everybody who ever tried to do that failed no matter how much time or money they spent. We also have plenty of evidence that it does matter, they just can not do it. Here is Google touting their Common Criteria certification for the Titan M2 security chip hardware which is EAL4 + AVA_VAN.5 (resistance against penetration attackers with a high attack potential) [2]. Note that this is only the hardware (software was not certified; a critical severity vulnerability was actually disclosed in the software allowing complete takeover if I remember correctly) and only cherry picks AVA_VAN.5 so is still only EAL4, not a holistic EAL6 certification. Getting that certification was a deliberate effort and cost. If they literally did not care about the Common Criteria then they would just certify to the checkbox level like everybody else. It is because they could certify it to a higher level than most other can achieve that they chose to do it because then they could tout their unique advantage. Basically everybody gets a certification and basically everybody displays their certification on their page. There is something to be said about them opting for a EAL1 over a EAL4. It is basically assumed that any serious vendor could probably get a EAL4 with some effort. So, there is no differential advantage to displaying a EAL4 since everybody could get it. It is just a zero-sum game to pay for certification if everybody knows nobody has a true advantage. However, if you can achieve EAL5 or higher, then you do have a unique advantage because basically nobody else can do it. The fact that none of the major vendors attempts EAL5, shows that they can not do it. [1] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART5R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 18 [2] https://security.googleblog.com/2022/10/google-pixel-7-and-pixel-7-pro-next.html https://security.googleblog.com/2022/10/google-pixel-7-and-p...

kramerger 3y ago

Isn't EAL1 what you get for just showing up? Basically, here is the product. Here are some design documents. We don't have anything more. Can we get our EAL1 please?

Veserv 3y ago
Yup. Want to have a laugh? Here is the Apple iOS certification report [1]. On PDF page 26 (document page 21) they describe the rigorous AVA_VAN.1 vulnerability analysis certification process they faced. The evaluation team basically typed in: "ios vulnerabilities" into Google and then typed in "ios iphone" into the NVD and verified that all of the search results were fixed. AVA_VAN.1 certification please. To explain why, AVA_VAN.1 does not require a independent security analysis, it only requires a survey of the public domain for known vulnerabilities [2]. You need AVA_VAN.2 (which is only required in EAL2 and EAL3) before they actually attempt to look at for vulnerabilities themselves. [1] https://www.commoncriteriaportal.org/files/epfiles/st_vid11237-vr.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid112... [2] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 154

wepple 3y ago

There is a near zero chance that being EAL4 or higher certified would’ve prevented these attacks. CC might be better than PCI-DSS, but not by much.

dang 3y ago

Please don't post "regular reminder" style comments - they're too generic, and generic discussion is consistently less interesting. Good threads require being unpredictable. The best way to get that is to respond to specific new information in an article. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

deleted 3y ago
[deleted]

tptacek 3y ago

Common Criteria EALs have nothing whatsoever to do with practical security. I'd be surprised to hear anybody on this site who has managed a CCTL security review for a product saying anything positive about the program. A fun exercise: find a list of commercial mainstream products with "high" EAL audits, and then look at their vulnerability histories.

Veserv 3y ago
Since it is fun can you link some of these EAL5 or higher products with sordid vulnerability histories?
- tptacek 3y ago
  The archetypical EAL5 product is a smartcard or cryptographic coprocessor (same thing, different package). They're certifiable because they don't do much. But if you'd like an example from the EAL4 list: start with FortiOS.
  - Veserv 3y ago
    EAL4 and under is junk (with respect to security). I already said that. The standards committee has also always maintained that there is no meaningful security at EAL4. Earlier drafts of the standards said EAL4 is only meant to protect against “casual and inadvertent attacks”. The general crappiness of EAL4 goes all the way back to the Orange Book where EAL4 maps approximately to Level C2 (contemporaneous projects got certified to those levels simultaneously). That level was intentionally meant for toys before they put on their big person pants and release a grown up product with actual security [1]. It is a mystery why anybody thinks EAL4 and security belong in the same sentence. [1] https://www.stevelipner.org/links/resources/The%20Birth%20and%20Death%20of%20the%20Orange%20Book.pdf https://www.stevelipner.org/links/resources/The%20Birth%20an...
    - tptacek 3y ago
      If you're saying "EAL4 and below is junk" (I'd say EAL* is junk, but whatever), all you're really saying is that minimal-function cryptographic coprocessors are safer than operating systems and applications. Well, yeah, sure. I don't think you needed the farce of Common Criteria to tell you that, though. But upthread, you knocked Apple for not achieving an adequate assurance level. As you can see now, and from your own last comment, that doesn't make any sense. It's possible (though deeply silly) that there's some iPhone configuration that could "achieve" EAL4, but you yourself don't believe that has any meaning. I don't either. I don't think EAL5 or EAL6 do, either, except that if you tell me your product is EAL5, I'll assume it's a small fixed-function device.