FTA_TSE session denial conditions

FTA_TSE.1 is an SFR for defining the conditions in which an otherwise valid authentication attempt is rejected. The application note currently says the following (emphasis ours):

“all compliant TOEs will reject authentication requests based on invalid credentials but some may impose additional limitations"

FTA_TSE.1 does not cover the 'invalid credentials' case because one would never expect invalid credentials to be accepted. The use of 'may' here suggests that FTA_TSE.1 should be optional rather than mandatory because it implies that an authentication server may not have the ability to impose such restrictions.

The restrictions in the SFR are currently just an open-ended assignment that the ST author can populate with whatever they want. To make the SFR align with the app note, one of the two approaches below must be taken; guidance is needed on which is preferred:

1. Keep the assignment open-ended and make FTA_TSE.1 an optional requirement (since we can't have the ST author fill out "none" for the assignment)
2. Define some minimum set of session denial conditions that all conformant TOEs must enforce (or a selection that must have at least one item be chosen), with the option for the ST author to claim additional ones beyond that. For example, it may be the case that all conformant TOEs must be able to enforce, at minimum, a time-of-day/day-of-week access restriction such that any authentication attempt made during a restricted time or day is automatically rejected, even if the user supplied the proper credentials.

Start with FTA_TSE.1 and its application note, especially the wording around invalid credentials and additional limitations. Resolve whether the requirement should be optional or define mandatory session-denial conditions, then update the SFR and application note so their relationship is unambiguous.