Common Criteria for Smart Cards

Common Criteria for Smart Cards

Common Criteria (CC, ISO/IEC 15408) is the international framework for evaluating and certifying the security properties of IT products, including smart cards and secure elements. A CC certificate from an accredited evaluation laboratory gives procurers an independent, reproducible assurance that a card's EAL claims are genuine.

Use the EAL Comparator to compare evaluation levels across card families and understand which assurance tier matches your deployment requirements.

EAL Levels — Assurance Hierarchy

Common CriteriaCommon CriteriaSecurityInternational IT security evaluation standard.Click to view → defines seven Evaluation Assurance Levels. Each level adds more rigorous analysis and documentation requirements than the last. Smart cards are almost universally evaluated at EAL4+ or higher.

Most commercial smart cards target EAL4+ with AVA_VAN.5 augmentation, which requires the evaluator to demonstrate resistance against attackers with high attack potential — the standard used to certify chips for European national eIDeIDIdentityNational ID with embedded chip.Click to view →, EMVEMVApplicationGlobal chip payment card standard.Click to view →, and banking programmes.

Protection Profiles

A Protection Profile (PP) is a reusable security requirements document authored by a community of interest rather than a single vendor. A card that claims conformance to a PP must satisfy all requirements in that PP, enabling procurement based on standardised benchmarks rather than vendor-specific Security Targets.

Composite evaluation — where the chip hardware PP is evaluated separately from the OS and applet PPsPPsProtocolCard-reader parameter negotiation.Click to view → — allows silicon vendors, OS developers, and application providers to each hold their own certificates and combine them without full re-evaluation.

Certification Process

The Common Criteria evaluation workflow follows five phases:

1. Security Target authoring — The developer writes the Security Target (ST), which specifies the protection profile conformance claims, Security Functional Requirements (SFRs), and Security Assurance Requirements (SARs) the product must satisfy.

2. Evaluation by ITSEFITSEFComplianceAccredited lab that performs Common Criteria smart card evaluations.Click to view → — An accredited IT Security Evaluation Facility (ITSEF) performs independent testing: functional testing, design analysis, vulnerability analysis (penetration testing) rated to the claimed EAL.

3. Certification body review — A national scheme (BSI in Germany, ANSSI in France, NLNCSA in the Netherlands, etc.) reviews the evaluation report and issues the certificate.

4. Mutual recognition — Certificates issued under SOGIS-MRA (Europe) or CCRA (global, up to EAL2 for hardware; specific domains up to EAL4) are mutually recognised across signatory nations — a single evaluation can cover multiple markets.

5. Maintenance and re-evaluation — A certified product that undergoes significant change must undergo delta evaluation or re-evaluation. Minor non-security changes may be handled by an Assurance Continuity (ACO) process.

Practical Implications for Smart Card Buyers

When procuring certified smart cards, verify:

• The certificate is current (not expired or withdrawn) on the issuing scheme's public register
• The scope (TOE boundary) covers the applet or OS version you will actually deploy
• The attack potential in AVA_VAN matches your threat model: AVA_VAN.3 (moderate) is insufficient for high-value credentials; AVA_VAN.5 (high) is the minimum for government identity documents and banking chips

See Key Management for Smart Cards for how certified hardware roots support HSM-backed key hierarchies in real deployments.