search

biometricITC / cPP-biometrics

Contains the development of a Collaborative Protection Profile for biometrics
MIT License
10 stars 2 forks source link

FPT_PBT_EXT.1.1 is not scoped #396

Closed chapman-s closed 1 year ago

chapman-s commented 2 years ago

What is the change request for the cPP/PP-module? Please describe.

For FPT_PBT_EXT.1.1, the requirement is not scoped and, technically, could apply to all templates on the TOE, not just to the biometric template. In the context of a large ST, this SFR requirement sounds like it applies to all templates on a device. (Note that the title of an SFR is not a valid SFR scoping mechanism in CC.)

Describe the solution you'd like

Consider enhancing the wording of FPT_PBT_EXT.1.1 by limiting the scope of the SFR to just biometric templates. For example:

FPT_PBT_EXT.1.1 The TSF shall protect the biometric template [selection: using a PIN as an additional factor, using a password as an additional factor, [assignment: other circumstances]].

Describe alternatives you've considered

The ST author will have to refine the SFR to provide context within an ST.

Additional context

chapman-s commented 2 years ago

This issue is against the published v1.1.