FIA_XCM_EXT.2.1 Uses

[kenji-lightship]

FIA_XCM_EXT.2.1 allows for the selection of "administrator authentication" and "user authentication."

Since FIA_XCM_EXT.2.1 is for the TOE obtaining corticates for its own use, it is not clear how the certificates would be used for administrator or user authentication. Is this an additional variant of the embedded CA use case. The TOE might issue certificates that enable external entities (e.g., administrators) to authenticate to the TOE)?

[jfisherbah]

The use case for this would be to acquire person-entity certificates for outbound communications (e.g. SSH). The app note clarifies that use of an embedded CA to obtain these is discouraged (as opposed to external CA issuance) but no change made to explicitly prohibit this.