Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

establishing how the applicant is known to the verifier as required by this certificate
policy;
� The applicant shall present one valid National Government-issued photo ID (e.g.
passport), or two valid non-National Government IDs, one of which shall be a recent
photo ID (e.g., Drivers License).
� Unique identifying numbers from the Identifier (ID) of the verifier and from an ID of
the applicant;
� The date and time of the verification, and;
� A declaration of identity signed by the applicant using a handwritten signature or
equivalent and performed in the presence of the person performing the identity
authentication, using the format set forth at 28 U.S.C 1746 (declaration under penalty
of perjury) or comparable procedure under local law.
Practice Note: Examples of signatures equivalent to handwritten signature are a
good fingerprint or other adequate biometric that can be linked to the individual
identity. Another example of a signature equivalent to handwritten signature is digital
signature that can be verified using a certificate provided to the same identity.
However, that certificate must not be the same certificate for whose issuance the
identity proofing is being performed.
Identity shall be established by in-person proofing before the RA or Trusted Agent; information
provided shall be verified to ensure legitimacy. Requirements for authentication of individual
identity using an in-person antecedent are listed in Section 3.2.3.3.
3.2.3.1 Authentication of Component Identities
Some computing and communications devices (applications, routers, firewalls, servers, etc.)
shall be named as certificate subjects. In such cases, the device shall have a human sponsor.
The PKI sponsor shall be responsible for providing the following registration information:
� Equipment identification (e.g., serial number) or service name (e.g., DNS name)
� Equipment public keys
� Equipment authorizations and attributes (if any are to be included in the certificate)
� Contact information to enable the CA or RA to communicate with the sponsor when
required
� The registration information shall be verified to an assurance level commensurate
with the certificate assurance level being requested. Acceptable methods for
performing this authentication and integrity checking include, but are not limited to:
o Verification of digitally signed messages sent from the sponsor (using certificates
of equivalent or greater assurance than that being requested).
o In person registration by the sponsor, with the identity of the sponsor confirmed
in accordance with the requirements of Section 3.2.3.
3.2.3.2 Human Subscriber Re-Authentication
If a human subscriber credentials containing the private keys associated with the public key
certificates are lost, damaged, or stolen, the subscriber may be issued new certificates using the
process described in this section. However, the validity period of the certificates issued using
this process shall not exceed the identity-reproofing requirements in Section 3.3.1.
Alternatively, the subscriber can undergo an initial identity proofing process described in Section
3.2.3.
25 7/25/2011