ACP 185

UNCLASSIFIED
ACP 185
CHAPTER 1
INTRODUCTION
PURPOSE
101. Allied Communications Publication (ACP) 185 - PKI Cross-Certification
Between CCEB Nations establishes the framework for PKI interoperability to facilitate
the cross-certification of CCEB National Defence/Defence Public Key (NDPKI). It
defines the minimum set of standards which each PKI needs to meet and the processes
and activities that each CCEB Nation needs to conduct prior to cross-certification, and, in
order to maintain cross-certification.
102. This framework serves to describe a common approach to authentication within
CCEB environments. Provided that each Nation meets the minimum standards listed in
Annex A, each Nation can use their own processes to perform identity proofing and
credentialing for their employees and affiliates, while relying on identity proofing and
credentialing performed by other nations for their employees and affiliates. Although not
mandated by this framework, the issuance of cross-certificates between NDPKIs is the
preferred technical approach for implementing formal and reciprocal recognition of trust
between the NDPKIs of two CCEB Member Nations.
SCOPE
103. This ACP applies to all CCEB NDPKIs that seek to or have established
mechanisms to interoperate with another CCEB NDPKI at the Secret or below level
environment under the Combined Joint Multilateral Master Military Information
Exchange Memorandum of Understanding (CJM3IEM). It may be used by other non
CCEB nations for information purposes. In no way does it imply that this will be
employed as a basis for cross-certification outside of CCEB partners.
NATURE OF THE CROSS-CERTIFICATION ARRANGEMENT
104. This ACP provides a framework for bi-lateral PKI interoperability. Self-assertion
to the requirements described in Annex A does not automatically result in interoperability
across the CCEB. Each participating nation must establish a Cross-Certification
Arrangement (CCA) with all other participating nations they wish to interoperate with as
the arrangements are not transitive 1 .
Uncontrolled copy when printed
105. In addition, a CCA allows individuals with certificates from one NDPKI to
authenticate to relying party information systems hosted by the other NDPKI. However,
it is not an authorization arrangement and is not intended to supplement or replace any
1 For example, if Nation A establishes a CCA with Nation B, and Nation B establishes a CCA with Nation C,
there is no arrangement between Nation A and Nation C as a result.
1-1
UNCLASSIFIED