|
|
1.2. Document Name and Identification
2. PUBLICATION AND REPOSITORY RESPONSIBILITIES
2.2. Publication of certification information
2.3. Time or frequency of publication
2.4. Access controls on repositories
3. IDENTIFICATION AND AUTHENTICATION
3.2. Initial identity validation
3.3. Identification and authentication for re-key requests
3.4. Identification and authentication for revocation request
4. CERTIFICATE LIFE-CYCLE OPERATIONAL REQUIREMENTS
4.2. Certificate application processing
4.5. Key pair and certificate usage
4.9. Certificate revocation and suspension
4.10. Certificate status services
5. FACILITY, MANAGEMENT, AND OPERATIONAL CONTROLS
5.7. Compromise and disaster recovery
6. TECHNICAL SECURITY CONTROLS
6.1. Key pair generation and installation
6.2. Private Key Protection and Cryptographic Module Engineering Controls
6.3. Other aspects of key pair management
6.5. Computer security controls
6.6. Life cycle technical controls
6.7. Network security controls
7. CERTIFICATE, CRL, AND OCSP PROFILES
8. COMPLIANCE AUDIT AND OTHER ASSESSMENTS
8.1. Frequency or circumstances of assessment
8.2. Identity/qualifications of assessor
8.3. Assessor's relationship to assessed entity
8.4. Topics covered by assessment
8.5. Actions taken as a result of deficiency
9. OTHER BUSINESS AND LEGAL MATTERS
9.3. Confidentiality of business information
9.4. Privacy of personal information
9.5. Intellectual property rights
9.6. Representations and Warranties
9.7. Disclaimers of warranties
9.11. Individual notices and communications with participants
9.13. Dispute resolution provisions
9.15. Compliance with applicable law
9.16. Miscellaneous provisions
1. Introduction[Content] [RFC3647]
1.1. Overview[Content]
The purpose of KISTI GRID CA is to issue identity and service certificates for use in Grids for its community of users and/or class of applications with common security requirements.
1.2. Document Name and Identification[Content]
| IANA | 1.3.6.1.4.1 |
| KISTI(Korea Institute of Science and Technology Information) | .14305 |
| KISTI Supercomputing Center | .1 |
| KISTI GRID CA | .1 |
| CP/CPS | .1 |
| Major Version | .2 |
| Minor Version | .0 |
1.3. PKI Participants[Content]
1.3.1. Certification Authority
The KISTI GRID CA does not issue certificates to subordinate Certification Authorities.
1.3.2. Registration Authorities
The KISTI GRID CA delegates the authentication of individual identity to Registration Authorities (RA). RAs must sign an agreement with the KISTI GRID CA, stating their adherence to the procedures described in this document. RAs are not allowed to issue certificates under this CP/CPS. Every organization, whether a real or virtual organization, has only one RA who is a representative of the organization. The following is the KISTI GRID RA registration procedure:
1.3.3. Subscribers(End Entities)
The KISTI GRID PKI issues person, host and service certificates to members of KISTI and other individuals working on
The person requesting and responsible for a certificate's private key is the subscriber. The term end entity is used to refer to the holder of the private key. For a person certificate it will be the subscriber, but for a host or service certificate the end entity may be some process running on a machine.
1.3.4. Applicability
Certificates issued by the KISTI GRID CA are to be used for grid security, generally with the various globus certificate related security tools, and PKI object signing and authentication. Certificates issued by the KISTI GRID CA is only valid in the context of Grid research activities of KISTI and other research and development activities listed in 1.3.3. Any other usage including financial transaction is strictly forbidden.
1.4. Certificate Usage[Content]
1.5. Policy Administration[Content]
1.5.1. Organization administering the document
1.5.2. Contact person
For inquiries regarding this document or the KISTI GRID PKI service in general, please contact:
Sangwan Kim
Grid Technology Research Team, KISTI
305-806 Eoeun-dong 52, Yusung-gu, Daejeon, Korea
Phone: +82-42-869-0568
Fax: +82-42-869-0599
Email: ca@gridcenter.or.kr or sangwan@kisti.re.kr
Soonwook Hwang
Grid Technology Research Team, KISTI
305-806 Eoeun-dong 52, Yusung-gu, Daejeon, Korea
Phone: +82-42-869-0647
Fax: +82-42-869-0599
Email: ca@gridcenter.or.kr or hwang@kisti.re.kr
1.5.3. Person determining CPS suitability for the policy
1.5.4. CPS approval procedures
Major changes must be approved by the KISTI GRID PMA.
1.6. Definitions and Acronyms[Content]
Certification authority (CA)
An authority trusted by one or more
users to create and assign public key certificates. Optionally the CA
may create the user's keys. The CA is responsible for the public key
certificates during their whole lifetime, not just for issuing them.
CA certificate
A certificate for one CA's public key issued by another CA.
Certificate policy (CP)
A named set of rules that indicates the
applicability of a certificate to a particular community or class of
application with common security requirements. For example, a
particular certificate policy might indicate applicability of a type of
certificate to the authentication of electronic data interchange
transactions for the trading of goods within a given price range.
Certification path
An ordered sequence of certificates that, together
with the public key of the initial object in the path, can be processed
to obtain that of the final object in the path.
Certification practice statement (CPS)
A statement of the practices
that a certification authority employs in issuing certificates.
Certificate revocation list (CRL)
A time stamped list identifying
revoked certificates, which is signed by a CA and made freely available
in a public repository.
Issuing certification authority (issuing CA)
The CA that issues the
certificate (see also Subject certification authority).
Public key certificate (PKC)
A data structure containing the public
key of an end entity and some other information, which is digitally
signed with the private key of the CA that issued it.
Public Key Infrastructure (PKI)
The set of hardware, software,
people, policies and procedures needed to create, manage, store,
distribute, and revoke PKCs based on public key cryptography.
Registration authority (RA)
An entity that is responsible for
identification and authentication of certificate subjects but that does
not sign or issue certificates (i.e., an RA is delegated certain tasks
on behalf of a CA). The term Local Registration Authority (LRA) is used
elsewhere for the same concept.
Relying party
A recipient of a certificate who acts in reliance on
that certificate or on digital signatures verified using that
certificate. In this document, the terms "certificate user" and
"relying party" are used interchangeably.
Subject certification authority (subject CA)
In the context of a
particular CA-certificate, the subject CA is the CA whose public key is
certified in the certificate.
2. Publication and Repository Responsibilities[Content]
2.1. Repositories[Content]
2.1.1. Publication of CA information
KISTI GRID CA publishes the following information through its online repository.
2.1.2. Frequency of Publication
2.1.3. Access controls
2.1.4. Repositories
2.2. Publication of certification information[Content]
Changes to this CP/CPS will be announced on the KISTI GRID PKI repository.
2.3. Time or frequency of publication[Content]
No stipulation yet.
2.4. Access controls on repositories[Content]
3. Identification and Authentication[Content]
3.1. Naming[Content]
3.1.1. Types of Names
Identification of certificates will be according to X.500 distinguished name. (RFC2459)
3.1.2. Name Meanings
The following table shows attribute values for name.
Both the Organization Name 3 and Common Name are decided based on the data provided by subscribers when requesting certificates.
| attributes | meaning | value |
| countryName | Country name | KR |
| organizationName | Organization Name 1 | KISTI |
| organizationName | Organization Name 2 | GRID |
| organizationName | Organization Name 3 | Based on application information |
| commonName | User name(client certificate) | |
| Host name(server certificate) |
3.1.3. Rules of interpreting various name forms
Identification will be according to the rule in the previous section[3.1.2].
3.1.4. Uniqueness of Names
3.1.5. Name claim dispute resolution procedure
No Stipulation
3.1.6. Recognition, authentication and role trademarks
No Stipulation
3.1.7. Method to prove possession of private key
3.1.8. Authentication of organization identity
If the name of an organization is requested to be part of subject name, the KISTI Grid CA may take steps to ascertain that the organization consent to such use.
3.2. Initial Identity Validation[Content]
User:
Host or Service certificate:
3.3. Identification and Authentication for Re-key Requests[Content]
3.4. Identification and Authentication for Revocation Requests[Content]
4. Certificate Life-Cycle Operational Requirements[Content] [RFC3647]
4.1. Certificate Application[Content] [RFC3647]
4.2. Certificate Application Processing[Content] [RFC3647]
4.3. Certificate Issuance[Content] [RFC3647]
4.4. Certificate Acceptance[Content] [RFC3647]
4.5. Key Pair and Certificate Usage[Content] [RFC3647]
4.6. Certificate Renewal[Content] [RFC3647]
4.7. Certificate Re-key[Content] [RFC3647]
See section 3.3.4.8. Certificate Modification[Content] [RFC3647]
No stipulation4.9. Certificate Revocation and Suspension[Content] [RFC3647]
4.9.1. Circumstances for Revocation
A certificate must be revoked when information it contains is suspected to be incorrect or compromised. This includes situations where:
4.4.2. Who Can Request Revocation
KISTI GRID CA will accept a revocation request made by
4.9.3. Procedure for Revocation Req
Entities requesting revocation of a certificate must authenticate themselves in one of the following ways:
In both case above, the requesting entity must specify the reason for the revocation request and provide evidence of circumstances as described in section 4.4.1.
4.9.4. Revocation request grace period
4.9.5. Circumstances for Suspension
KISTI GRID CA does not support Certificate Suspension.
4.9.6. CRL Issuance Frequency
4.10. Certificate Status Services[Content] [RFC3647]
No stipulation.4.11. End of Subscription[Content] [RFC3647]
No stipulation.4.12. Key Escrow and Recovery[Content] [RFC3647]
No stipulation.5. Management, Operational, and Physical Controls[Content] [RFC3647]
5.1. Physical Security Controls[Content] [RFC3647]
The CA operates in a controlled environment, where access is restricted to authorized people.
5.1.1. Site Location
KISTI GRID PKI is located at Grid Technology Research Team, KISTI Supercomputing Center, Daejeon, Korea.
5.1.2. Physical Access
Physical access to the KISTI GRID CA machine is restricted to authorized personnel.
The KISTI Grid CA machines are:
5.1.3. Power and Air Conditioning
The CA signing machine and the CA web server are both protected by uninterruptible power supplies. Environment temperature in rooms containing CA related equipment is maintained at appropriate levels by suitable air conditioning systems.
5.1.4 Water exposures
No stipulation
5.1.5 Fire Prevention and Protectionr
The building housing the KISTI GRID CA facilities has a fire alarm system.
5.1.6 Media storage
The KISTI GRID CA key and backup copies of CA related information is securely kept in several removable storage media.
5.1.7 Waste Disposal
Wastes carrying potential confidential information such as old floppy disks are physically destroyed before being trashed.
5.1.8 Off-Site Backup
No off-site backups are currently performed.
5.2. Procedural Controls[Content] [RFC3647]
5.3. Personnel Security Controls[Content] [RFC3647]
All access to the servers and applications that comprise the KISTI GRID PKI is limited to KISTI GRID PKI security staffs.
5.3.1 Background Checks and Clearance Procedures for CA Personnel
CA personnel are recruited from the KISTI Supercomputing Center.
5.3.2 Background Checks and Security Procedures for Other Personnel
No other personnel is authorized to access KISTI GRID CA facilities without the physical presence of CA personnel.
5.3.3 Training Requirements and Procedures
Internal training is given to CA operators.
5.3.4 Training Period and Retraining Procedures
No Stipulation
5.3.5 Frequency and Sequence of Job Rotation
No stipulation.
5.3.6 Sanctions Against Personnel
No Stipulation.
5.3.7 Controls on Contracting Personnel
No Stipulation
5.3.8 Documentation Supplied to Personnel
- Copies of this document
- KISTI GRID CA Operations Manual
5.4. Audit Logging Procedures[Content] [RFC3647]
The KISTI Grid CA will retain records as much as possible so that the KISTI Grid CA could trace anything if something illegal would happen. Such audit information is not publicly available. Auditors are allowed to access the information as part of auditing and such information must be kept confidential.
5.4.1. Types of Events Recorded
5.4.2. Frequency of processing logs
No Stipulation.
5.4.3. Retention Period for Audit Logs
Logs will be kept for a minimum of 3 years.
5.5. Records Archival[Content] [RFC3647]
5.5.1. Types of Event Recorded
5.5.2. Retention Period for Archive
The minimum retention period is 3 years.
5.5.3. Protection of Archive
System logs and email archives are protected by the authorization mechanism provided by Unix operating system. Only the owners of the system logs are able to modify the logs. System logs and email archives are periodically back-up to the offline media which is stored in a safe place.
5.5.4. Requirements for Time-Stamping of Records
All archived logs and documents are time stamped.
5.6. Key Changeover[Content] [RFC3647]
5.6.1. User Certificate Validity Date
A user certificates including host/service certificate will require renewal within its validity period, which will not exceed one year.
5.6.2. CA Certificate Validity Date
5.7. Compromise and Disaster Recovery[Content] [RFC3647]
5.8. CA or RA Termination[Content] [RFC3647]
Before KISTI GRID CA terminates its services it will:
6. Technical Security Controls[Content] [RFC3647]
6.1. Key Pair Generation and Installation[Content] [RFC3647]
6.1.1. Key Pair Generation
6.1.2. Private Key Delivery to Entity
The KISTI GRID CA does not generate end entities' private keys hence does not deliver private keys. User's private key could be generated by browser application in personal computer.
6.1.3. Public Key Delivery to Certificate Issuer
End entity will send its public key included in CSR at time of certificate request.
6.1.4. CA Public Key Delivery to Users
CA certificate will be published on the KISTI Grid PKI repository.
6.1.5. Key Sizes
6.1.6. Public Key Parameters Generation
No stipulation
6.1.7. Parameter Quality Checking
No stipulation
6.1.8. Hardware/Software Key Generation
It is defined in this document [6.1.1 key pair generation].
6.1.9. Key Usage Purposes
KISTI GRID CA private key is the only key used for signing CRLs and Certificates for persons, servers and services.
The Certificate key Usage field must be used in accordance with the ``Internet X.509 Public Key Infrastructure Certificate and CRL profile'' [RFC 2459].
6.2. Private Key Protection and Cryptographic Module Engineering[Content] [RFC3647]
6.2.1. Private Key (n out of m) Multi person control
The CA's private key is not under (n out of m) multi-person control. But the KISTI GRID CA implements multi-person control for the access to the CA server as described in this document [5.1.2 Physical Access]. Backup copy of CA's private key is under (2 out of 3) multi-person control.
6.2.2. Private Key Escrow
Not supported.
6.2.3. Private Key Backup
The KISTI GRID private key backup is performed by CA operator and the two copies of backup key is kept encrypted in a CDROM and Memory stick respectively in a safe place where access is controlled.
6.2.4. Private Key Archival
The CA private key will not be archived.
6.3. Other Aspects of Key Pair Management[Content] [RFC3647]
6.4. Activation Data[Content] [RFC3647]
6.5. Computer Security Controls[Content] [RFC3647]
6.5.1. Specific Security Technical Requirements
6.5.2. Computer Security Rating
No stipulation.
6.6. Life Cycle Security Controls[Content] [RFC3647]
No stipulation.
6.7. Network Security Controls[Content] [RFC3647]
6.8. Time-stamping[Content] [RFC3647]
No stipulation.
7. Certificate and CRL Profiles[Content] [RFC3647]
7.1. Certificate Profile[Content] [RFC3647]
7.1.1. Version Number
X.509 v3.
7.1.2. Certificate Extensions
CA Certificates:
User Certificates:
Host Certificates:
7.1.3. Algorithm Object Identifiers
No stipulation
7.1.4. Name Forms
7.1.5. Name Constraints
No Stipulation.
7.1.6 Certificate Policy Object Identifier
See section 1.2.
7.1.7 Usage of Policy Constraints Extensions
No Stipulation.
7.1.8 Policy Qualifier Syntax and Semantics
No Stipulation.
7.2. CRL Profile[Content] [RFC3647]
CRLs are signed by the KISTI GRID CA private key and are published in a web page.
7.2.1. Version number(s)
X.509 v2.
7.2.2. CRL and CRL Entry Extensions
No stipulation.
7.3. OCSP Profile[Content] [RFC3647]
No stipulation.
8. Compliance Audit and Other Assessment[Content] [RFC3647]
8.1. Frequency of Entity Compliance Audit[Content] [RFC3647]
The KISTI GRID CA will accept at least one external Compliance Audit per year. In addition, the KISTI GRID CA performs operational self-assessment of CA/RA staff at least once per year.
8.2. Identity/Qualifications of Auditor[Content]
The CA will be audited by the other cross-certifying CAs.
8.3. Assessor's relationship to assessed entity[Content]
It is desirable that the auditor is a third-party to this PKI system
8.4. Topics Covered by Audit[Content]
Audit items will be selected based on the WebTrust criteria and minimum CA requirements enacted by the APGridPMA. The Audit must cover both compliance audit and operational audit.
8.5. Actions Taken as a Result of Deficiency[Content]
The KISTI GRID CA has the responsibility for the action to be taken as a result of deficiency. When the KSITI GRID CA receives an audit report from the auditor, it will send a report on actions to the auditor within two weeks. The report must describe actions taken as a result of deficiency and their timetable.
8.6. Communications of Results Frequency of Entity Compliance[Content]
The result of the audit will be made available to members of any policy management authorities in which the KISTI GRID CA participates. It may make the results of the audit publicly available. The decision will be made by the KISTI GRID CA in case-by-case basis.
9. Other Business and Legal Matters[Content] [RFC3647]
No fees are charged for any service provided by the KISTI GRID CA.
9.2. Financial Responsibility[Content] [RFC3647]
Accept no liability at all.
9.3. Confidentiality of Business Information[Content] [RFC3647]
9.4. Privacy of Personal Information[Content] [RFC3647]
No stipulation yet.
9.5. Intellectual Property Rights[Content] [RFC3647]
All certificate related data issued by KISTI GRID CA is not under any copyright or intellectual property protection.
9.6. Representations and Warranties[Content] [RFC3647]
No stipulation.
9.7. Disclaimers of Warranties[Content] [RFC3647]
No stipulation.
9.8. Limitations of Liability[Content] [RFC3647]
No stipulation.
9.9. Indemnities[Content] [RFC3647]
No stipulation.
9.10. Term and Termination[Content] [RFC3647]
No stipulation.
9.11. Individual notices and communications with participants[Content] [RFC3647]
No stipulation.
9.12. Amendments[Content] [RFC3647]
9.13. Dispute Resolution Procedures[Content] [RFC3647]
No stipulation.
9.14. Governing Law[Content] [RFC3647]
KISTI GRID CA is subject to Korean law.
9.15. Compliance with Applicable Law[Content] [RFC3647]
No stipulation.
9.16. Miscellaneous Provisions[Content] [RFC3647]
No stipulation.
9.17. Other Provisions[Content] [RFC3647]
No stipulation.
2.1.1. CA Obligations
CA will:
2.1.2. RA Obligations
RA will:
2.1.3. Subscriber Obligations
In all cases, subscribers will be required to:
2.1.4. Relying Party Obligations
Relying parties must:
2.1.5. Repository Obligations
2.2. Liability[Content]
2.3. Financial Responsibility[Content]
3.3. Rekey After Revocation[Content] [RFC3647]