Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 1 Mxtran Payeeton Solution Security Policy ： v 1.3 Version ： April 15, 2013 Effective Date ： Public Classification Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 2 EDITOR Author Title Anderson Ni Department Manager Tracy Huang Engineer Revision History Version Description Date By 0.1 Initial Version 2012/07/13 Tracy Huang 0.2 Modify some contents 2012/07/16 Anderson Ni 0.3 Modify some contents based on comments 2012/07/26 Tracy Huang, Anderson Ni 1.0 Final Version 2012/08/31 Anderson Ni 1.1 Modify according to CMVP’s comments 2013/01/11 Anderson Ni 1.2 Modify according to CMVP’s comments 2013/03/01 Anderson Ni 1.3 Modify according to CMVP’s comments 2013/04/15 Anderson Ni Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 3 Table of Contents 1 Introduction .................................................................................................................................. 5 1.1 Purpose .................................................................................................................................. 5 1.2 Scope ...................................................................................................................................... 5 1.3 Security Level .......................................................................................................................5 2 Cryptographic Module Specification .........................................................................................7 2.1 Cryptographic Module Boundary ...................................................................................... 7 2.2 Hardware .............................................................................................................................. 9 2.3 Firmware ............................................................................................................................. 10 2.4 FIPS Approved Mode of Operation ................................................................................. 11 2.5 FIPS Approved Security Functions .................................................................................. 12 3 Cryptographic Module Ports and Interfaces ........................................................................... 13 3.1 Physical Ports .....................................................................................................................13 3.2 Logical Interfaces ...............................................................................................................15 4 Roles, Services and Authentication .......................................................................................... 16 4.1 Roles .................................................................................................................................... 16 4.2 Identification and Authentication..................................................................................... 17 4.3 Services ................................................................................................................................ 19 5 Physical Security ........................................................................................................................ 23 5.1 Physical Security mechanisms as required by FIPS 140-2 ............................................. 23 5.2 Additional Hardware Security Mechanisms ................................................................... 24 6 Operational Environment ......................................................................................................... 25 7 Cryptographic Key Management ............................................................................................. 26 7.1 Critical Security Parameters and Public Keys ................................................................ 26 7.2 Key Generation................................................................................................................... 27 7.3 Key Entry and Output .......................................................................................................27 7.4 Key Storage ......................................................................................................................... 27 7.5 Key Zeroization .................................................................................................................. 28 7.6 RNG Seed Values ...............................................................................................................28 8 Electromagnetic Interference/Compatibility (EMI/EMC) ..................................................... 29 9 Self-Tests ..................................................................................................................................... 30 9.1 Power-up Self-Tests ........................................................................................................... 30 Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 4 9.2 Conditional Self-Tests ........................................................................................................ 32 10 Design Assurance .......................................................................................................................33 10.1 Configuration Management .............................................................................................. 33 10.2 Delivery and Operation .....................................................................................................33 10.3 Guidance Documents .........................................................................................................33 11 Mitigation of Other Attacks ...................................................................................................... 34 12 Security Rules .............................................................................................................................36 12.1 General Security Rules ...................................................................................................... 36 12.2 Identification and Authentication Security Rules ...........................................................36 12.3 Access Control Security Rules .......................................................................................... 37 12.4 Physical Security Rules ...................................................................................................... 39 12.5 Mitigation of Other Attacks Security Rules .................................................................... 39 13 Security Policy Check List Tables ............................................................................................ 40 13.1 Roles and required Identification and Authentication ...................................................40 13.2 Strength of Authentication Mechanisms .......................................................................... 40 13.3 Services Authorized for Roles ...........................................................................................41 13.4 Mitigation of Other Attacks .............................................................................................. 41 14 References ................................................................................................................................... 42 15 Acronyms and Definitions .........................................................................................................43 Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 5 1 Introduction 1.1 Purpose This is a non-proprietary security policy for the Mxtran Payeeton Solution (MPS, hereafter referred to as the module) of Mxtran Inc. This Security Policy describes how the cryptographic module meets the requirements for a FIPS 140-2 Security Level 3 validation as specified in the FIPS 140-2 standard. This Security Policy is part of the evidence documentation package to be submitted to the validation lab. FIPS 140-2 specifies the security requirements for a cryptographic module protecting sensitive information. Based on four security levels for cryptographic modules this standard identifies requirements in eleven sections. For more information about the standard, please visit http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf 1.2 Scope This Security Policy specifies the security rules under which the cryptographic module operates its major properties. It does not describe the requirements for the entire system, which makes use of the cryptographic module. 1.3 Security Level The module meets the overall requirements applicable to FIPS140-2 Security Level 3. In the individual requirement sections of FIPS 140-2 the following Security Level ratings are achieved: Section Section Title Level 1 Cryptographic Module Specification 3 2 Cryptographic Module Ports and Interfaces 3 3 Roles, Services, and Authentication 3 Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 6 Section Section Title Level 4 Finite State Model 3 5 Physical Security 3 6 Operational Environment N/A 7 Cryptographic Key Management 3 8 EMI/EMC 3 9 Self-tests 3 10 Design Assurance 3 11 Mitigation of Other Attacks 3 Table 1 – Security Level per FIPS 140-2 Section Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 7 2 Cryptographic Module Specification The cryptographic module acts as a flexible platform for diversified mobile commerce services, allowing Mxtran clients to support both proximity payment and mobile payment via SMS for prepaid, online paid and post-paid services including e-ticketing, e-coupons, access control, membership management and more. Mxtran leverages extensive integrated circuit expertise to deliver highly customizable, portable applications and payment services in a single handset. The module is a single-chip module based on MX12E320128E controller by Mxtran. The MX12E320128E is a dual interface smart card controller that being designed for multiple applications. This module combines contact and contactless smart card technology on a single chip. 2.1 Cryptographic Module Boundary The cryptographic module boundary is the edge of the controller coated with opaque epoxy resin. The module will be embedded into a plastic film body and connected to two [7816-1] compliant contact plates and/or to an [14443] compliant external antenna loop. The boundary separates the module from the plastic film body, contact plates, and external antenna loop. The module is a single-chip implementation of a cryptographic module. During the manufacturing process, the epoxy-covered controller is wire-bonded into plastic film body with contact plates on both sides and/or an external antenna loop. The perimeter of the module forms the cryptographic boundary of this FIPS140-2 Security Level 3 compliant single-chip cryptographic module. The module block diagram and logical boundary are shown as following. Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 8 VCC GND 288KB Flash ROM True 32KB 128KB 7.5KB 256 16 bit Interrupt Security Voltage WDT Random OTP ROM EEPROM AUX-RAM SRAM Timer Controller Circuit Regulator Number Memory Protect Unit Generator POR Turbo 8051 Address/Data Bus MCU ISO 14443 Int. OSC USB PKI SHA-1 Port ISO 7816 AES TDES Interface Co-Processor SHA-256 Control Reset/Clock Port GPIO SWP Management Control*3 RF USB Front-End Controller RST CLK IO IO1 IO2 IO3 IO4 IO5 AC1 AC2 SW-IO D+ D- Figure 1 – Cryptographic Module Block Diagram Applications APDU Middleware & Card OS 2G/3G FILM Payeeton GATInterpreter Card Manager Authentication TDES Service Codec AES Service APDU RSA File Dispatcher System SHA Atomic HMAC Service DRNG ECDSA SWP 7816(ICC/IFD) 14443 USB Multi IO Hardware Driver Hardware Module PKI TRNG TDES SHA AES Cryptographic Module Logical Boundary Figure 2 – Cryptographic Module Logical Boundary Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 9 2.2 Hardware The boundary of the single-chip module is the edges and surfaces of the integrated circuit die which contains a CPU, OTPROM, Flash ROM, EEPROM and RAM. No components are excluded from the cryptographic boundary. The module is designed to be encased into different form factors such as a plastic SIM card, a SIM card with antenna, or any other support to produce the MX12E320128E controller, on which FIPS 140-2 Security Level 3 validated applications may be loaded and instantiated at post issuance. The following figures show two various form factors available from the module. Red perimeter indicates the cryptographic module boundary. Figure 3 – Contact Mode Figure 4 – Contactless Mode (Top view and bottom view) (Top view and bottom view) The cryptographic module is based on the MX12E320128E controller. This module comprises the following components:  CPU core  OTPROM as program memory  Flash ROM as data/program memory  EEPROM as data/program/secure data memory  Internal SRAM  Auxiliary SRAM (including RSA dedicated SRAM)  Dual data pointer Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 10  Interrupt controller  Six 16-bit Timers with ETU clock sources  Watch Dog Timer with two clock sources (CLK and internal clock/16)  True Random number generator (TRNG)  Triple-DES accelerator  AES accelerator  SHA-1 & SHA-256 hardware module  Single-Wire Protocol (SWP) (Slave mode)  USB 2.0 Full-speed (Device mode)  PKI coprocessors with DMA function  RSA with randomly modulus (32 bits per step configurable)  Mathematical Library to support ECDSA (P-curve)  Two [7816] compliant electrical interfaces and response T=0 and T=1 protocol  Contactless RF interface according to [14443]  13.56 MHz operating frequency  847 kHz subcarrier for load modulation  CRC engine compliant to ISO/IEC 13239 2.3 Firmware The module contains platform firmware that resides in ROM, with key storage and future application storage functionality in the EEPROM. This firmware is implemented using high level language (C Language). It is loaded onto the module during manufacturing and does not allow for modification. An Error Detection Code (EDC) is calculated over the firmware during this installation and is checked at each power up. After completion of the manufacturing process (including pre-personalization), only trusted FIPS 140-2 validated applications shall be loaded or installed onto the module. Furthermore, at the time of loading, these applications must be identified as part of the cryptographic module. The module uses Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 11 HMAC to authenticate prior validated applications and avoid the loading of any unauthorized applications. Applications are isolated from each other due to the fact that the platform firmware does not contain any constructs that allow cross-application communication directly; any such communication must go by way of systems software mechanisms, which allow for implementation of strict security measures. Applications can only perform callable Approved security functions. The platform firmware restricts direct access to CSP through APDU ([7816-3] or/and [7816-4] compatible communication interface) and other hardware resources for a single user application. The FIPS 140-2 validation testing targeted this specific configuration. Changes to that configuration (for example, loading another application), would constitute a new module, and the new configuration would need to undergo 140-2 testing for FIPS 140-2 compliance. There is no assurance of operation unless the modified module has been validated to FIPS 140-2, per CMVP requirements. The firmware version supported by the module described in this security policy is: Simker 3.20. The firmware comprises the following components:  Authentication (AuthenServ): FileSystem, Atomic  Crypto (CodeServ): AES, RSA, SHA, TDES, HMAC, DRNG, ECDSA  Multiple IO (Multi_IO): ISO7816, ISO14443  APDU (Dispatcher): APDU bypass, Logical channel, multi-selectable applet management  Interpreter(Interpreter): CAT Applet interpreter 2.4 FIPS Approved Mode of Operation The module shall not contain a non-FIPS Approved mode of operation. Hence, as configured during production process, the module only operates in a FIPS Approved mode of operation, comprising all services described in section below. The module does not implement bypass or maintenance modes. The module will enter FIPS Approved mode following on a successful response to the initial authentication sequence handshake command. Successful transition to the FIPS Approved mode is indicated by an ATR and a Success response to the initial authentication sequence handshake Th is d o cu men t may b e freely rep roduced and distributed in its original entirety without revision. Doc. ID: P002SP-001 Grade: Public Mxtran Payeeton Solution Security Policy Version: 1.3 Page: 12 command. The ATR value returned by the module during power-up serves as an Approved mode indicator. The ATR returned by the module is: ATR: 3B 99 94 80 1F C3 80 31 A0 73 BE 06 27 E0 FF B3 2.5 FIPS Approved Security Functions The following table gives the list of FIPS Approved security functions that are provided by the module. Security CAVP Details Function Cert. # AES ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); #1691 FIPS186-3: PKG: CURVES( P-192 P-224 Testing Candidates ) ECDSA SigGen: CURVES( P-192: (SHA-1, 256) P-224 (SHA-1, 256) ) #340 SigVer: CURVES( P-192: (SHA-1, 256) P-224 (SHA-1, 256) ) HMAC-SHA1 (KS