1. Don Wright Director of Standards Lexmark International don@lexmark.com
P2600 Hardcopy Device and System Security December 2006 Working Group Meeting
Don Wright
Director of Standards
Lexmark International
11/26/2018

2. Agenda Items Monday/Tuesday, December 11-12 Welcome & Introductions
Update and Approve Agenda
Review and approve October Minutes
IEEE Patent Policy Review
2007 Meeting Schedule
Update on TCG
Update on INCITS CS1 Working Group
Update on CC Vendors Forum
Review of Action Items from October Meeting
11/26/2018

3. Agenda Items Monday/Tuesday, December 11-12
Topics from
Lack of CIM for CCV3.1 Smithson (mail)
Draft CIMs (Basic) (Medium)
US unique robustness requirement
Removing DoS Threats from PP - Smithson (mail)
Addition of FAX DoS Threats in PP-C (Chen)
Representation of Threats and Objects (mail)
Various devices' claim to P2600 PP conformance - Chen (mail)
IPA/Sharp Comments - Nevo (mail)
SFR worksheet revision B - Smithson
SFR notes
Audit notes
Management notes
Draft SFR Document - Smithson
Threats Analysis Worksheet Comments - Aubry (mail)
MFD Compliance Clause (24a)
Family PP prototype - Smithson (24a)
11/26/2018

4. Agenda Items Monday/Tuesday, December 11-12 Submitted Comments
Document Review of PPs & PP Annexes
PP-A (24b)
PP-B (24a)
PP-C (24a)
PP-D (24a)
Merged Document Review (24a) (24b)
Other items
Next meeting details
Summarize and record action items
11/26/2018

5. Minutes from October Meeting
Minutes were published shortly after the meeting.
They are available at:
Any additions, deletions or corrections to the October minutes?
11/26/2018

6. Instructions for the WG Chair
At Each Meeting, the Working Group Chair shall:
Show slides #1 and #2 of this presentation
Advise the WG membership that:
The IEEE’s patent policy is consistent with the ANSI patent policy and is described in Clause 6 of the IEEE-SA Standards Board Bylaws;
Early disclosure of patents which may be essential for the use of standards under development is encouraged;
Disclosures made of such patents may not be exhaustive of all patents that may be essential for the use of standards under development, and that neither the IEEE, the WG, nor the WG Chairman ensure the accuracy or completeness of any disclosure or whether any disclosure is of a patent that, in fact, may be essential for the use of standards under development.
Instruct the WG Secretary to record in the minutes of the relevant WG meeting:
That the foregoing advice was provided and the two slides were shown;
That an opportunity was provided for WG members to identify or disclose patents that the WG member believes may be essential for the use of that standard;
Any responses that were given, specifically the patents and patent applications that were identified (if any) and by whom.
11/26/2018
(Not necessary to be shown)
Approved by IEEE-SA Standards Board – March 2003 (Revised March 2005)

7. IEEE-SA Standards Board Bylaws on Patents in Standards
IEEE standards may include the known use of essential patents and patent applications provided the IEEE receives assurance from the patent holder or applicant with respect to patents whose infringement is, or in the case of patent applications, potential future infringement the applicant asserts will be, unavoidable in a compliant implementation of either mandatory or optional portions of the standard [essential patents]. This assurance shall be provided without coercion. The patent holder or applicant should provide this assurance as soon as reasonably feasible in the standards development process. This assurance shall be provided no later than the approval of the standard (or reaffirmation when a patent or patent application becomes known after initial approval of the standard). This assurance shall be either:
a) A general disclaimer to the effect that the patentee will not enforce any of its present or future patent(s) whose use would be required to implement either mandatory or optional portions of the proposed IEEE standard against any person or entity complying with the standard; or
b) A statement that a license for such implementation will be made available without compensation or under reasonable rates, with reasonable terms and conditions that are demonstrably free of any unfair discrimination.
This assurance is irrevocable once submitted and accepted and shall apply, at a minimum, from the date of the standard's approval to the date of the standard's withdrawal.
11/26/2018
Slide #1
Approved by IEEE-SA Standards Board – March 2003 (Revised February 2006)

8. Inappropriate Topics for IEEE WG Meetings
Don’t discuss the validity/essentiality of patents/patent claims
Don’t discuss the cost of specific patent use
Don’t discuss licensing terms or conditions
Don’t discuss product pricing, territorial restrictions, or market share
Don’t discuss ongoing litigation or threatened litigation
Don’t be silent if inappropriate topics are discussed… do formally object. If you have questions, contact the IEEE-SA Standards Board Patent Committee Administrator at or visit This slide set is available at
11/26/2018
Slide #2
Approved by IEEE-SA Standards Board – March 2003 (Revised March 2005)

9. Officer Elections – Nominees
Only one nominee per office received
Chair: Don Wright, Lexmark
Vice Chair: Lee Farrell, Canon
Secretary: Brian Smithson, Ricoh
Any nominations from the floor? ?
11/26/2018

10. 2007 Meeting Schedule Feb 22-23 (Thur/Fri), Maui April 24-25 May 30-31
With PWG (Mon/Tues)
With TCG (Wed)
April 24-25
IEEE HQ, Piscataway NJ
With PWG
May 30-31
Handle comments from 1st re-circulation (if needed)
Location:
July 11-12
Handle comments from 2nd re-circulation (if needed)
Location open (HP Roseville (fly into Sacramento))
11/26/2018

11. Trusted Computing Group
Update
11/26/2018

12. INCITS CS1 : Cyber-Security
Update
11/26/2018

13. CC Vendors Forum
Update
Thrasher/Sukert
11/26/2018

14. Group General Action Items from Oct.
Update web site with future meeting details – complete
Convert PP-A to CIM EAL 3 – (due in July) – at EAL3 now
Harmonize Subject/Object implementation – (waiting for CCV3, part 2) OBE – “final” version of CCV3 removed this.
11/26/2018

15. Action Items from Previous Meetings
Review entries in P2600-action-items excel spreadsheet
December 8, 2006 Spreadsheet
11/26/2018

16. Issues raised on e-mail
Lack of CIM for CCV3.1 Smithson (mail)
P2600 PPs to be fully within CCV3.1
Informative annex to describe the additions necessary to be CIM compliant
Draft CIMs (Basic) (Medium)
11/26/2018

17. How to create an Int’l and CIM PP
General Approach to the CIM vs Int’l Certification
Assume EAL3 requires XXX.1 and XXX.2
XXX.1, .2 and .3 are all defined by CCV3.1
XXX.4 is NOT a part of CCV3.1
CIM requires XXX.1, XXX.2, XXX.3 & XXX.4 therefore:
P2600 will be drafted to include XXX.1, .2 & .3
Informative annex would include XXX.4
Any SFRs/SARs not “internationally recognized” are in the annex
11/26/2018

18. Issues raised on e-mail
Removing DoS Threats from PP - Smithson (mail)
Homework assignment:
What T.DOS.* and T.EA* threats are not testable?
What T.DOS.* & T.EA.* threats are NEVER covered in other PPs or STs?
Which threats are not mitigatable?
T.DOS.FAX.VOLUME, probably .LOOP and .HOOK
others?
What other details are needed in the threat descriptions to make the scenario better understood? Or to better understand the possible mitigations.
For those threats you think should be covered, what SFRs & SARs are applicable?
Addition of FAX DoS Threats in PP-C (Chen)
Decision: Remove the four fax threats from PP-C
11/26/2018

19. Issues raised on e-mail
Representation of Threats and Objectives (mail)
Threats: decided to unroll the threats
Objectives: decided not to use the same objective name to describe objectives that are actually different.
Various devices' claim to P2600 PP conformance - Chen (mail)
Ask IPA/NIAP if the PP clearly states that a certain SFR is not required when a function or component is missing from the TOE can a compliant ST be written that does not include that SFR?
State in the PP explicitly when an SFR doesn’t haven’t to be in an ST because the function or component is not present.
IPA/Sharp Comments - Nevo (mail)
Definition of RESOURCE needs to change to more accurately reflect the resources inherent in T.RESOURCE.COPY and T.RESOURCE.PEER
New definition of User Document Data: “The asset that consists of the information contained in a user’s document. This includes the original document itself in either hardcopy or electronic form, image data or residually-stored data created by the hardcopy device while processing an original document and printed hardcopy output.”
11/26/2018

20. Issues raised on e-mail
SFR worksheet revision B - Smithson
SFR notes
Audit notes
Management notes
Decisions recorded by Brian in the various documents
Draft SFR Document - Smithson
Not reviewed, no action taken
11/26/2018

21. Issues raised on e-mail
Threats Analysis Worksheet Comments - Aubry (mail)
T.DOS.PRT.DELETE probably should be Y in PP-A and PP-B
Added explanations in cases where the score and the inclusion in the PPs have significant disagreement (score = red, inclusion = no and vice versa)
MFD Compliance Clause (24a)
Ron will write up the 4 environments and hand off the text to Jerry for inclusion in the main document.
We will use the comment tool to refine the language as needed.
11/26/2018

22. Issues raised on e-mail
Family PP prototype - Smithson (24a)
Previous Discussed Restructuring
Main document
Retain existing clause 1-9 as P2600
Add compliance clause as #10 only covering compliance with main document
Protection Profiles become separate standards
Guide to PP  P2600.1
PP-A  P2600.2
PP-B  P2600.3
PP-C  P2600.4
PP-D  P2600.5
Additional PPs can be added asynchronously
11/26/2018

23. P2600 Restructuring Proposal
Implications
Will need P2600.x PARs
Don will create these and circulate to the list for objections
Can ballot P2600 without having the PPs complete
Will have to tweak wording in main document and PPs to align with this restructuring
Each PP will be standalone but all will share the text for clauses such as glossary, bibliography, common annexes, etc.
11/26/2018

24. Document Review Drafts needing review Review Comments Submitted
Merged Draft
Version 24a
Marked-up version showing changes required for IEEE document restructuring (24b)
Any issues with the changes
11/26/2018

25. Document Review: PP-A
Review Draft
Version 24b
11/26/2018

26. Document Review: PP-B
Review Draft
Version 24a
11/26/2018

27. Document Review: PP-C
Review Draft
Version 24a
11/26/2018

28. Document Review: PP-D
Review Draft
Version 24a
11/26/2018

29. Next Meeting Details February 22-23
Wailea Beach Marriott Resort and Spa 3700 Wailea Alanui Wailea, HI
Website:
Registration Information:
There is a $80 per person, per day registration fee. Your advanced registration is appreciated! Please go to to register.
When you make reservations, please mention the PWG, IEEE-ISTO, or Printer Working Group to get the preferred rate.  Hotel reservations deadline is January 28, 2007.
(Not mentioned on the Marriott web site, but according to Marriott customer service: high speed internet access is available in guest rooms for $13 per 24 hours)
11/26/2018

30. Next Meeting Location Map
11/26/2018

31. Action Items ?
11/26/2018

32. Back-up Charts
BACK-UP CHARTS
11/26/2018

33. Schedule Schedule Clauses 1-9, Informative Annex Protection Profiles
Ready for merging
May & June meeting reviews
Protection Profiles
Still Waiting for July draft of CCV3
into the PPs by Sept?
PPs reviewed and iterate 1 or 2 times
Complex changes: who knows?
Complete draft out of December meeting
11/26/2018

34. Schedule Schedule January 2007 February March
Form IEEE ballot body
Engage with CC Eval Labs
February
Start Balloting
Start Evaluation of PPs
March
April -- (Will need group meeting)
Reconcile comments from IEEE and Eval Labs
May – June - July
Recirculations
September
RevCom / Standards Board Approval
11/26/2018

35. Paying for the PP Evaluations
Benefits for paying for the PP evaluation (ideas)
Company name/logo and acknowledgement of some kind on the PP cover sheets and/or on the PP certificate.
Copyright license to freely use PP content.
Joint press release or other PR activities with IEEE.
Some kind of elevated acknowledgment (logos vs. no logo or whatever) on the P2600 standard.
A discount from the eval lab for product evals based on P2600 PPs. A lab might like that to generate business.
Only those contributing dollars have input into the selection of the eval lab, which PP’s get evaluated and the schedule/order of the PPs.
11/26/2018

36. Mailing List and Web Site
Listserv run by the IEEE
An archive is available on the web site
Subscribe via a note to: containing the line: subscribe stds-2600
Only subscribers may send to the mailing list.
No Change
11/26/2018