ACP 185

UNCLASSIFIED
ANNEX A TO
ACP 185
1.36.2 Private Key Delivery to Subscriber
Where private keys are generated or recovered by the Subscriber on/into the Subscriber’s
cryptographic module, no additional delivery process is required. Where private keys are
generated on the Subscriber’s cryptographic module under the control of another person, the
process for delivery of the Subscriber’s cryptographic module to the Subscriber shall ensure:
• The correct token and activation data are provided to the correct Subscriber
• No unauthorized parties can access or use the token during the delivery process
Where private keys are generated in another cryptographic module or recovered by an RA, the
process to delivery of the private key securely onto the Subscriber’s token or to the requestor
shall be approved by the nation’s DSA / DSO. While outside of the cryptographic module or the
Subscriber’s token, private keys shall be encrypted using an algorithm and process approved by
the DSA / DSO.
1.36.3 Public Key Delivery to Certificate Issuer
Public keys shall be delivered to the certificate issuer in a way that binds the applicant’s verified
identification to the public key being certified.
1.36.4 CA Public Key Delivery to Relying Parties
Trusted CA certificates for the NDPKIs and any directly trusted intermediate CAs shall be
delivered to Relying Parties via a controlled mechanism.
1.36.5 Key Sizes
The strength of key size and hash algorithms shall be as specified in National Institute of
Standards and Technology Special Publication 800-57 Part 1 – “Recommendation for Key
Management – Part 1: General. [SP 800-57P1]”
1.36.6 Public Key Parameters Generation and Quality Checking
Public key parameters shall always be generated and checked in accordance with the standard
that defines the crypto-algorithm in which the parameters are to be used. For example, public
key parameters for use with algorithms defined in the Federal Information Processing Standard
186-3, Digital Signature Standard [FIPS 186] shall be generated and tested in accordance with
[FIPS 186]. Whenever a crypto-algorithm is described in [FIPS 186], the parameter generation
and checking requirements and recommendations of [FIPS 186] shall be required of all entities
generating key pairs whose public components are to be certified by the CA.
Uncontrolled copy when printed
1.36.7 Key Usage Purposes (as per X.509 v3 key usage field)
The use of a specific key is determined by the key usage extension in the X.509 certificate.
A-29
UNCLASSIFIED