Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

6 TECHNICAL SECURITY CONTROLS
6.1 Key Pair Generation and Installation
6.1.1 Key Pair Generation
The following table provides the requirements for key pair generation for the various entities.
Entity FIPS 140-1/2
Level
Hardware or
Software
Same Module
CA 3 Hardware Same
RA 2 Hardware Same
CSA 2 Hardware Same
Code Signing 2 Hardware Same
End Entity Signature or
Authentication (mediumsoftware
and medium-
CBP-software)
1 Software No Requirement
End Entity Encryption
(medium-software and
medium-CBP-software)
End Entity Signature or
Authentication (mediumhardware,
medium-
CBP-hardware and highhardware)
End Entity Encryption
(medium-hardware,
medium-CBP-hardware
and high-hardware)
Server (medium-software
and medium-CBP-
software)
Server (medium-hardware,
medium-CBP-hardware,
and high-hardware)
1 Software No Requirement
2 Hardware Same
2 Hardware No Requirement
1 Software
2 Hardware
No Requirement
Same
Random numbers for medium-hardware, medium-CBP-hardware, and high-hardware assurance
level keys shall be generated in FIPS 140 Level 2 validated hardware cryptographic modules.
When private keys are not generated on the token to be used, originally generated private keys
shall be destroyed after they have been transferred to the token. This does not prohibit the key
generating modules to act as the key escrow module also.
Multiparty control shall be used CA key pair generation, as specified in Section 5.2.2.
CA key pair generation process shall create a verifiable audit trail that the security requirements
for procedures were followed. The documentation of the procedure shall be detailed enough to
58 7/25/2011