Melanie Volkamer (Research Manager) University of Passau, Innstraße 43, 94032 Passau, Germany, Tel: +49 851/509-3021 E-Mail: [email protected]; Webpage:

Melanie Volkamer (Research Manager)

University of Passau, Innstraße 43, 94032 Passau, Germany, Tel: +49 851/509-3021

E-Mail: [email protected]; Webpage: http://www.isl.uni-passau.de

Common Criteria Protection Profile for

a Basic Set of Security Requirements for Online Voting Products

CoE Meeting 16th October 2008, Madrid

Project Formation

DFKI project funded by the BSI

DurationStarting in January 2006

Certification in April 2008

Advisory Board: Researchers: Koblenz, Gießen, Wien, …

Users: GI, Ministry of workers & social affairs, …

Companies: mainly Micromata and T-Systems

Others: CoE, e-Voting.cc, PTB, ASIT, BSI, …

Based on existing requirement documents:CoE, PTB and GI catalogue

Oct16th 2008 2CoE Meeting Madrid

Motivation


Council of Europe Recommendations

Swiss, Austrian, German Election Regulations

Austrian Election Regulations

IEEE Voting Equipment Standards

Voting System Standards

Network Voting System Standards

PTB requirement catalogue

…..

Good starting point but only lists of requirements

Problems:- Trust model is not defined- Evaluation method and depth is not made explicit

No meaningful evaluation No comparable evaluation results

Solution: Common Criteria

International standard (ISO/IEC15408) for Information Technology Security Evaluation (CC)

Australia, Canada, France, Germany, Japan, Republic of Korea, The Netherlands, New Zealand, Norway, Spain, United Kingdom, United States of America; Austria, Czech Republic, Denmark, Greece, Hungary, India, Israel, Italy, Republic of Singapore, Sweden, Turkey

Protection Profile = An implementation-independent set of security requirements for a category of TOEs that meet specific consumer needs. [TOE = target of evaluation]

CoE Recommendations made first steps


Basis Protection Profile

Not „one“ general Protection Profile for Online VotingBecause of different trust models and evaluation depths

Depending on the election in mind (societies vs. parliamentary)

Serves as basis which can be extended

Takes only the voting phase and the counting phase into account.


Protection Profile – Content


Trust Model

Evaluation Depth

Content - Threats

T.UnauthorisedVoter

T.Proof

T.IntegrityMessage

T.SecretMessage

T.AuthenticityServer

T.ArchivingIntegrity

T.ArchivingSecrecyOfVoting


Content - Assumptions

A.ElectionPreparation

A.Observation / A.AuthData/A.ElectionOfficers

A.VoteCastingDevice /ElectionServer / ServerRoom

A.Availability / DataStorage

A.AuthenticityServer / ProtectedCommunication

A.SystemTime / AuditTrailProtection

A.ArchivingSecrecyOfVoting

A.BufferBallot


Content - OSPs

P.Abort / OverhasteProtection / Correction / ACK

P.EndingElection

P.EndOfElection / StartTallying

P.SecrecyOfVotingElectionOfficer / IntegrityE.O./ IntermediateResult / AuthE.O.

P.OneVoterOneVote

P.Tallying

P.Failure

P.Audit


Protection Profile – Content


Trust Model

Evaluation Depth

Content – Evaluation Depth

CC EAL scale from 1 to 7

Evaluation Assurance Level 2+ALC_CMC.3 (substituting ALC_CMC.2)

ALC_CMS.3 (substituting ALC_CMS.2)

ALC_DVS.1

ALC_LCD.1

Assumed attacker potential: basic


Election Authorities

Does the trust model fits to your environment?

Does EAL 2+ provides enough trust in the evaluation

If not the PP can be extended byShifting assumptions to threats

Arising the EAL number

Demand the systems in use to be certified according to this Protection Profile or an extended version


Thank your for your attention

? Questions ?

[email protected]

http://www.bsi.bund.de/zertifiz/zert/reporte/pp0037b_engl.pdf

Melanie Volkamer (Research Manager) University of Passau, Innstraße 43, 94032 Passau, Germany, Tel: +49 851/509-3021 E-Mail: [email protected]; Webpage:

Documents

coe meeting madrid slide

evaluation depths

meaningful evaluation

evaluation method

content osps p

content threats t

authenticityserver t

basis protection profile