The sec-certs project (sec-certs.org) aims to be the one-stop shop to explore the security certification ecosystems of Common Criteria and FIPS 140. We aggregate and annotate certification data, enabling unified search, vulnerability investigation, trend analyses, side-by-side comparisons, notifications and other features.

This thesis aims to conduct a multi-faceted investigation into the existing sec-certs dataset to gain new insights and support existing gut feeling with objective data. For a successful thesis, the student will perform the following work:

• Familiarize themselves with data structures currently available in the sec-certs dataset for both Common Criteria and FIPS 140.
• Perform multi-faceted analysis of two business use cases.
  • Use case 1: Use of OpenSSL in certified products (its prevalence with respect to time, vendors, products and the prevalence of its alternatives in both CC and FIPS 140).
  • Use case 2: Linux-based FIPS-validated products (their prevalence with respect to time, vendors, products and architectures with a specific focus of comparing the certified products of Red Hat to other vendors).
• On a general level, assess the reliability and completeness of the data available in sec-certs.
• Optionally, add support for new data points as needed and file or fix any found sec-certs bugs.

The thesis is a part of a long-term research project in cooperation of the Centre for Research on Cryptography and Security (CRoCS) at FI MUNI and Red Hat.