Products certified under security certification frameworks such as Common Criteria undergo significant scrutiny during the costly certification process. Yet, critical vulnerabilities, including private key recovery (ROCA, Minerva, TPM-Fail...), get discovered in certified products with high assurance levels. Furthermore, assessing which certified products are impacted by such vulnerabilities is complicated due to the large amount of unstructured certification-related data and unclear relationships between the certified products. To address these problems, we conducted a large-scale automated analysis of Common Criteria certificates. We trained unsupervised models to learn which vulnerabilities from NIST's National Vulnerability Database impact existing certified products and how certified products reference each other. Our tooling automates the analysis of tens of thousands of certification-related documents, extracting machine-readable features where manual analysis is unattainable. Further, we identify the security requirements that are associated with products being affected by fewer and less severe vulnerabilities. This indicates which aspects of certification correlate with higher security. We demonstrate how our tool can be used for better vulnerability mitigation on four case studies of known, high-profile vulnerabilities. All tools and continuously updated results are available at https://seccerts.org

翻译：在通用标准等安全认证框架下获得认证的产品，在昂贵的认证过程中会经历严格的审查。然而，在具有高保证级别的认证产品中，仍发现了包括私钥恢复（ROCA、Minerva、TPM-Fail...）在内的严重漏洞。此外，由于存在大量非结构化的认证相关数据以及认证产品之间关系不明确，评估哪些认证产品受此类漏洞影响变得十分复杂。为解决这些问题，我们对通用标准证书进行了大规模自动化分析。我们训练了无监督模型，以学习美国国家标准与技术研究院（NIST）国家漏洞数据库中的哪些漏洞会影响现有认证产品，以及认证产品之间如何相互引用。我们的工具自动化分析了数万份认证相关文档，在人工分析无法实现的领域提取了机器可读的特征。此外，我们识别了与受更少且更轻微漏洞影响的产品相关的安全要求。这揭示了认证的哪些方面与更高的安全性相关。我们通过四个已知的重大漏洞案例研究，展示了如何利用我们的工具实现更好的漏洞缓解。所有工具及持续更新的结果可在 https://seccerts.org 获取。