PKI Forum Endorsements

Transcription

1 July 2001 CA Trust Public Key Ifrastructure provides a meas for relyig parties (i.e., recipiets of certificates who act i reliace o digital sigatures verified usig those certificates) to kow that aother idividual s public key actually belogs to that idividual. Certificatio Authorities are those etities that iitially autheticate the public key subscriber ad issue the certificate for use by the relyig parties. Idepedet verificatio that a certificatio authority operates usig idustry accepted stadards for busiess disclosures ad evirometal, key maagemet, ad certificate maagemet cotrols will ehace the TRUST i ecommerce. The PKI Forum edorses the stadards embodied i the America Natioal Stadard (ANS) X9.79 PKI Practices ad Policy Framework, ad the America Istitute of Certified Public Accouts (AICPA) ad Caadia Istitute of Chartered Accouts (CICA) stadard WebTrust SM/TM Program for Certificatio Authorities. ANS X9.79 is curretly uder process to become a ISO stadard. This edorsemet is for the stadards as adopted by their respective stadards bodies ad do ot iclude ay proprietary, orgaizatioal or other extesios ad extrapolatios from these stadards. Ackowledgemets CA Trust is a deliverable from the PKI Forum s Best Practices Workig Group. Several member orgaizatios ad idividuals have cotributed by providig cotet, editorial assistace ad editorial reviews. Primary Author: Jeff Stapleto KPMG, LLP PKI Forum Edorsemets The Busiess Workig Group (BWG) of the PKI Forum established the Best Practices Workig Group to propose a set of stadards, policies ad audit procedures that esure the overall itegrity, effectiveess ad iteroperability of trusted PKI-eabled implemetatios. At the Sydey meetig i December 2000, the Best Practices Work Group udertook to prepare its first items. Followig that, members leared of the efforts of the ASC X9 ad the widespread acceptace of the AICPA/CICA stadard ad cocluded durig the Sa Jose meetig i March 2001, that the professioal ad iteratioal stadards that they were seekig already existed. The workig group reviewed the parallel developmet efforts of the X9 Accredited Stadards Committee (ASC X9) ad the joit America Istitute of Certified Public Accouts ad the Caadia Istitute of Chartered Accouts (AICPA/CICA) ad formally edorses ANS X9.79 PKI Practices ad Policy Framework ad the WebTrust SM/TM Program for Certificatio Authorities. Cotets Abstract 1 PKI Forum 2 Accredited Stadards Committee X9 2 America Istitute of Certified Public Accoutats 2 ANS X PKI Practices ad Policy Framework 3 WebTrust SM/TM Program for Certificatio Authorities 4 The PKI Forum believes that the stadards edorsed by the PKI Forum herei represet those policies, procedures ad practices which are best used atioally ad iteratioally. Thus, the PKI Forum will focus o these stadards 1 ad, workig through its members, will ifluece these stadards by reviewig documets, promotig commets 1 The WebTrust stadard, the multi-part X9.79 stadard, ad the aticipated ISO stadard.

2 e-busiess Risks cotiued ad recommedig chages. These documets represet the cosesual opiios of a vast umber of corporatios ad govermets iteratioally. May of the PKI Forum members are X9 members, icludig AT&T, Baltimore, Certicom, Chrysalis-ITS, Digital Sigature Trust Co., Etrust, IBM, KPMG LLP, Cipher, PricewaterhouseCoopers LLP, RSA Security, Securify, Spyrus, VeriSig, Visa Iteratioal, ad Wells Fargo Bak,. Therefore the PKI Forum was egaged i the developmet ad ballotig process which resulted i these stadards, ad thus the PKI Forum has already had some say i their establishmet. PKI Forum edorsemet will be reviewed as these stadards evolve ad the Forum will ot otherwise edorse policies ad practices ot justified i these stadards. PKI Forum edorsemet will be reviewed as these stadards evolve ad the Forum will ot otherwise edorse policies ad practices ot justified i these stadards. Accredited Stadards Committee X9 ASC X9 is the US stadards committee for the fiacial idustry services, whose missio is to develop, establish, publish, maitai, ad promote stadards for the Fiacial Services Idustry i order to facilitate delivery of fiacial products ad services. 1 X9 is accredited by the America Natioal Stadards Istitute (ANSI). 2 ANSI is the US atioal stadards body represetig the US to the Iteratioal Stadards Orgaizatio (ISO). The X9 Secretariat is the America Bakers Associatio (ABA). 3 X9 is also the US Techical Advisory Group (TAG) to ISO Techical Committee 68 Bakig, securities ad other fiacial services. 4 The X9F5 workig group developed ANS X9.79 PKI Practices ad Policy Framework i cooperatio with the AICPA/CICA Electroic Commerce Assurace Task Force. America Istitute of Certified Public Accoutats The America Istitute of Certified Public Accoutats is the atioal, professioal orgaizatio for all Certified Public Accoutats. 5 Its missio is to provide members with the resources, iformatio, ad leadership that eable them to provide valuable services i the highest professioal maer to beefit the public as well as employers ad cliets. The joit AICPA / CICA Electroic Commerce Assurace Task Force developed i cooperatio with the X9F5 workig group the WebTrust SM/TM Program for Certificatio Authorities. Caadia Istitute of Chartered Accoutats The Caadia Istitute of Chartered Accoutats (CICA), together with the provicial ad territorial istitutes of chartered accoutats, represets a membership of more tha 66,000 CAs ad 8,500 studets i Caada ad Bermuda. The CICA coducts research ito curret busiess issues ad sets accoutig ad assurace stadards for busiess, ot-for-profit orgaizatios ad govermet. It issues guidace o cotrol ad goverace, publishes professioal literature, develops cotiuig educatio programs ad represets the CA professio atioally ad iteratioally. 1 For more iformatio, visit 2 For more iformatio, visit 3 For more iformatio, visit 4 For more iformatio, visit 5 For more iformatio, visit 2

3 ANS X PKI Practices ad Policy Framework The ANS X PKI Practices ad Policy Framework is a America Natioal Stadard that defies the compoets of a PKI ad sets a framework of practices ad policy requiremets for the operatio of a PKI. The stadard draws a distictio betwee PKI systems used i ope, closed ad etworked eviromets. It further defies the operatioal practices relative to idustry accepted iformatio systems cotrol objectives. PKI practices implemetig this stadard ca support multiple polices that icorporate the use of digital sigature techology. The stadard allows for the implemetatio of operatioal, baselie PKI practices ( practices ) that satisfy idustry accepted iformatio systems cotrol objectives. 6 PKI practices implemetig the ANS X stadard ca support multiple polices that icorporate the use of digital sigature techology. I 7.2 Certificatio Practice Statemets of X9.79, requiremet 4. reads as follows: Certificatio practices SHALL comply with the cotrol objectives specified i Aex B: Certificatio Authority Cotrol Objectives. The cotets of Aex B draws heavily from the followig documets, listed i alphabetical ad umerical order: ANS X9.57 Certificate Maagemet ANS X9.80 (draft), Prime Number Geeratio, Primality Testig, ad Primality Certificates British Stadard (BS) Code of Practice for Iformatio Security Maagemet, also kow as ISO/IEC DIS , Iformatio Security Maagemet, Part 1: Code Of Practice For Iformatio Security Maagemet. Federal Iformatio Processig Stadard 140-1, Security Requiremets for Cryptographic Modules Iteret Egieerig Task Force (IETF), RFC 2527 Iteret X.509 Public Key Ifrastructure Certificate Policy ad Certificatio Practices Framework, also kow as PKIX-4. ISO , Fiacial trasactio cards - Security architecture of fiacial trasactio systems usig itegrated circuit cards, Part 1: Card life cycle ISO , Bakig Key Maagemet (retail), Part 4: Key maagemet techiques usig public-key cryptography, ad Part 5: Part 5: Key life cycle for public key cryptosystems ISO (draft), Bakig Secure Cryptographic Devices (Retail), Part 2: Security Compliace Checklists for Devices used i Magetic Stripe Card Systems ISO Bakig Certificate Maagemet, Part 1: Certificate Maagemet Natioal Automated Clearig House Associatio (NACHA), Iteret Coucil s Certificatio Authority Ratig ad Trust (CARAT). Certificate Life Cycle Cotrols cotais 9 detailed cotrol objectives, with 115 comprehesive cotrol procedures. These cotrol objectives ad procedures are suitable for use by a professioal audit practitioer to assess a public key ifrastructure. The Certificatio Authority Cotrol Objectives are orgaized ito three sectios, B.1 CA Evirometal Cotrols, B.2 Key Maagemet Life Cycle Cotrols, ad B.3 Certificate Life Cycle Cotrols. Aex B.1 CA Evirometal Cotrols cotais 11 detailed cotrol objectives, with 165 comprehesive cotrol procedures. Aex B.2 Key Maagemet Life Cycle Cotrols cotais 9 detailed cotrol objectives, with 67 comprehesive cotrol procedures. Aex B.3 Certificate Life Cycle Cotrols cotais 9 detailed cotrol objectives, with 115 comprehesive cotrol procedures. These cotrol objectives ad procedures are suitable for use by a professioal audit practitioer to assess a public key ifrastructure. 6 ANS X , 1. Scope 3

4 WebTrust SM/TM Program for Certificatio Authorities The WebTrust SM/TM Program for Certificatio Authorities provides a framework for licesed WebTrust practitioers to assess the adequacy ad effectiveess of the cotrols employed by Certificatio Authorities (CAs). The public accoutig professio has developed ad is promotig a set of priciples ad criteria for CAs. Public accoutig firms ad practitioers, who are specifically licesed by the AICPA/CICA ca provide assurace services to evaluate ad test whether the services provided by a particular Certificatio Authority meet these priciples ad criteria. The postig of the WebTrust seal of assurace for Certificatio Authorities is a symbolic represetatio of a practitioer s uqualified report certifyig the coformace of that CA to the WebTrust requiremets. I additio, ay iterested party ad i particular those who rely o the digital certificates (ad certificate status iformatio) issued by the Certificatio Authority ca click o the WebTrust seal to view the practitioer s report. The Certificatio Authority criteria is orgaized ito three priciples: CA Busiess Practices Disclosure The Certificatio Authority discloses its key ad certificate life cycle maagemet busiess ad iformatio privacy practices ad provides its services i accordace with its disclosed practices. This priciple has 4 disclosure criteria addressig geeral disclosures, key life cycle maagemet disclosures, certificate life cycle disclosures, ad CA evirometal disclosures with 45 illustrative disclosures that are harmoized with the ANS X9.79 stadard. The postig of the WebTrust seal of assurace for Certificatio Authorities is a symbolic represetatio of a practitioer s uqualified report certifyig the coformace of that CA to the WebTrust requiremets. Service Itegrity The Certificatio Authority maitais effective cotrols to provide reasoable assurace that; Subscriber iformatio was properly autheticated (for the registratio activities performed by a certificatio authority). The itegrity of keys ad certificates it maages is established ad protected throughout their life cycles. This priciple has 9 key maagemet life cycle criteria, with 67 illustrative cotrols, ad 9 certificate life cycle criteria, with 121 illustrative cotrols, that are harmoized with the ANS X9.79 stadard. CA Evirometal Cotrols The Certificatio Authority maitais effective cotrols to provide reasoable assurace that: Subscriber ad relyig party iformatio is restricted to authorized idividuals ad protected from uses ot specified i the CA s busiess practices disclosure. The cotiuity of key ad certificate life cycle maagemet operatios is maitaied. 4

5 WebTrust SM/TM Program for Certificatio Authorities cotiued CA systems developmet, maiteace, ad operatio are properly authorized ad performed to maitai CA systems itegrity. This priciple has 11 CA evirometal criteria with 165 illustrative cotrols that are harmoized with the ANS X9.79 stadard. The WebTrust stadard also icludes a complete set of example practitioer reports for use i the Uited States ad Caada. This stadard has also bee adopted by the public accoutig professio of other coutries, icludig Australia, Austria, Argetia, Demark, Eglad, Hog Kog, Irelad, Japa, Netherlads, Scotlad, Spai, Germay, ad Frace. Furthermore, the Microsoft Corporatio is workig with the AICPA/CICA task force to develop the Microsoft Program for Certificatio Authority Qualificatio, based o the WebTrust criteria. Prior to the existece of the WebTrust stadard, the Statemet o Auditig Stadards (SAS) 70 has bee used as the reportig vehicle for a audit of a Certificatio Authority, ad is still required by some state legislature today. However, the purpose of the SAS 70 is auditor-to-auditor commuicatio, whereas the WebTrust stadard is a auditor to iterested parties commuicatio based o the Statemets o Stadards for Attestatio Egagemets (SSAE, U.S.) ad Stadards for Assurace Egagemets (SAE, Caada). A table highlightig the differeces betwee a WebTrust for Certificatio Authorities ad SAS NO. 70 ad Sectio 5900 egagemets is provided i Appedix E of the WebTrust stadard. Copyright Statemet This Note ad all other materials prited by the PKI Forum are property of the PKI Forum ad may ot be copied without express coset from the PKI Forum PKI Forum, Ic. About PKI Forum The PKI Forum is a iteratioal, ot-for-profit, multi-vedor ad ed-user alliace whose purpose is to accelerate the adoptio ad use of Public-Key Ifrastructure (PKI). The PKI Forum advocates idustry cooperatio ad market awareess to eable orgaizatios to uder-stad ad exploit the value of PKI i their e- busiess applicatios. Web: ifo@pkiforum.org Phoe: