full-disclosure - Can ISO15408 evaluated products be trusted?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <428C2281.90808@yahoo.co.jp>
Date: Thu May 19 06:29:03 2005
From: h_hikita at yahoo.co.jp (HHikita)
Subject: Can ISO15408 evaluated products be trusted?

Nora Barrera wrote:

>Does anybody understand what is really tested during
>an evaluation, or is it just bullshit?
>  
>
For evaluations up to EAL4,  the evaluation methods are stated in
"Common Evaluation Methodology"(CEM).
http://www.commoncriteriaportal.org/public/files/cemv2.2.pdf

For  evaluations higher than EAL5,  the testing method depends on the
country  you apply for the certification.

I would trust the  ISO15408 evaluated products to do what it states in
its Security Target(ST).
To figure out what is written in the ST is  another problem.

__________________________________
Do You Yahoo!?
Upgrade Your Life
http://bb.yahoo.co.jp/