Microsoft Windows Common Criteria Evaluation Microsoft Windows 10 (Anniversary Update) Microsoft Windows Server 2016
Appendix A: List of Abbreviations
Yüklə 0,57 Mb.
|
28.Appendix A: List of Abbreviations
1 This option is not included in the Windows Common Criteria evaluation. 2 Hardware and software 3 Stored or communicated 4 According to a defined metric 5 6 Windows 10 Enterprise and Windows Server 2016 can restrict program execution based on a version; Windows 10 Pro and Windows 10 Home editions cannot. 7 Windows can also run on computers that do not have a TPM, which is the mechanism that provides the hardware-based protection for boot integrity. 8 Windows will prevent a local administrator from disabling auditing for local administrator accounts. If an administrator can bypass auditing, they can avoid accountability for such actions as exfiltrating files without authorization. 9 Note that the 192-bit key size is not used by Windows but is available to developers. 10 The Windows OS Loader implements a SP 800-90 AES-CTR-DRBG and passes along 384 bits of entropy to the kernel for CNG to be use during initialization. This DBRG uses the same algorithms to obtain entropy from the CPU cycle counter, TPM, and RDRAND as described above. 11 In other words, the expected result from the CPU cycle counter, the RDRAND instruction, and the TPM RBG is an apparently random value which will be used as an input to seed the RBG.. 12 Running Windows in FIPS validated mode is required according to the administrative guidance. 13 The test results are described in the evaluation and Assurance Activity Reports. 14 In the context of this evaluation, Windows will generate RSA and ECC key pairs as part of establishing a TLS session. 15 In the context of this evaluation, Windows will generate RSA and ECC key pairs as part of establishing a TLS session. 16 See https://msdn.microsoft.com/en-us/library/windows/apps/windows.networking.vpn.aspx. 17 See https://msdn.microsoft.com/en-us/library/windows/desktop/aa380252(v=vs.85).aspx for the win32 interface description for this component. 18 This security management function requires join the computer to one domain and Windows 10 Home Edition does not provide this feature, so this security management function is not applicable. 19 The 64-bit version of the Windows microkernel, ntoskrnl.exe, implements Kernel Patch Protection to prevent the modification of kernel data structures which could be exploited by stack-based vulnerabilities. 20 The PRNG is seeded by the TPM RBG, the RDRAND instruction and other sources. 21 Winload.exe, winresume.exe, and hvloader.exe are loaded before the stack buffer overrun protection mechanism is operational and therefore are not compiled with this option. 22 The evaluated configuration precludes suspending/resuming Windows and so this boot application will not be used when operating Windows per the administrative guidance. 23 This is considered to be a non-operational mode for the evaluation. 24 Note that this is an additional integrity check in addition to the TPM measurements check. 25 Enforcing the Kernel Mode Code Signing policy is mandatory for the x64 version of Windows. For the x86 version of Windows, Windows will check the signatures for all kernel executable code and will halt OS if it detects an integrity error in ntoskrnl.exe, bootvid.dll, hall.dll, kdcom.dll, ci.dll, clfs.dll, ksecdd.sys, pshed.dll, or tpm.sys. 26 Windows Store Applications are typically downloaded from the Windows Store for the Windows 10 operating system, however Windows Server 2016 does not include the Windows Store app. Users of both operating systems can copy the AppX package to their local computer to install the UWP app. 27 OPC is also part of ISO/IEC 2900-2 and ECMA 376-2. Microsoft © 2016 Page of Yüklə 0,57 Mb. Dostları ilə paylaş:
|