Re: ADV_FSP.1-6

["NIAP Interpretations Board" <ccevs-nib@nist.gov>]

With respect the question of whether, as part of evaluating an ST, the 
evaluator must check the guidance documentation and the FSP to make sure all 
the functions are described in the TSS, the answer is no.  The TSS does not 
have to describe all of the interfaces or security mechanisms; only those that 
relate to the satisfaction of components allocated to the TOE.  The TOE may 
contain additional security functions.  These must be described in the FSP in 
order to permit the evaluation to ascertain that they do not contribute to the 
satisfaction of the SFRs.

The comments also make it appear as if one is restricted by the CC on the 
cryptography functions that may be used.  This is incorrect.  The CC makes it 
clear, in paragraph 721 of Part 2, that the assigned standard may comprise 
none, one, or more actual standards publications.  In the case of none, it 
appears it would be sufficient to have the algorithm written down.