cryptosystems, security protocols, and trusted kernels. The requirement for
formal models and proofs is the most significant differentiating prerequisite
for TOEs aspiring to the highest Common Criteria (CC) Evaluation Assurance
Level (EAL) (EAL 7), as it was previously for systems aspiring to evaluation