Integrating cryptography into trusted systems: A criteria approach

The rationale behind the requirements for cryptographic implementations which have been integrated into version 3.0 of the Canadian trusted computer products evaluation criteria (CTCPEC) are presented. It is argued that an integrated set of requirements for cryptography is an essential step toward bridging the gulf between communications and computer security. A brief overview of the CTCPEC is given, with particular emphasis on those features of the CTCPEC which facilitated the development of security requirements for cryptographic modules. The scope of the security requirements for cryptographic modules and the structure of the security requirements document are discussed. The requirements on the implementation of a cryptographic module are addressed. The requirements for the integration of cryptographic modules into INFOSEC products are described. A summary of the project is provided