What does the EAL (evaluation assurance level) of Common Criteria (ISO/IEC 15408), the international standard for evaluating security products, represent?

Answer: B. How deeply and rigorously the evaluation was carried out; the functional requirements for what is protected are defined separately, for example in a security target

In Common Criteria, the security functions a product must provide are defined in a security target (ST) or protection profile (PP), and a third-party evaluation body examines whether those functions have been built correctly. EALs range from 1 to 7, and a higher number means that design documents, testing and vulnerability analysis were evaluated more deeply and rigorously. Smart-card chips commonly hold certifications such as EAL5+ or EAL6+, which add vulnerability assessment assuming a high attack potential. Even with the same EAL, the scope of protection differs from product to product, so comparisons must look at the content of the ST, not just the number.

• A. It is not an indicator of key length or computational effort.
• B. Correct. It is the degree of rigor of the evaluation; the scope of protected functions is set by the ST and similar documents.
• C. It is not a score based on the number of attacks or vulnerabilities.