Increased information flow needs for high-assurance composite evaluations

Four common criteria certification agencies from France, Germany, the Netherlands and the UK have developed a concept of composite evaluations in which software evaluators would not receive the full hardware evaluation technical report (ETR), but instead would only receive an abbreviated ETR-lite. While ETR-lite is acceptable at low assurance levels, we argue that at high assurance levels, such an abbreviated report violates the basic principles of systems engineering and high assurance evaluation, and demonstrates that serious undetected security vulnerabilities can be the result. We recommend that additional information flow between hardware evaluators and software developers and evaluators is crucial for high assurance evaluation to succeed.