Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

5.6 Key Changeover
A CA uses a signing (private) key for creating certificates; however, relying parties employ the
CA certificate for the life of the Subscriber certificate beyond that signing. Therefore, CAs must
not issue Subscriber certificates that extend beyond the expiration dates of their own certificates
and public keys, and the CA certificate validity period must extend one Subscriber certificate
validity period (listed in Section 3.3) past the last use of the CA private key.
To minimize risk to the PKI through compromise of a CAs key, the private signing key shall be
changed more frequently, and only the new key shall be used for certificate signing purposes
from that time. The older, but still valid, certificate shall be available to verify old signatures until
all of the Subscriber certificates signed under it have also expired. If the old private key is used
to sign CRLs that contain certificates signed with that key, then the old key must be retained
and protected. For a thorough discussion of key changeover, see Certificate Management
Protocol [RFC2510].
The following table provides the life times for certificates and associated private keys.
Key 1024 Bits 2048 Bit Keys
Private Key Certificate Private Key Certificate
Root CA 5 years 5 years 15 years 20 years
Signing CA 5 years 5 years 6 years 8 years
Subscriber Identity or 3 years 3 years 3 years 3 years
Signature
Subscriber Encryption 3 years 3 years 3 years 3 years
Code Signer 3 years 3 years 5 years 5 years
Device 3 years 3 years 3 years 3 years
For additional constraints on certificate life and key sizes, see Section 6.1.5.
5.7 Compromise and Disaster Recovery
5.7.1 Incident and Compromise Handling Procedures
If a CA or CSA detects a potential hacking attempt or other form of compromise, it shall perform
an investigation in order to determine the nature and the degree of damage. If the CA or CSA
key is suspected of compromise, the procedures outlined in Section 5.7.3 shall be followed.
Otherwise, the scope of potential damage shall be assessed in order to determine if the CA or
CSA needs to be rebuilt, only some certificates need to be revoked, and/or the CA or CSA key
needs to be declared compromised.
The RPMA members shall be notified if any of the following cases occur:
� Suspected or detected compromise of the Raytheon PKI system;
� Physical or electronic attempts to penetrate the Raytheon PKI system;
� Denial of service attacks on a Raytheon PKI component; or
� Any incident preventing the Raytheon PKI from issuing a CRL within 24 hours of the time
specified in the next update field of its currently valid CRL.
The RPMA, CPMA and all cross certified PKIs shall be notified if any of the following cases
occur:
� A CA certificate revocation is planned; or
55 7/25/2011