ETSI 101 456-1

[1] In response to ETSI 101 456 sub section 7.1 Note 1 and Note 2, the Digi-CAST3™ Team in conjunction with the certified BS 7799 Trust Centre Team will ensure that all documentation, subscriber agreements, Certificate Policy and Certificate Practice Statement [2] are up to date and publicly available.

In response to ETSI 101 456 sub section 7.2.1 and 7.2.2 the key generation is undertaken in a physically secured environment by personnel in trusted roles under dual control. The number of personnel authorized to carry out this function is kept to a minimum and is consistent with the Trust Centre practices.

Both the private signing key is held and the key generation is carried out within the secure cryptographic Eracom Host Orange Hardware Security Module [HSM] device that is certified to FIPS PUB 140-2 level 3 and meets the requirements identified in CEN Workshop Agreement 14167-2 [8] and the keys are not accessible outside the HSM.

The key generation is performed using the RSA algorithm that is a minimum of 1024 bits and is recognized as being fit for the purposes of qualified certificates.

The Digi-CA™ [3] private signing is backed up, stored and recovered only by personnel in trusted roles using dual control in a physically secured environment. The number of personnel authorized to carry out this function are kept to a minimum and be consistent with the Digi-CA’s™ practices and backup copies of the Digi-CA™ private signing keys are subject to a greater level of security controls than the keys currently in use.

In response to ETSI 101 456 sub section 7.2.3 the Digi-CA™ signature verification (public) keys are made available to relying parties by combining the public LDAP directory, Certificate Revokation List and OCSP [4] Service.

In response to ETSI 101 456 sub section 7.2.4 the Digi-CA™ and subject private signing keys are not held in a way which provides a backup decryption capability, allowing authorized entities under certain conditions to decrypt data using information supplied by one or more parties (commonly called key escrow).

In response to ETSI 101 456 sub section 7.2.5 the Digi-CA™ signing key(s) used for generating certificates and/or issuing revocation status information, is not be used for any other purpose and the certificate signing keys are only be used within the physically secure Trust Centre.

In response to ETSI 101 456 sub section 7.2.6 the Digi-CA™ private signing keys are not used beyond the end of their life cycle and all copies of the Digi-CA™ private signing keys are destroyed such that the Private Keys cannot be retrieved; or are retained in a manner such that they are protected against being put back into use.

In response to ETSI 101 456 sub section 7.2.7 the certificate signing cryptographic hardware was not tampered with during shipment and neither was the certificate and revocation status information signing cryptographic hardware. The installation, activation, back-up and recovery of the Digi-CA’s™ signing keys in cryptographic hardware requires simultaneous control of at least of two trusted employees and certificate and revocation status information signing cryptographic hardware is functioning correctly. The Digi-CA™ private signing keys stored on Digi-CA™ cryptographic hardware will be destroyed upon device retirement.

In response to ETSI 101 456 sub section 7.2.9 the secure signature creation device preparation is securely controlled by the service provider and then stored and distributed. Secure signature creation device deactivation and reactivation is securely controlled, where it has associated user activation data. The activation data is securely prepared and distributed separately from the secure signature creation device.

In response to ETSI 101 456 sub section 7.3.1 the Digi-CA™ ensures that subjects are properly identified and authenticated; and that subject certificate requests are complete, accurate and duly authorized. Before entering into a contractual relationship with a subscriber, the Digi-CA™ informs the subscriber of the terms and conditions regarding the use of the certificate. The Digi-CA™ communicates this information through a durable (i.e. with integrity over time) means of communication, which may be transmitted electronically, and in readily understandable language. The service provider verifies by appropriate means in accordance with national law, the identity and, if applicable, any specific attributes of the person to which a qualified certificate is issued. Evidence of the identity is checked against a physical person either directly or indirectly using means which provides equivalent assurance to physical presence and the submitted evidence may be in the form of either paper or electronic documentation. Where the subject is a person, the evidence provided is of full name, date and place of birth, a nationally recognized number, or other attributes that is used to, as far as possible, distinguish the person from others with the same name.

Where the subject is a person who is identified in association with a legal person, or other organizational entity, the evidence provided is of full name, date and place of birth, a nationally recognized identity number, or other attributes of the subject which is used to, as far as possible, distinguish the person from others with the same name; full name and legal status of the associated legal person or other organizational entity, any relevant existing registration information (e.g. company registration) of the associated legal person or other organizational entity and an evidence that the subject is associated with the legal person or other organizational entity. The subscriber provides a physical address, or other attributes, which describe how the subscriber may be contacted. The Digi-CA™ records all the information used to verify the subjects' identity, including any reference number on the documentation used for verification, and any limitations on its validity.

The Digi-CA™ also records the signed agreement with the subscriber including agreement to the subscriber's obligations, agreement to use a SSCD if required, consent to the keeping of a record by the Digi-CA™ of information used in registration, subject device provision, any subsequent revocation, and passing of this information to third parties under the same conditions as required by this policy in the case of the Digi-CA™ terminating its services, whether and under what conditions, the subscriber requires and the subject's consents to the publication of the certificate and confirmation that the information held in the certificate is correct.

The records identified above are retained for at the period of time as indicated to the subscriber and as necessary for the purposes for providing evidence of certification [5] in legal proceedings. If the Digi-CA™ does not generate the subject’s key pair, the certificate request process ensures that the subject has possession of the Private Key associated with the Public Key presented for certification and the CA ensures that the requirements of the national data protection legislation are adhered to (including the use of pseudonyms if applicable) within their registration process.

In response to ETSI 101 456 sub section 7.3.2 the Digi-CA™ checks that the information used to verify the identity and attributes of the subject is still valid and if any of the Digi-CA™ terms and conditions have changed, these shall be communicated to the subscriber and agreed. If any information has changed, this is verified, recorded, agreed to by the subscriber, the Digi-CA™ issues a new certificate using the subject's previously certified Public Key, only if its cryptographic security is still sufficient for the new certificate's intended lifetime and no indications exist that the subject's Private Key is compromised.

In response to ETSI 101 456 sub section 7.3.3 the Digi-CA™ ensures that it issues certificates securely to maintain their authenticity and the procedure of issuing the certificate is securely linked to the associated registration, certificate renewal or rekey, including the provision of any subject generated Public Key. If the Digi-CA™ generated the subject’s key, the procedure of issuing the certificate is securely linked to the generation of the key pair by the Digi-CA™ and the Private Key is securely passed to the registered subscriber or subject. The Digi-CA™ ensures over time the uniqueness of the distinguished name assigned to the subject within the domain of the Digi-CA™. (i.e. over the life time of the Digi-CA™ a distinguished name which has been used in an issued certificate shall never be re-assigned to another entity) and the confidentiality and integrity of registration data shall be protected especially when exchanged with the subscriber, subject or between distributed Digi-CA™ system components. The Digi-CA™ also verifies that registration data is exchanged with recognized registration service providers, whose identity is authenticated, in the event that external registration service providers are used.

In response to ETSI 101 456 sub section 7.3.4 the Digi-CA™ makes available to subscribers and relying parties the terms and conditions regarding the use of the certificate, the qualified certificate policy being applied, including a clear statement as to whether the policy is for certificates issued to the public and whether the policy requires uses of a SSCD, any limitations on its use, the subscriber's obligations including whether the policy requires uses of a SSCD, information on how to validate the certificate including requirements to check the revocation status of the certificate, such that the relying party is considered to "reasonably rely" on the certificate, limitations of liability including the purposes/uses for which the Digi-CA™ accepts (or excludes) liability, the period of time which registration information is retained, the period of time which Digi-CA™ event logs are retained, procedures for complaints and dispute settlement, the applicable legal system; and if the Digi-CA™ has been certified to be conformant with the identified qualified certificate policy, and if so through which scheme. The information identified is available through a durable (i.e. with integrity over time) means of communication, which is transmitted electronically, and in readily understandable language.

In response to ETSI 101 456 sub section 7.3.5 upon generation, the complete and accurate certificate is available to subscriber or subject for whom the certificate is being issued and certificates are available for retrieval in only those cases for which the subject's consent has been obtained. The Digi-CA™ makes available to relying parties the terms and conditions regarding the use of the certificate and the applicable terms and conditions are readily identifiable for a given a certificate. The information identified is available 24 hours per day, 7 days per week. Upon system failure, service or other factors, which are not under the control of the Digi-CA™, the Digi-CA™ makes best endeavours to ensure that this information service is not unavailable for longer than a maximum period of time as denoted in the certification practice statement. The information identified is publicly and internationally available.

In response to ETSI 101 456 sub section 7.3.6 the Digi-CA™ ensures that certificates are revoked in a timely manner based on authorized and validated certificate revocation requests and documents, as part of its certification practice statement the procedures for revocation of certificates including who may submit revocation reports and requests, how they may be submitted, any requirements for subsequent confirmation of revocation reports and requests, whether and for what reasons certificates may be suspended, the mechanism used for distributing revocation status information and the maximum delay between receipt of a revocation request or report and the change to revocation status information being available to all relying parties. This is at most 1 day. Requests and reports relating to revocation (e.g. due to compromise of subject's Private Key, death of the subject, unexpected termination of a subscriber's or subject's agreement or business functions, violation of contractual obligations) are processed on receipt and checked to be from an authorized source. Such reports and requests are confirmed as required under the Digi-CA’s™ practices.

A certificate's revocation status is set to suspended whilst the revocation is being confirmed. The Digi-CA™ ensures that a certificate is not kept suspended for longer than is necessary to confirm its status. The subject, and where applicable the subscriber, of a revoked or suspended certificate, is informed of the change of status of its certificate and once a certificate is definitively revoked (i.e. not suspended) it is not reinstated. Where Certificate Revocation Lists (CRLs) including any variants (e.g. Delta CRLs) are used, these are published at least daily and every CRL is stated a time for next CRL issue and a new CRL may be published before the stated time of the next CRL issue. The certification authority signs the CRL or an authority designated by the Digi-CA™. Revocation management services and Revocation status information are available 24 hours per day, 7 days per week. Upon system failure, service or other factors, which are not under the control of the Digi-CA™, the Digi-CA™ makes best endeavours to ensure that this service is not unavailable for longer than a maximum period of time as denoted in the certification practice statement. The integrity and authenticity of the status information is protected and Revocation status information is publicly and internationally available.