Canon MFP Security Chip

Certificate

Approved Algorithms (4)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Canon MFP Security Chip
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-test<br/>Status Output</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3 clue;
  class I2,I3 infer;
  class R2,R3 risk;
  class E2,E3 evidence;

flowchart LR
  %% Deterministic clue tier for Canon MFP Security Chip
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-test<br/>Status Output</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3 clueLow;

Security Policy, page by page

Date of Issue: 2024/8/22 Canon MFP Security Chip FIPS140-3 Security Policy Version 1.27 2024/8/22 Canon Inc.

Date of Issue: 2024/8/22 Contents Trademark Notice ・ Canon and the Canon logo are trademarks of Canon Inc. ・ All names of companies and products contained herein are trademarks or registered trademarks of the respective companies.

Date of Issue: 2024/8/22 This security policy (hereinafter referred to as SP) is the security policy for the hardware cryptographic module developed by Canon called the Canon MFP Security Chip. This document describes how the Canon MFP Security Chip meets the FIPS140-3 Level 2 security requirements. This SP is a nonproprietary document.

This section provides basic information about this SP. Title Canon MFP Security Chip FIPS140-3 Security Policy Version 1.27 Issuer Canon Inc. Date of issue 2024/8/22

The following terms and abbreviations are used throughout this SP. Table 1 Terms and abbreviations

The Canon MFP Security Chip is a cryptographic module designed and implemented to meet the FIPS140-3 Level 2 security requirements. Table2 shows the security level met by the Canon MFP Security Chip for each of the specified areas. The overall level is level 2.

Date of Issue: 2024/8/22 Table 2 Security Levels

When installed, initialized and configured as specified in Section 11 of the Security Policy. When entropy is externally loaded1, no assurance of the minimum strength of generated SSPs (e.g., keys).

1 “externally loaded” caveat is only applicable when “Input secret information” service is used.

The Canon MFP Security Chip handles cryptography for the storage device of the Canon MFP/printer. The Canon MFP Security Chip realizes high-speed data encryption/decryption through a serial ATA interface, using XTS-AES mode. This allows the Canon MFP/printer's storage device to be protected against the risk of information leakage, without compromising objectives such as extensibility, flexibility, usability, and high performance. The Canon MFP Security Chip is a “Multiple-chip embedded cryptographic module” and the cryptographic boundary is the surface of the package. The following table shows the hardware and firmware comprising the Canon MFP Security Chip (As described in Section 2.2, all elements of the module are enclosed in a single package). The firmware includes the boot loader. Table 3 Cryptographic Module Tested Configuration Figure1 and Figure2 show the appearance of the Canon MFP Security Chip. The physical perimeter of the Canon MFP Security Chip is the surface of the package. Figure 1 Appearance of the Canon MFP Security Chip GPIO SATA-I/F non-security relevant signal Figure 2 Appearance of Canon MFP Security Chip (Bottom view)

DEVICE interface. Figure 3 shows an example of configuration for cryptographic module operation. The red line in the figure shows the cryptographic boundary. Cryptographic boundary Cryptographic SATA engine RAM HDD I/F I/F (AES) SATA-Host SATA GPIO CPU HDD I/F Reset Clock H Block Host System Power Supply F Block Power Supply PCIe Other Controller relevant I Block relevant signal signal Figure 3 Example of operational configuration of Canon MFP Security Chip The Canon MFP Security Chip is located between the host system and storage device. The host system is a system to use the services provided by the Canon MFP Security Chip, while the storage Security Chip also has a mirroring function thus it is possible to connect two storage devices. However, the second storage device is optional, and it is possible to operate with only one storage device. Serial ATA is used as the interface between the host system and Canon MFP Security Chip, and between The Canon MFP Security Chip consists of three blocks: H block for the main process of the cryptographic module; F block where flash memory is mounted; and I block not related to the services provided by the cryptographic module. The Canon MFP Security Chip consists of two dies: H and I blocks sit on one die, and F block, on the other. All these elements are enclosed in a single package, making up the cryptographic chip. All the security services of the cryptographic module are implemented in H block and F block. Firmware and CSP data to be executed in H block are stored in the flash memory in F block. I block does not have any physical I/F with H and F blocks, including the power supply. Therefore, it is not possible to access SSPs from I block and there is no impact on input/output of the cryptographic module. I block has no impact on the security of the Canon MFP Security Chip and thus explicitly excluded from the FIPS140-3 requirements. The following shows the role of each component of H and F blocks: Table 4 Roles of components of the Canon MFP Security Chip

The Canon MFP Security Chip supports Approved mode, which implements security features approved by CMVP, and non-Compliant state, which is considered outside the scope of this certification. The Canon MFP Security Chip operates in non-Compliant state when installed. It becomes validated one by using the Initialization operation described in Section 11 and is always in Approved mode. If “Sanitization” service is used in Approved mode, the module will transition to non-Compliant state.

Date of Issue: 2024/8/22 The Canon MFP Security Chip provides the following approved algorithms in Approved mode. Table 5 Approved algorithms The Canon MFP Security Chip does not implement any non-Approved algorithms.

2 #C217 includes AES-ECB as validated algorithm. This is used as a prerequisite for XTS-AES

This section describes the physical ports of the Canon MFP Security Chip, and how they relate to the Security Chip operates upon ATA commands that are input from the host system. Each ATA command is associated with a different interface, namely Data Input, Data Output, Control Input, and Table 6 Ports and Interfaces There is no control output in the Canon MFP Security Chip.

This section describes the roles with corresponding service with input and output provided by the Canon MFP Security Chip. Table 7 Roles, Service Commands, Input and Output

Date of Issue: 2024/8/22 *2 AES encryption/decryption services perform different methods of data transfer to the storage device according to the ATA command (i.e., write a single block or multiple blocks, etc.). No matter which command is executed, the module provides same function (data encryption/decryption). *3 The Process ATA Command services sends non-cryptographic-related ATA commands (as defined in the ANSI INCITS 452 standard document (ATA 8)) received from a host to storage, and sends a response from storage to the host. The Canon MFP Security Chip has a service corresponding to services. *4 The extended ATA command is proprietary to the Canon MFP Security Chip.

The Canon MFP Security Chip supports two distinct operator roles, CO(USER) and CO. These roles are the "Crypto Officer Role" specified in ISO/IEC 19790 Section 7.4.2. The Canon MFP Security Chip has no "User Role". CO(USER) serves to allow connection to the Host. CO (USER) is allowed use of the AES encryption/decryption services as described in Table 10. CO (USER) is a role that undertakes information, and C6 can update the firmware of the Canon MFP Security Chip, respectively. The following table shows the authentication method of each role. The Canon MFP Security Chip does not provide the maintenance service, so no MAINTENANCE role is supported. It does not support concurrent use by multiple operators or bypass function. Table 9 Roles and Authentication

Before providing any of the services associated with CO(USER) and CO respectively, the Canon MFP Security Chip performs role-based authentication by shared secret. The authentication mechanism differs for each role, as follows. Uses challenge-response authentication based on Authentication ID defined in 9.1. CO(USER) authentication is referred to as “Device Identification and Authentication” service. In Device Identification and Authentication, the challenge generated from the DRBG and a response value derived from the challenge and the Authentication ID, are used to mutually identify/authenticate the host system and the Canon MFP Security Chip. Response value is calculated by concatenating challenge and authentication ID, and then calculating hash values. ・ CO authentication Uses challenge-response authentication based on CO authentication information defined in section 9.1. The Canon MFP Security Chip generates challenge from DRBG and performs CO authentication using the response value notified by the host system. Response value is calculated by concatenating challenge and CO authentication information, and then calculating hash values. The hash algorithm used in CO (USER) and CO authentication is SHS as described in # 4547 of Table 5, and SHA-256 is used to calculate the hash value. For the shared secret, both CO authentication and CO(USER) authentication use a 32-byte random number, so the probability that a random attempt will succeed is 1/2 256, which is less than the objective of 1/1,000,000. The module can perform CO authentication every 60 milliseconds, and CO(USER) authentication, every 120 milliseconds. Therefore, the probability that multiple consecutive random authentication attempts will be successful during a one-minute period is 1000/2256 and 500/2256 respectively, both of which are less than the objective of 1/100,000.

This section describes the cryptographic services provided by the Canon MFP Security Chip. The Access rights shown in the table mean the access rights to Keys and/or SSPs and are defined as follows: G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g., the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. Zeroisation of SSP is performed by overwriting the area where corresponding SSP is stored with 0 or 1. See Table 9 for the method used for authentication to each operator role. Table 10 Approved Services

At the start-up, the Canon MFP Security Chip perform the boot loader integrity test using 32-bit CRC and an integrity test of the firmware (ELF format) using digital signature of RSA 2048-bit. By resetting the Canon MFP Security Chip, it is possible to perform an on-demand integrity test of the firmware. It is also possible for CO to update the firmware except for the boot loader by completely replacing it using Update firmware service. For firmware update, the new firmware image for firmware updating is stored to the non-running firmware storage space of the two storage spaces. After receiving all the firmware data, the Canon MFP Security Chip verifies the received digital signature of RSA 2048-bit by public key that is embedded in the current firmware. In case the verification succeeds, the Canon MFP Security Chip zeroizes CSPs, returns a success status and switches to non-Compliant state. Then, the next start-up, the Canon MFP Security Chip starts with the new firmware. The new firmware launches for the first time after the device is reset. After the new firmware becomes effective, the module becomes another one, and new validation is needed. If verification fails, the Canon MFP Security Chip discards the new firmware, returns an error, and quits the firmware update. In that case, the Canon MFP Security Chip will continue to operate with the pre-update firmware. The CO can verify the updated firmware version by Get FW Version Info service. The firmware version is displayed, consisting of the updated part and the unupdated boot loader.

The Canon MFP Security Chip operates in limited operational environment. It has a function to update firmware but the firmware to be updated has to be the one approved by CMVP. In case other firmware is loaded, it is considered outside of the scope of this certification. The firmware will be completely replaced by the update function. of the Canon MFP Security Chip, it is necessary to remove at least a part of the plastic mold thus tamper evidence will be left if an attempt to remove the mold is made. Table 11 Physical Security Inspection Guidelines

The Canon MFP Security Chip does not implement a non-invasive security technology to protect SSPs from non-invasive attacks.

authentication ID and CO authentication information are collectively called “secret information”. There are no cryptographic algorithms and its parameters with an expiration date in this module. Since the establishment method does not apply to all CSPs, the description is omitted. Table 12 SSPs ”

Date of Issue: 2024/8/22 * See Table 5 for algorithm Certification number. The RBG entropy source is ENT (P). ENT (P) is used in generating the seed value for approved Hash_DRBG shown in Table 5. The Table shows entropy source specification. Table 15 Non-Deterministic Random Number Generation Specification

Date of Issue: 2024/8/22 If the entropy source deteriorates to the point that it can no longer guarantee the generation of a sufficient amount of entropy, the Canon MFP Security Chip transitions to an error state as the result of the Conditional Self-test shown in 11.2. To recover from the error condition, it is necessary to contact the vendor to repair the Canon MFP security chip.

The Canon MFP Security Chip has pre-operational self-test and conditional self-test functions. Table

Date of Issue: 2024/8/22 automatically. It performs the firmware integrity test shown in Table 16 as the pre-operational self-test. Cryptographic algorithm tests are also conducted since the firmware integrity test uses RSA signature verification and SHA-256. In case the result of the firmware integrity test and cryptographic algorithm tests is an error, the Canon MFP Security Chip transitions to an error state immediately, and after that, no data can be written to, or read from, the storage device(s). Status of the error state can be obtained by Show status service. In order to recover from an error state, it is necessary to contact the vendor to repair the cryptographic module. On-demand pre-operational self-test can be performed by resetting the Canon MFP Security Chip.

The Canon MFP Security Chip provides cryptographic algorithm tests, Hash_DRBG continuous random bit generator test, entropy source test, CSP integrity test, and test for firmware loading as the conditional self-test shown in Table 16. The cryptographic algorithm tests are conducted at the same time as the pre-operational self-test, as described in 11.1. Hash_DRBG continuous random bit generator test is conducted every time before using the Hash_DRBG pseudo-random number generator. Entropy source tests are conducted as conditional cryptographic algorithm tests when performing start-up (i.e., as start-up health tests) and seed generation (i.e., as continuous health tests). The Canon MFP Security Chip also provides a management function of secret information as a critical function. It implements CSP integrity test shown in Table 16 as critical functions test. In CSP integrity test, each time secret information stored in the flash memory is read, the integrity of the secret information is confirmed by using 32-bit CRC. The Canon MFP Security Chip has the update firmware function and the firmware load test shown in Table 16 is performed when updating the firmware. In case the result of one of the cryptographic algorithm tests is an error, the Canon MFP Security Chip immediately transitions to an error state, and after that, no data can be written to, or read from, the storage device(s). The status of the error state can be obtained by using Show status service. In order to recover from an error state, it is necessary to contact the vender to repair the Canon MFP Security Chip. In case the transition to the error state is made as a result of the conditional self-test except the cryptographic algorithm tests and firmware load test, it is possible to recover from an error state by transitioning to non-Compliant state using “Sanitization” service. The status of the error state can be obtained by using Show status service. If the Firmware load test fails, the Canon MFP Security Chip will terminate the firmware update and continue to work with the existing firmware. The result can be obtained by using Show status service. No bypass test is implemented because the Canon MFP Security Chip does not have a bypass function.

The Canon MFP Security Chip operates in non-Compliant state when installed. In this state, the SSPs are not in the Canon MFP Security Chip and no security functions can be performed. To use the Canon MFP Security Chip in Approved mode, the CO shall perform the following. The CO first runs "Initialization operation" by the [PREPARE INSTALL] extended ATA command in non-Compliant state, and the Canon MFP Security Chip transitions to Approved mode after conducting pre-operational tests and cryptographic algorithm tests described in Section 10. Then, the CO uses the “Configure secret information” service, to set secret information to the Canon MFP Security Chip.

Date of Issue: 2024/8/22 The Canon MFP Security Chip, in its initial state, does not have default CO authentication information and default authentication ID. In the service, the CO should set both CO authentication information and authentication ID at the same time. The 32 Byte value which is written in the specified position of the setting command is set as the CO authentication information. It should not be easily guessed. Upon receiving a request for this service, the Canon MFP Security Chip writes the authentication ID and CO authentication information to flash memory, and generates the key seed for AES cryptographic key generation. The Canon MFP Security Chip specifies the key size by the [INSTALL SECRET INFO] extended ATA command in the “Configure secret information” service. “Show status” service by the [GET STATUS] extended ATA command can be used to determine the current operating mode. In response, the operator receives status information from the Canon MFP Security Chip indicating whether it is on Approved mode or non-Compliant state. The administrator shall periodically perform tamper evidence inspection of the Canon MFP Security Chip. Physical access to the contents of the module cannot be gained without removing at least one part of the coating that covers the cryptographic chip. The administrator shall inspect the coating for any signs of tampering. If the administrator discovers tamper evidence, the Canon MFP Security Chip should not be used. Although it cannot be switched, key sizes can be re-set after erasing CSPs by the [ERASE SECRET INFO] command. In this case, user data will not be migrated.

The Canon MFP Security Chip zeroizes all CSPs and switches to non-Compliant state by using the “Sanitization” service.

Provide the following private document as Administrator guidance and non-Administrator guidance. - Canon MFP Security Chip Firmware specification

The Canon MFP Security Chip does not implement functions to mitigate the impact of other types of attacks. END