[SD Correction] FCS_NTP_EXT.1.2 Test makes no sense.

[OlegAndrianov]

Provide the location of the issue FCS_NTP_EXT.1.2 Second paragraph: "[conditional] If the message digest algorithm is claimed in element 1.2, the evaluator shall change the message digest algorithm used by the NTP server in such a way that the new value does not match the configuration on the TOE and confirms that the TOE does not synchronize to this time source."

What is the correction request for the cPP? Please describe. Described test does not make a any sense and provides no assurance. As TOE is always NTP request initiator, this test if performed as written will just result in NTP server rejecting/ignoring the request from the TOE, so TOE does not receive NTP response, so there is nothing to check here.

Describe the solution you'd like This test needs to be removed or reworked. One solution will be to reword it in a way that will require evaluator to use modified NTP server to send reply signed with the wrong digest. Another alternative would be to modify test, prescribing evaluator to corrupt message digest. e.g.: "[conditional] If the message digest algorithm is claimed in element 1.2, the evaluator shall initiate NTP requests from the TOE and ensure that the NTP response received by the TOE contains incorrect digest (digest algorithm does not match the configuration on the TOE or the digest value is modified in transit) and confirms that the TOE does not synchronize to this time source."

Describe alternatives you've considered One alternative would be to remove this paragraph altogether, but that leaves us with zero assurance that NTP digest is actually being verified by the TOE. But on the other hand there is zero assurance of that in current state.

Additional context Add any other context or screenshots about the change request here.

[kr15tyk]

This issue is being discussed in the NIT - RFI 202412