is there Stack fuzzing test report?

RE: is there Stack fuzzing test report?

Ethan.jskim — Thu, 15 Aug 2024 04:47:13 GMT

Hello Simon.

I apologize for the delayed response.

I update the current certification progress

My customer and I believe that it is unusual for a certification lab to require BLE stack stability results.
Therefore, our solution has completed SIG certification, and we will submit the SIG certification details instead of STACK stability report to prove that there is no problem with the standard SPEC.

I will close this ticket and contact you in the future if the certification lab asks again to submit a test case with a clear test method, conditions, or specifications.

thanks to you and all of the supporting guys.
BR.
Ethan.

RE: is there Stack fuzzing test report?

Simonr — Tue, 06 Aug 2024 13:14:23 GMT

I see, so a medical device robustness test, is what you're looking for. I'm afraid we don't do tests for medical devices, as per what is stated in the nRF52810 product spec. In Europe, the European Medicines Agency (EMA) will be in charge of any medical certification so you should contact them regarding what BLE tests would be necessary.

Best regards,

Simon

RE: is there Stack fuzzing test report?

Ethan.jskim — Tue, 06 Aug 2024 01:02:03 GMT

Simon

I think what the certification body is asking for is a test report on the stability of the BLE stack.

So even if it is not a FUZZ TEST, we need to submit a report related to the stability of the stack, and it seems like we need to explain the current situation that our supplier (Nordic) does not do FUZZ testing.

BR.

Ethan.

RE: is there Stack fuzzing test report?

Simonr — Mon, 05 Aug 2024 08:10:19 GMT

Hi Ethan

Do you have a reference to what exactly this is so I know what to ask the product security team about?

Best regards,

Simon

RE: is there Stack fuzzing test report?

Ethan.jskim — Sat, 03 Aug 2024 00:44:51 GMT

Simon.

thanks for your answer.

I understood that there is no random input test and I think this is FUZZ test I need

so, is there any way I can get the result of the robustness test report for BLE conformance verification that Nordic has tested themselves?

BR.

Ethan

RE: is there Stack fuzzing test report?

Simonr — Thu, 01 Aug 2024 11:58:27 GMT

Sigurd is out of office, so I have been assigned this case while he's away. According to the product security team, we don't have BLE tests using random inputs like this I'm afraid. We test for invalid parameters and invalid behavior, both as part of BLE conformance and for our own testing, as well as robustness tests that check how the stack operates in stressful conditions but all of these are deterministic.

Best regards,

Simon

RE: is there Stack fuzzing test report?

Sigurd Hellesvik — Thu, 25 Jul 2024 07:10:02 GMT

I will check if we got this, and get back to you next week.

RE: is there Stack fuzzing test report?

Ethan.jskim — Thu, 25 Jul 2024 01:33:05 GMT

The required fuzz test report for cybersecurity in the In Vitro Diagnostics Medical Device Regulation (IVDR), a European medical device certification standard.
They say that fuzz test reports are needed as evidence to determine vulnerabilities and robustness issues in software due to random, unexpected or invalid data input.

RE: is there Stack fuzzing test report?

Sigurd Hellesvik — Wed, 24 Jul 2024 13:42:12 GMT

Hi,

[quote user=""]we are currently in the process of European medical device certification, and report of "FUZZ test for BT STACK" must be submitted.[/quote]

Could you refer to which certification and which part of this is from?

Regards,
Sigurd Hellesvik