Security level 5, known as Evaluation Assurance Level 5 (EAL5) in the Common Criteria framework, is a top-tier security certification that requires systems to be built and verified using formal methods. It ensures that software and hardware are mathematically proven to enforce strict security policies, making unauthorized access or data leakage logically impossible under normal operation.
The meaning of EAL5 in security standards
EAL5 sits near the top of the seven-level Common Criteria (ISO/IEC 15408) scale, which evaluates how thoroughly a system’s security claims are tested and verified. Unlike lower levels that rely on testing and code review, EAL5 demands a semi-formally designed system with a fully analyzed architecture. This means every component must be documented, and its behavior must align with a precise security model.
The goal is not just to reduce bugs but to eliminate entire classes of vulnerabilities—like buffer overflows or privilege escalations—by proving correctness through logic. This level does not guarantee 100% security, but it ensures that any flaw would stem from implementation errors or external factors, not design weaknesses.
The role of formal methods and mathematical proof
At EAL5, developers must translate system requirements into mathematical models and prove that the code behaves exactly as specified. This process, known as formal verification, treats software like a theorem: if the logic holds, the system is secure by design. It’s the closest computing gets to airtight assurance.
Such verification is only feasible with extremely small, minimalist codebases, often microkernels under 10,000 lines. Larger systems, like standard operating systems, are too complex to verify this way. Even with a perfect kernel, hardware flaws (e.g., Spectre or Meltdown) can undermine security, which is why EAL5 often requires joint evaluation of hardware and software.
Strict information flow and isolation
A core requirement at EAL5 is strict information flow control (IFC), ensuring data moves only in authorized directions. Models like Bell-LaPadula enforce rules such as "no read up" and "no write down," preventing lower-level processes from accessing or leaking high-level data.
This is critical in multilevel security (MLS) environments, such as military systems handling both classified and unclassified data on the same machine. Physical and logical separation, like Red/Black isolation in cryptographic modules, ensures unencrypted and encrypted data never mix. These systems act like one-way valves, blocking covert channels that could leak data through timing or power usage.
Performance and practical trade-offs
Security at this level comes at a cost. Every switch between security domains requires cache flushes, register resets, and state checks to block side-channel attacks. These steps can reduce performance by 30% or more compared to standard systems.
While this slowdown is acceptable for nuclear controls or satellite guidance, it’s impractical for everyday computing. The certification process is lengthy and expensive, often taking years and requiring exhaustive documentation. By the time a system is certified, its hardware may already be outdated.
Where EAL5 is actually used
True EAL5 systems are rare and mostly found in defense, intelligence, and critical infrastructure. Examples include Hardware Security Modules (HSMs) that protect banking root keys and secure smart cards for identity or access control.
As autonomous vehicles and medical devices become more connected, the need for high-assurance systems is growing. When software failure can result in physical harm, formal verification moves from overkill to necessity. Still, most businesses operate far below this level, often struggling with basic patching and password policies.