Raytheon Company Public Key Infrastructure (PKI) Certificate Policy

Hashing:
Cryptographic
Function
Hashing Algorithm for
Certificates
Hashing Algorithm for
CRLs
Hashing Algorithm for
Pre-signed OCSP
Responses
Hashing Algorithm for
Other (i.e., not presigned)
OCSP
Responses
Issued on or
before 12/31/2010
Issued after
12/31/2010 but
before 12/31/2030
SHA-1 SHA-224 or SHA-
256
Issued after
12/31/2030
SHA-256
SHA-1 SHA-1 7 SHA-256
SHA-1 SHA-1 8 SHA-256
SHA-1 SHA-224 or SHA-
256
SHA-256
CSAs shall use the same signature algorithms, key sizes, and hash algorithms as used by the
CA to sign the certificate in question. However CRLs and pre-signed OCSP responses can be
signed using SHA-1 at all assurance levels.
Using compensating controls on the SHA-1 hashing algorithm increases the effective bit
strength to 80 bits and allows it to be effectively used through the end of 2013. The
compensating controls employed introduce validity entropy (randomness) into the unused and
least significant bits of the validity date fields.
As an exception to all of the other assertions in this section, CAs not asserting “id-raytheon-
SHA2-…..” series certificate policy OID(s) may continue to use SHA-1 for issuing end entity
certificates after 12/31/2010. OCSP Responders that only provide “certificate revocation status”
of certificates that do not possess “id-raytheon-SHA2-…..” certificate policy OIDs, may use
SHA-1 for all OCSP response types, not just for pre-signed.
After 12/31/2010, CAs operatingi 9 at medium and high assurance shall only act on certificate
requests to sign using the SHA-1 hashing algorithm if all of the following conditions are met:
1. The certificate request is generated/created by a trusted entity (e.g., RA, CA, or CSA);
and
2. The certificate request is securely submitted by a trusted entity.
6.1.6 Public Key Parameters Generation and Quality Checking
RSA keys shall be generated in accordance with ANSI X9.31. Prime numbers for RSA shall be
generated or tested for primality in accordance with ANSI X9.80.
ECDSA and ECDH keys shall be generated in accordance with FIPS 186-2. Curves from FIPS
186-3 shall be used.
7
Raytheon may decide to transition to stronger hash algorithm earlier than 12/31/2030.
8
Raytheon may decide to transition to stronger hash algorithm earlier than 12/31/2030.
9
A CA is considered operating at an assurance level, if it has been issued a certificate for that assurance
level or is issuing certificates at that assurance level.
61 7/25/2011