credentials in the clear - FMT_CFG_EXT.1.2

commoncriteria / application

Protection Profile for Application Software

The Unlicense

9 stars 3 forks source link

credentials in the clear - FMT_CFG_EXT.1.2 #40

Closed bourdett closed 10 years ago

bourdett commented 10 years ago

we should probably add an app note to clear up what we mean

Note: The default configuration of the application should not allow the transmission of credentials in clear plain text form over a network. Hashing or encryption of credentials is one method to secure credentials when transmitted.

If an app XOR the credentials and sent them it would currently pass FMT_CFG_EXT.1.2 as worded

bourdett commented 10 years ago

wording improved, and added an app note