BSI-DSZ-CC-1219-2024
MTCOS Pro 2.6 EAC with PACE / SLC37 (V11)
| Antragsteller / Applicant | MaskTech International GmbH Nordostpark 45 |
| Prüfstelle / Evaluation Facility |
SRC Security Research & Consulting GmbH |
| Prüftiefe / Assurance |
EAL5+, ALC_DVS.2, ALC_FLR.3, AVA_VAN.5 |
| Schutzprofil / Protection Profile |
Machine Readable Travel Document with "ICAO Application", Extended Access Control with PACE (EAC PP), Version 1.3.2, 5 December 2012, BSI-CC-PP-0056-V2-2012-MA-02 |
| Ausstellungsdatum / Certification Date |
13.11.2024 |
| gültig bis / valid until |
12.11.2029 |
Zertifizierungsreport / Certification Report
Sicherheitsvorgaben / Security Target
Zertifikat / Certificate
Der Evaluierungsgegenstand (EVG) ist das Produkt MTCOS Pro 2.6 EAC with PACE / SLC37 (V11) der Firma MaskTech International GmbH.Der EVG ist ein elektronisches Reisedokument, repräsentiert durch eine kontaktlose und kontaktbasierte Smartcard, die gemäß dem ICAO Technical Report “Supplemental Access Control” programmiert ist und zusätzlich Extended Access Control gemäß ’ICAO 9303’ und 'BSI_TR-03110-1' zur Verfügung stellt. Die Kommunikation zwischen Terminal und Chip muss durch Password Authenticated Connection Establishment (PACE) gemäß „Electronic Passport using Standard Inspection Procedure with PACE“, BSI-CC-PP-0068-V2 geschützt werden. Zusätzlich wird Active Authentication gemäß 'ICAO_9303' zur Verfügung gestellt.
Es handelt sich um eine Re-Zertifizierung auf Grundlage des Zertifikats BSI-DSZ-CC-1033-V2-2021 mit folgendem Änderungsschwerpunkt:
- neue Hardware-Platform SLC37GDA512 (V11) secure dual-interface controller of Infineon Technologies AG, BSI-DSZ-CC-1107-V5-2024
- der Evaluierungsgegenstand enthält im Gegensatz zum Basiszertifikat nun ein Multi-Applikationsprodukt mit einer SSCD (wird unter der ID BSI-DSZ-CC-1221 zertifiziert)
- Das MTCOS OS wurde überarbeitet, um das internal key handling einzuschließen.
- Das Feature “in-field hardening of the cryptographic implementation” wurde weggelassen
- Aufgrund des Verfalls der Auditgültigkeit von MaskTech International GmbH wurde ein neues Audit durchgeführt, in dem die Assurance Komponente ALC_FLR.3 hinzugefügt wurde.
Target of evaluation (TOE) is the product MTCOS Pro 2.6 EAC with PACE / SLC37 (V11) provided by MaskTech International GmbH.The TOE is a fully interoperable multi-application smart card operating system compliant to 'ISO_7816' with a contact and contactless interface. It contains an MRTD application which is programmed according to ICAO Technical Report “Supplemental Access Control” and additionally providing the Extended Access Control according to the ’ICAO 9303’ and 'BSI_TR-03110-1', respectively. The communication between terminal and chip shall be protected by Password Authenticated Connection Establishment (PACE) according to “Electronic Passport using Standard Inspection Procedure with PACE”, BSI-CC-PP-0068-V2. Additionally, Active Authentication according to 'ICAO_9303' is provided.The current evaluation process is a re-evaluation of the product MTCOS Pro 2.5 EAC with PACE / SLE78CLFX400VPHM/BPHM/7PHM (M7892), which has been certified under the certification ID BSI-DSZ-CC-1033-V2-2021.
Subject to the re-evaluation are changes to the certified product with respect to actual development and findings which are:
- The embedded software has been implemented to the hardware platform SLC37GDA512 (V11) secure dual-interface controller of Infineon Technologies AG, BSI-DSZ-CC-1107-V5-2024. This implies an adaption of the low-level interfaces to the functionality provided by the IC and the usage of the cryptographic library.
- While the base certification was provided as an ePassport application only, the TOE now includes a multi-application product, containing an SSCD application to be certified in a separate procedure. However, the basecertification itself is based on an SSCD-including multi-application product.
- The MTCOS operating system has been revised including the internal keyhandling. In this context, new commands for the generation and configuration of key files are provided. Furthermore, MTCOS now allows more configuration options: File sizes of specified transparent files can be set during personalization. In order to oblige customers with an established personalization system, a “compatibility mode” can be configured.
- The feature “in-field hardening of the cryptographic implementation” has been omitted.
- Due to expiration of the audit validity of MaskTech International GmbH a new site visit was performed in which course the assurance component ALC_FLR.3 was added.