GM/T 0115-2021Testing and evaluation requirements for information system cryptography application (English PDF)

1 Scope

This document specifies the testing and evaluation requirements for different levels of cryptography application in information systems. From the perspectives of cryptographic algorithm compliance, cryptographic technology compliance, cryptographic product compliance, cryptographic service compliance and key management security, etc., it proposes the general testing and evaluation requirements for cryptography application from Level 1 to Level 5.From four technological levels. physical and environmental security of information systems, network and communication security, equipment and computing security, application and data security, etc., it proposes the testing and evaluation requirements for cryptography application technology from Level 1 to Level 4.From four management perspectives.

management system, personnel management, construction and operation, and emergency response, it proposes the testing and evaluation requirements for cryptography application management from Level 1 to Level 4.In addition, the requirements for the testing and evaluation links, such as. overall testing and evaluation, risk analysis and evaluation, and testing and evaluation conclusions, etc., are provided.

This document is applicable to guide and standardize the security evaluation of commercial cryptography application in the planning, construction and operation of information system cryptography application.

NOTE. for Level 5 cryptography application testing and evaluation requirements, only general testing and evaluation requirements are described in this document.

2 Normative References

The contents of the following documents constitute indispensable clauses of this document through the normative references in the text. In terms of references with a specified date, only versions with a specified date are applicable to this document. In terms of references without a specified date, the latest version (including all the modifications) is applicable to this document.

GB/T 39786-2021 Information Security Technology - Baseline for Information System Cryptography Application GM/Z 4001 Cryptology Terminology

3 Terms and Definitions

The terms and definitions defined in GB/T 39786-2021 and GM/Z 4001, and the following are applicable to this document.

4 Overview

In accordance with GB/T 39786-2021, the testing and evaluation requirements for information system cryptography application are divided into general testing and evaluation requirements, testing and evaluation requirements for cryptography application technology, and testing and evaluation requirements for cryptography application management.

8 Risk Analysis and Evaluation

The cryptography application security evaluation report shall conduct risk analysis and evaluation of non-conforming and partially conforming items in the unit testing and evaluation results after the overall testing and evaluation.

9 Testing and Evaluation Conclusions

The cryptography application security evaluation report shall provide the testing and evaluation conclusions of the information system and confirm that the information system reaches the corresponding level of protection requirements.

GM/T 0115-2021

CRYPTOGRAPHY INDUSTRY STANDARD ICS 35.040 CCS L 80 Testing and Evaluation Requirements for Information System Cryptography Application Issued on. OCTOBER 19, 2021 Implemented on. MAY 1, 2022 Issued by. State Cryptography Administration

Table of Contents

Foreword... 3

1 Scope... 4

2 Normative References... 4

3 Terms and Definitions... 4

4 Overview... 5

5 General Testing and Evaluation Requirements... 8

5.1 Compliance of Cryptographic Algorithms... 8

5.2 Compliance of Cryptographic Technology... 8

5.3 Compliance of Cryptographic Products... 9

5.4 Compliance of Cryptographic Services... 10

5.5 Key Management Security... 10

6 Testing and Evaluation Requirements for Cryptography Application Technology and Cryptography Application Management... 11

6.1 Physical and Environmental Security... 11

6.2 Network and Communication Security... 14

6.3 Equipment and Computing Security... 19

6.4 Application and Data Security... 24

6.5 Management Systems... 31

6.6 Personnel Management... 36

6.7 Construction and Operation... 41

6.8 Emergency Response... 45

7 Overall Testing and Evaluation Requirements... 48

7.1 Overview... 48

7.2 Inter-unit Testing and Evaluation... 48

7.3 Inter-level Testing and Evaluation... 49

8 Risk Analysis and Evaluation... 49

9 Testing and Evaluation Conclusions... 50 Appendix A (informative) Key Lifecycle Management Inspection Points... 51 Appendix B (informative) Typical Cryptographic Product Application Testing and Evaluation Technology... 57 Appendix C (informative) Typical Cryptographic Function Testing and Evaluation Technology... 61 Bibliography... 64

1 Scope

This document specifies the testing and evaluation requirements for different levels of cryptography application in information systems. From the perspectives of cryptographic algorithm compliance, cryptographic technology compliance, cryptographic product compliance, cryptographic service compliance and key management security, etc., it proposes the general testing and evaluation requirements for cryptography application from Level 1 to Level 5.From four technological levels. physical and environmental security of information systems, network and communication security, equipment and computing security, application and data security, etc., it proposes the testing and evaluation requirements for cryptography application technology from Level 1 to Level 4.From four management perspectives.

management system, personnel management, construction and operation, and emergency response, it proposes the testing and evaluation requirements for cryptography application management from Level 1 to Level 4.In addition, the requirements for the testing and evaluation links, such as. overall testing and evaluation, risk analysis and evaluation, and testing and evaluation conclusions, etc., are provided.

This document is applicable to guide and standardize the security evaluation of commercial cryptography application in the planning, construction and operation of information system cryptography application.

NOTE. for Level 5 cryptography application testing and evaluation requirements, only general testing and evaluation requirements are described in this document.

2 Normative References the contents of the following documents constitute indispensable clauses of this document through the normative references in the text. In terms of references with a specified date, only versions with a specified date are applicable to this document. In terms of references without a specified date, the latest version (including all the modifications) is applicable to this document.

GB/T 39786-2021 Information Security Technology - Baseline for Information System Cryptography Application GM/Z 4001 Cryptology Terminology

3 Terms and Definitions the terms and definitions defined in GB/T 39786-2021 and GM/Z 4001, and the following are applicable to this document.

3.1 commercial cryptography application security evaluation staff Personnel engaged in security evaluation of commercial cryptography application in a commercial cryptography application security evaluation institution.

4 Overview

In accordance with GB/T 39786-2021, the testing and evaluation requirements for information system cryptography application are divided into general testing and evaluation requirements, testing and evaluation requirements for cryptography application technology, and testing and evaluation requirements for cryptography application management.

5 General Testing and Evaluation Requirements

5.1 Compliance of Cryptographic Algorithms See the specific testing and evaluation units below.

5.2 Compliance of Cryptographic Technology See the specific testing and evaluation units below.

5.3 Compliance of Cryptographic Products See the specific testing and evaluation units below.

5.5 Key Management Security See the specific testing and evaluation units below.

6 Testing and Evaluation Requirements for Cryptography Application Technology and Cryptography Application Management

6.1 Physical and Environmental Security

6.1.1 Identity authentication See the specific testing and evaluation units below.

6.2.2 Communication data integrity See the specific testing and evaluation units below.

6.2.4 Integrity of network boundary access control information See the specific testing and evaluation units below.

6.3 Equipment and Computing Security

6.3.1 Identity authentication See the specific testing and evaluation units below.

6.4 Application and Data Security

6.4.1 Identity authentication See the specific testing and evaluation units below.

6.4.4 Important data transmission confidentiality See the specific testing and evaluation units below.

6.4.7 Important data storage integrity See the specific testing and evaluation units below.

6.5 Management Systems

6.5.1 Security management systems with cryptography application See the specific testing and evaluation units below.

6.5.2 Key management rules See the specific testing and evaluation units below.

6.7.4 Cryptography application security evaluation conducted before putting into operation See the specific testing and evaluation units below.

a) Testing and evaluation indicators

1) Before putting it into operation, conduct a cryptography application security evaluation (Level 1 to Level 2).

2) Before putting it into operation, conduct a cryptography application security evaluation. The system may be officially operated only after passing the evaluation (Level 3 to Level 4).

c) Testing and evaluation objects Cryptography application security evaluation report, and responsible person of the system.

d) Testing and evaluation implementation

1) For Level 1 to Level 2 system, check whether a cryptography application security evaluation is organized before the information system is put into operation; check whether there is a cryptography application security evaluation report formulated before the system is put into operation.

2) For Level 3 to Level 4 system, check whether a cryptography application security evaluation is organized before the information system is put into operation; check whether there is a cryptography application security evaluation report formulated before the system is put into operation and whether the system has passed the evaluation.

e) Result determination for an individual testing and evaluation object, if the above contents of testing and evaluation implementation of the corresponding level are all YES, then, the testing and evaluation object complies with the testing and evaluation indicator requirements of this unit; otherwise, it does not comply with, or it partially complies with the testing and evaluation indicator requirements of this unit. For this testing and evaluation unit, summarize the determination results of all the testing and evaluation objects involved in the unit. If the determination results are all conforming, then, the testing and evaluation result of this unit is conforming; if the determination results are all non-conforming, then, the testing and evaluation result of this unit is non-conforming;

otherwise, the testing and evaluation result of this unit is partially conforming.

6.7.5 Regular cryptography application security evaluation and offensive and defensive confrontation exercises See the specific testing and evaluation units below.

a) Testing and evaluation indicators During the operation process, strictly implement the established cryptography application security management system, regularly carry out cryptography application security evaluation and offensive and defensive confrontation exercises and make rectifications based on the evaluation results (Level 3 to Level 4).

b) Testing and evaluation objects Cryptography application security management system, cryptography application security evaluation report, offensive and defensive confrontation exercise report, and rectification documents.

c) Testing and evaluation implementation Check whether the party responsible for the information system has strictly implemented the establish cryptography application security management system, regularly conducted cryptography application security evaluation and offensive and defensive confrontation exercises after the information system is put into operation, and whether there are corresponding cryptography application security evaluation report and offensive and defensive confrontation exercise report; check whether rectification schemes are formulated based on the evaluation results and whether corresponding rectifications are made.

d) Result determination for an individual testing and evaluation object, if the above contents of testing and evaluation implementation are all YES, then, the testing and evaluation object complies with the testing and evaluation indicator requirements of this unit; otherwise, it does not comply with, or it partially complies with the testing and evaluation indicator requirements of this unit. For this testing and evaluation unit, summarize the determination results of all the testing and evaluation objects involved in the unit. If the determination results are all conforming, then, the testing and evaluation result of this unit is conforming; if the determination results are all non-conforming, then, the testing and evaluation result of this unit is non-conforming; otherwise, the testing and evaluation result of this unit is partially conforming.

6.8 Emergency Response

7 Overall Testing and Evaluation Requirements

7.1 Overview

For the overall testing and evaluation, the testing and evaluation, and comprehensive security analysis shall be conducted from the inter-unit and inter-level perspectives.

7.2 Inter-unit Testing and Evaluation After the unit testing and evaluation is completed, inter-unit testing and evaluation shall be conducted on the non-conforming and partially conforming items existing in the unit testing and evaluation results, focusing on analyzing whether there is mutual compensation between units in the information system.

7.3 Inter-level Testing and Evaluation After the unit testing and evaluation is completed, inter-level testing and evaluation shall be conducted on the non-conforming and partially conforming items existing in the unit testing and evaluation results, focusing on analyzing whether there is mutual compensation between levels in the information system.

8 Risk Analysis and Evaluation the cryptography application security evaluation report shall conduct risk analysis and evaluation of non-conforming and partially conforming items in the unit testing and evaluation results after the overall testing and evaluation.

9 Testing and Evaluation Conclusions the cryptography application security evaluation report shall provide the testing and evaluation conclusions of the information system and confirm that the information system reaches the corresponding level of protection requirements.