Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

More documents

Recommendations

Info

10.14 Medium Assurance Role Encryption Certificate Field Value Version V3 (2) Serial Number Must be unique Issuer Signature Algorithm sha-1WithRSAEncryption {1 2 840 113549 1 1 5} or sha256 WithRSAEncryption {1 2 840 113549 1 1 11} Issuer Distinguished Name ou=class3, o=CAs, dc=raytheon, dc=com Validity Period No longer than 3 years from date of issue expressed in UTCTime until 2049 Subject Distinguished Name Unique X.500 subject DN for role within the namespace dc=raytheon, dc=com as specified in Section 7.1.4 of this CP Subject Public Key Information 2048 bit RSA key modulus, rsaEncryption Issuer’s Signature sha-1WithRSAEncryption {1 2 840 113549 1 1 5} or sha256 WithRSAEncryption {1 2 840 113549 1 1 11} Extension Value Authority Key Identifier c=no; Octet String (same as subject key identifier in MASCA certificate ) Subject Key Identifier c=no; Octet String (same as in PKCS-10 request or calculated by the MASCA) Key Usage c=yes; keyEncipherment Certificate Policies c=no; SHA-1: {1.3.6.1.4.1.1569.10.1.2} or {1.3.6.1.4.1.1569.10.1.4} or SHA-256: {1.3.6.1.4.1.1569.10.1.12} or {1.3.6.1.4.1.1569.10.1.14} Subject Alternative Name c=no; RFC822 email address of role (required); others optional Subject Directory Attributes c=no; Entrust User Role= integer, where integer is a numeric role identifier CRL Distribution Points 31 c = no; Authority Information Access c=no; id-ad-caIssuers access method entry contains HTTP URL for .p7c file containing certificates issued to MASCA or LDAP URL pointer to the caCertificate attribute of the MASCA; id-ad-ocsp access method entry contains HTTP URL for the MASCA OCSP Responder Entrust Version Info Entrust Authority Security Manager = 7.1; Key Update Allowed = Yes; Certificate Category = Enterprise 31 The CRL distribution point extension shall only populate the distributionPoint field. The distributionPoint field shall contain HTTP (i.e., of the form http://…) URI. The distributionPoint field may contain LDAP (i.e., of the form ldap://…) URI. The reasons and cRLIssuer fields shall not be populated. The CRL shall point to a full and complete CRL or a Distribution Point based partitioned CRL. The Distribution Point field shall contain a full name (i.e., the Distribution Point field shall not contain nameRelativetoCRLIssuer). 104 7/25/2011
10.15 OCSP Responder Certificate The following table contains the OCSP Responder certificate profile assuming that the OCSP Responder certificate is issued by the same CA using the same key as the Subscriber Certificate. Alternative trust models such as OCSP Responder as trust anchor may be acceptable to the RPMA. Field Value Version V3 (2) Serial Number Must be unique Issuer Signature Algorithm sha-1WithRSAEncryption {1 2 840 113549 1 1 5} or sha256 WithRSAEncryption {1 2 840 113549 1 1 11} Issuer Distinguished Name Unique X.500 Issuing CA DN as specified in Section 7.1.4 of this CP Validity Period No longer than one month from date of issue expressed in UTCTime until 2049 Subject Distinguished Name Unique X.500 subject DN within the namespace dc=raytheon, dc=com as specified in Section 7.1.4 of the Raytheon CP Subject Public Key 2048 bit RSA key modulus, rsaEncryption Information Issuer’s Signature sha-1WithRSAEncryption {1 2 840 113549 1 1 5} or sha256 WithRSAEncryption {1 2 840 113549 1 1 11} Extension Value Authority Key Identifier c=no; Octet String (same as subject key identifier in Issuing CA certificate ) Subject Key Identifier c=no; Octet String (same as in PKCS#10 request or calculated by the Issuing CA) Key Usage c=yes; nonRepudiation, digitalSignature Extended key usage c=yes; id-kp-OCSPSigning {1 3 6 1 5 5 7 3 9} Certificate Policies c=no; SHA-1: { 1.3.6.1.4.1.1569.10.1.1} { 1.3.6.1.4.1.1569.10.1.2} {1.3.6.1.4.1.1569.10.1.3} {1.3.6.1.4.1.1569.10.1.4} {1.3.6.1.4.1.1569.10.1.5} or SHA-256: { 1.3.6.1.4.1.1569.10.1.11} { 1.3.6.1.4.1.1569.10.1.12} {1.3.6.1.4.1.1569.10.1.13} {1.3.6.1.4.1.1569.10.1.14} {1.3.6.1.4.1.1569.10.1.15} Subject Alternative Name Email of the person controlling the OCSP Responder private key No Check id-pkix-ocsp- c=no; Null nocheck; {1 3 6 1 5 5 7 48 1 5} Authority Information Access c=no; id-ad-caIssuers access method entry contains HTTP URL for .p7c file containing certificates issued to Issuing CA or LDAP URL pointer to the caCertificate attribute of the Issuing CA 105 7/25/2011
Page 1 and 2:
Raytheon Company Public Key Infrast
Page 3 and 4:
Table of Contents 1 INTRODUCTION ..
Page 5 and 6:
4.6.7 Notification of Certificate I
Page 7 and 8:
5.4.8 Vulnerability Assessments ...
Page 9 and 10:
9 OTHER BUSINESS AND LEGAL MATTERS
Page 11 and 12:
1 INTRODUCTION This Certificate Pol
Page 13 and 14:
1.1.3 Scope The following diagram r
Page 15 and 16:
1. The CAs asserting id-raytheon-SH
Page 17 and 18:
approval of the PMA. The ROA activi
Page 19 and 20:
� Raytheon employees and eligible
Page 21 and 22:
1.5 Policy Administration 1.5.1 Org
Page 23 and 24:
3.1 Naming 3 IDENTIFICATION & AUTHE
Page 25 and 26:
establishing how the applicant is k
Page 27 and 28:
4. The Identity Verifier shall reco
Page 29 and 30:
3.3.1 Identification and Authentica
Page 31 and 32:
For subscriber certificates, the pr
Page 33 and 34:
4.3.1 CA Actions during Certificate
Page 35 and 36:
4.7.4 Notification of New Certifica
Page 37 and 38:
Any CA may unilaterally revoke anot
Page 39 and 40:
4.9.8 Maximum Latency for CRLs The
Page 41 and 42:
4.12.2 Session Key Encapsulation an
Page 43 and 44:
depart shall initial a sign-out she
Page 45 and 46:
� Performing or overseeing intern
Page 47 and 48:
� Be trustworthy; � Have no oth
Page 49 and 50:
administrative documents (e.g., Adm
Page 51 and 52:
REVOCATION PROFILE MANAGEMENT Audit
Page 53 and 54: It is acceptable for the system to
Page 55 and 56: 5.6 Key Changeover A CA uses a sign
Page 57 and 58: If a RA signature keys are compromi
Page 59 and 60: show that appropriate role separati
Page 61 and 62: Hashing: Cryptographic Function Has
Page 63 and 64: 6.2 Private Key Protection and Cryp
Page 65 and 66: 6.3 Other Aspects of Key Management
Page 67 and 68: � All hardware must be shipped or
Page 69 and 70: 7 CERTIFICATE, CRL AND OCSP PROFILE
Page 71 and 72: When multiple values exist for an a
Page 73 and 74: 8 COMPLIANCE AUDIT AND OTHER ASSESS
Page 75 and 76: 9.1 Fees 9 OTHER BUSINESS AND LEGAL
Page 77 and 78: � There are no material misrepres
Page 79 and 80: � Ensure that certificate and rev
Page 81 and 82: as a termination of this CP unless
Page 83 and 84: enforce the agreement to arbitrate,
Page 85 and 86: 10 CERTIFICATE, CRL, AND OCSP FORMA
Page 87 and 88: Field Value Policy Mapping For SHA-
Page 89 and 90: 10.3 Raytheon Root CA Certificate (
Page 91 and 92: 91 7/25/2011
Page 93 and 94: 10.6 Medium Assurance Signing CA Ce
Page 95 and 96: Field Value Entrust Version Info c=
Page 97 and 98: 10.9 Medium Assurance Code Signing
Page 99 and 100: Field Value Entrust Version Info En
Page 101 and 102: 10.12 Medium Assurance Domain Contr
Page 103: 10.13 Medium Assurance Role Signatu
Page 107 and 108: 10.17 Medium Assurance CA CRL Forma
Page 109 and 110: 11 PKI REPOSITORY INTEROPERABILITY
Page 111 and 112: BIBLIOGRAPHY The following document
Page 113 and 114: HTTP Hypertext Transfer Protocol IA
Page 115 and 116: 13 GLOSSARY Access Ability to make
Page 117 and 118: Client (application) A system entit
Page 119 and 120: Non-Repudiation Assurance that the
Page 121 and 122: other CA. (See superior CA). Subscr
show all

Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

Create successful ePaper yourself

Delete template?

Save as template?