Archive Collateral

[1] The Key Ceremony Administrator ensures that every Key Ceremony and every ceremony related activity is secure and auditable. This means that there must be an unbroken evidentially path demonstrating that your Certificate system is operated in accordance with the methods and procedures described in your organization’s Certificate Practice Statement [2]. In addition to the witnessed script, video record of key ceremonies and logging protocols provide further documentation of the CA creation process. Each of these is explained in the following sub sections:

Archive Folder

An Archive Folder must be compiled for every Key Ceremony. The folder should include the Naming Document, the witnessed Key Ceremony Script, the Key Access Component Holder Documents, the Attestation Letters and the Key Map. After the ceremony, the Archive Folder is stored in the secure storage area. This Folder and the video recording provide the primary record of all key ceremonies performed by the organization.

The Archive Folder documents the Key Ceremony and provides evidence of the secure manner in which the CA was created. The Archive Folder is divided into three parts as described in the following sub sections:

1.Naming Document

2.Key Map

3.Key Access Component Holder Documents

4.Attestation Letter

• Naming Document

The Naming document(s) is associated with the CA(s) that were generated using the Key Ceremony Script that was initialed by the witnesses. The Naming Document and Key Ceremony Script are described earlier in this section.



• Key Map

The Key Map document is associated with the CA(s) that were generated using the Key Ceremony Script that was initialed by the witnesses. The Key Map and Key Ceremony Script are described earlier in this section.

• Key Access Component Holder Documents

There is one Key Access Holder Component Document used for each Key Access Component Holder (a dedicated Card Holder within a defined Key Access Component Card Set, that protects access to the private key stored on a cryptographic device), that provides photographic identification of each Key Access Component Holder. The document also contains the date, the name of the CA, the Card Set Name, Card Serial Number, Private Key Common Name and the Key Access Component Holder’s responsibilities as they relate to card he holds. During the distribution event, at the end of the Key Ceremony, all the Key Access Component Holders sign each page of their respective Key Access Component Holder Document to indicate they understand their responsibilities. The document is dated and is initialed by the Key Ceremony Administrator and cross signed by the Notary, or equivalent public official. A sample Key Access Component Holder Document can be seen in Appendix V.



• Attestation Letter

Every step of the Key Ceremony Script is verified by the witnesses and each page of the Script is initialed as it is completed during the ceremony. At the end of the Key Ceremony, the witnesses then sign the Attestation Letter to provide further documentation that the published procedures were followed. The Attestation Letter is dated and initialed by the Key Ceremony Administrator and cross signed by the Notary, or equivalent public official to certify the signatures on the Letter. See the sample Attestation Letter is in Appendix VI.