FCS_TTTC_EXT.1 and FCS_TTTS_EXT.1 currently have assignments that allow the ST author to define support for arbitrary additional cipher suites beyond those listed in the SFR. A potential concern with this is that there is no way to define objective EAs for this since there are no bounds on what the ST can claim as security-relevant functionality.
For example, an ST author could currently complete such an assignment with "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" for which the Module has no test EAs for either the key establishment mechanism or the encryption algorithm.
For future revisions of the Module it is recommended that the full list of 'optional' cipher suites is explicitly enumerated so that there is no risk that a TOE claims functionality with no suitable test activities to validate its implementation.
FCS_TTTC_EXT.1 and FCS_TTTS_EXT.1 currently have assignments that allow the ST author to define support for arbitrary additional cipher suites beyond those listed in the SFR. A potential concern with this is that there is no way to define objective EAs for this since there are no bounds on what the ST can claim as security-relevant functionality.
For example, an ST author could currently complete such an assignment with "TLS_PSK_WITH_CHACHA20_POLY1305_SHA256" for which the Module has no test EAs for either the key establishment mechanism or the encryption algorithm.
For future revisions of the Module it is recommended that the full list of 'optional' cipher suites is explicitly enumerated so that there is no risk that a TOE claims functionality with no suitable test activities to validate its implementation.