**CPWG Mapping Comparison Matrix**

**Federal Bridge Certification Authority (FBCA)**

**and the XXXX**

**For cross certification at a**

**Rudimentary Level of Assurance**

**Version 1.1 13 July 2005**

Table of Contents

[1.0 INTRODUCTION 3](#introduction)

[2.0 EXECUTIVE SUMMARY 3](#executive-summary)

[3.0 BRIEF ASSESSMENT 5](#brief-assessment)

[4.0 DETAILED ASSESSMENT 6](#detailed-assessment)

[5.0 REFERENCES 12](#references)

[6.0 CONTACT DETAILS 13](#contact-details)

# 

# 

#  

# **1.0 INTRODUCTION**

The purposes of this certificate policy comparison, in relation to the
comparison study conducted with XXXX \[2\] and the FBCA CP \[3\], are:

> 1\) To identify at a rudimentary level the most severe areas of
> inconsistency and/or similarity between the contents of these two
> Certificate Policy (CP) documents to cross certify at a Rudimentary
> Level of Assurance,
>
> 2\) To identify at a rudimentary level the areas of consistency and/or
> similarity between the contents of these two Certificate Policy (CP)
> documents to cross certify at a Rudimentary Level of Assurance, and
>
> 3\) To recommend appropriate changes, if required, to XXXX \[2\] that
> would make it more consistent with the FBCA CP \[3\];

This document is organized to achieve these purposes in the following
sections:

> 1\) **EXECUTIVE SUMMARY**, which provides a high-level overview of the
> PKIs represented by the Certificate Policies being compared in this
> analysis as well as an overview of the findings of this mapping
> comparison,
>
> 2\) **BRIEF ASSESSMENT**, which provides a brief indication of the
> degree of similarity of each XXXX as compared to the FBCA CP by
> indicating the evaluation term used in each main subsection of the CP;
> and
>
> 3\) **DETAILED ASSESSMENT**, which presents a detailed breakdown of
> the requirements in the FBCA CP, Section by Section, and categorizes
> the degree of similarity of the XXXX requirements to the FBCA CP.
> Comments to explain the rationale for the degree of similarity are
> also provided. The topical and organizational framework used as a
> basis for this comparison is Request for Comments (RFC) 2527, the
> Internet X.509 Public Key Infrastructure Certificate Policy and
> Certification Practices Framework \[1\].

# **2.0 EXECUTIVE SUMMARY**

The Federal Bridge Certification Authority (FBCA) is the unifying
element to link autonomous Certification Authorities (CA's) into a
systematic overall Public Key Infrastructure (PKI). The FBCA functions
as a non-hierarchical hub allowing relying parties to create certificate
trust paths from their PKI domains back to the PKI domain of the
Certification Authority that issued the certificate, so that the levels
of assurance honored by disparate PKI's can be reconciled.

The General Services Administration (GSA), under the auspices of the
Federal Public Key Infrastructure Policy Authority (FPKIPA) and the
Federal PKI Steering Committee (FPKISC) operates the FBCA. In order to
promote interoperability and the appropriate use of certificate
policies, the FBCA has issued a minimum set of operational requirements
that support trust path creation and verification of digital
certificates. The FBCA will issue cross-certificates to other autonomous
Principal CA's, and then only when authorized by the FPKIPA. Initially,
autonomous CA's that operate in trust domains that meet the requirements
established by the FPKIPA will be eligible to cross-certify with the
FBCA.

The FBCA is designed to provide a mechanism for entities employing
entity-specific PKI's to interoperate efficiently. The FBCA allows
entities to create and process trust paths between specific PKI's, so
that digital certificates issued by one CA can be honored with an
appropriate level of trust \[or assurance\] by a different CA.

The FBCA acts as a non-hierarchical \"hub.\" A Principal CA receives
permission to interoperate with the FBCA under terms and conditions
described in the application for cross certification. This system will
allow every CA that cross certifies with the FBCA the possibility of
interoperating with all participating entities using FBCA-issued cross
certificates, in an environment of trust and reliability. This is
accomplished through the use of policy mapping, which is how
certificates issued in different Entity PKIs meet one another\'s
standards for authentication, integrity of data, non-repudiation, and
encryption of data. Policy mappings between the autonomous Principal CA
and the FBCA are proposed by the entity and approved by the FPKIPA, and
then placed in the certificate issued by the FBCA to the autonomous
Principal CA's.

When the Applicant is determining whether to rely on a certificate
issued by another Entity or party, it is not required to use the mapping
expressed in the FBCA certificates. The Applicant, at its sole
discretion, may choose to use a separate mapping for certain
transactions or for all transactions.

The XXXX operates a PKI to provide security for its electronic
information. The XXXX consists of products and services that provide and
manage X.509v3 certificates for public-key cryptography. A XXXX digital
certificate identifies the individual named in the certificate
requestor/holder, and binds that person to a unique public/private key
pair.

[]{.mark}

Programs that carry out or support XXXX missions may require the type of
security services provided by a PKI such as authentication,
confidentiality, encryption, non-repudiation, and access control. These
services are met with an array of network security components such as
web servers, guards, firewalls, routers, and trusted database servers.
The operation of these components is supported and complemented by use
of public-key cryptography. As a system solution, the components share
the burden of the total system security. The use of public key
certificates does not add any security services in a poorly designed or
implemented system. The reliability of the public-key cryptography
portion of the security solution is a direct result of the secure and
trustworthy operation of an established PKI, including equipment,
facilities, personnel, and procedures.

The XXXX Certificate Policy (CP) follows and complies with the Internet
Engineering Task Force (IETF) Request for Comment (RFC) 2527, X.509 PKI
CP and Certification Practices Framework. The XXXX defines the primary
obligations and operational responsibilities of all XXXX program
participants, and defines the creation, management and use of X.509
Version 3 digital certificates. The XXXX defines the applicability of
assurance levels for the protection of information based on its value or
sensitivity, the risk and the consequences of loss, disclosure or
modification.

This Rudimentary Level CP mapping comparison identifies any differences
between the FBCA CP and XXXX based on a set of predetermined evaluation
terms, defined in the [BRIEF ASSESSMENT](#brief-assessment). The results
of this comparison identify the sections that require modification to
facilitate policy compatibility and interoperability of the underlying
technology and operations.

# 

# **3.0** **BRIEF ASSESSMENT**

This section of the report contains the mapping table results,
representing a high level view of the mapping comparison between the
FBCA CP \[3\] and the XXXX \[2\]. This brief assessment in conjunction
with the detailed assessment of CP parameters mapped at the Rudimentary
Level of Assurance, verify that the XXXX is compliant with the FBCA CP
for a cross certification with the FBCA at a Rudimentary Level of
Assurance.

The "Brief Assessment" table provides a quick evaluation list to
facilitate the quick identification that the XXXX was evaluated against
and the "Overall Match" status as compared to the FBCA CP requirement.
This table presents a concise indication of the degree of conformity
between the XXXX \[2\] and the FBCA CP \[3\] at the Rudimentary Level of
Assurance. The XXXX Section column is left blank if it is the same as
the FBCA Section for the data being analyzed, if a different Section
number reference has been inserted, it is the corresponding Section in
the XXXX that carries the data that is being compared.

The Brief Assessment table contains four main columns described as
follows:

1)  **FBCA** -- identifies the section numbers for each of the CPs

2)  **XXXX Section Topics** -- identifies the CP framework section
    titles corresponding to the section numbers. If there is not a
    corresponding section in one of the CPs, it is indicated with "N/A"
    for Not Applicable.

3)  **Section Topic** - Title Category

4)  **Evaluation Summary --** displays the corresponding evaluation
    result, which indicates the *lowest* degree of conformity contained
    within each section.

The following seven evaluation terms and their definitions, listed in
order of degree of conformity, were used to assess the **XXXX** CP
alignment to the FBCA CP elements:

1)  **Exceeds** - The **XXXX** CP policy provides a higher level of
    assurance/security than the FBCA CP requirement

2)  **Equivalent** - The **XXXX** CP policy provides exactly the same
    assurance/security as the FBCA CP requirement.

3)  **Comparable** - The **XXXX** CP contains dissimilar policy
    contents, but provides a comparable level of assurance to meet the
    security to the FBCA CP requirement.

4)  **Partial** - The **XXXX** CP contains policy that is comparable,
    but it does not address the entire FBCA CP requirement.

5)  **Not Comparable** - The **XXXX** CP contains dissimilar policy
    contents, which provides a lower level of assurance/security than
    the FBCA CP requirement.

6)  **Missing** - The **XXXX** CP does not contain policy contents that
    can be compared to the FBCA CP requirement in any way.

7)  **N/A** -- Not Applicable to **XXXX** CP or required for FBCA cross
    certification.

RUDIMENTARY LEVEL OF ASSURANCE MAPPING RESULTS

+-----+----------+-------------------------------------+---------------+
| **F | **XXXX** | **Section Topic**                   | **Evaluation  |
| BCA |          |                                     | Summary**     |
| Sec | **S      |                                     |               |
| tio | ection** |                                     |               |
| n** |          |                                     |               |
+=====+==========+=====================================+===============+
| **[ |          | **[INTRODUCTION]{.mark}**           |               |
| 1.] |          |                                     |               |
| {.m |          | []{.mark}                           |               |
| ark |          |                                     |               |
| }** |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 1.2 |          | Identification                      |               |
+-----+----------+-------------------------------------+---------------+
| 1.  |          | Applicability                       |               |
| 3.4 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| **[ |          | **[GENERAL PROVISIONS]{.mark}**     |               |
| 2.] |          |                                     |               |
| {.m |          |                                     |               |
| ark |          |                                     |               |
| }** |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 2.  |          | Frequency of Entity Compliance      |               |
| 7.1 |          | Audit                               |               |
+-----+----------+-------------------------------------+---------------+
| **[ |          | **[IDENTIFICATION AND               |               |
| 3.] |          | AUTHENTICATION]{.mark}**            |               |
| {.m |          |                                     |               |
| ark |          |                                     |               |
| }** |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 3.  |          | Types of Names                      |               |
| 1.1 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 3.  |          | Authentication of Individual        |               |
| 1.9 |          | Identity                            |               |
+-----+----------+-------------------------------------+---------------+
| 3.  |          | Certificate Re-key                  |               |
| 2.1 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| **[ |          | **[OPERATIONAL                      |               |
| 4.] |          | REQUIREMENTS]{.mark}**              |               |
| {.m |          |                                     |               |
| ark |          |                                     |               |
| }** |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 4.  |          | Delivery of public key for          |               |
| 1.1 |          | certificate issuance                |               |
+-----+----------+-------------------------------------+---------------+
| 4   |          | CARL/CRL Issuance Frequency         |               |
| .4. |          |                                     |               |
| 3.1 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 4.5 |          | Security Audit Procedure            |               |
+-----+----------+-------------------------------------+---------------+
| 4.  |          | Frequency of processing data        |               |
| 5.2 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 4.  |          | Types of events archived            |               |
| 6.1 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 4.  |          | Retention period for archive        |               |
| 6.2 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| **[ |          | **[PHYSICAL, PROCEDURAL AND         |               |
| 5.] |          | PERSONNEL SECURITY                  |               |
| {.m |          | CONTROLS]{.mark}**                  |               |
| ark |          |                                     |               |
| }** |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 5.  |          | Separation of Roles                 |               |
| 2.2 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 5.  |          | Identification and authentication   |               |
| 2.4 |          | for each role                       |               |
+-----+----------+-------------------------------------+---------------+
| **[ |          | **[TECHNICAL SECURITY               |               |
| 6.] |          | CONTROLS]{.mark}**                  |               |
| {.m |          |                                     |               |
| ark |          |                                     |               |
| }** |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 6.  |          | FBCA and CA key pair generation     |               |
| 1.1 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 6.  |          | Hardware/Software Subscriber key    |               |
| 1.8 |          | generation                          |               |
+-----+----------+-------------------------------------+---------------+
| 6.  |          | Key usage purposes (as per X.509 v3 |               |
| 1.9 |          | key usage field)                    |               |
+-----+----------+-------------------------------------+---------------+
| 6.  |          | Standards for cryptographic module  |               |
| 2.1 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 6   |          | Backup of subscriber private        |               |
| .2. |          | signature key                       |               |
| 4.2 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 6.  |          | Activation data generation and      |               |
| 4.1 |          | installation                        |               |
+-----+----------+-------------------------------------+---------------+
| **[ |          | **[CERTIFICATE AND CARL/CRL         |               |
| 7.] |          | PROFILES]{.mark}**                  |               |
| {.m |          |                                     |               |
| ark |          |                                     |               |
| }** |          |                                     |               |
+-----+----------+-------------------------------------+---------------+
| 7.  |          | Certificate Extensions              |               |
| 1.2 |          |                                     |               |
+-----+----------+-------------------------------------+---------------+

# **4.0 DETAILED ASSESSMENT**

This section of the report presents the mapping comparison results for
the FBCA CP and the XXXX for Rudimentary Level of Assurance
requirements. This mapping comparison report works in conjunction with
the FPKIPA/CPWG General Requirements CP Mapping Matrix report \[4\],
**dated DD MM YYYY**. Following are the specific Rudimentary Level CP
requirements for mapping to the FBCA CP. The mapping comparison is
characterized using the evaluation terms listed in the [BRIEF
ASSESSMENT](#brief-assessment).

The detailed mapping results provide the FBCA and requirements to be
mapped, the XXXX and appropriate applicable policy text, the evaluation
result for each requirement element addressed by the XXXX, as well as
the evaluation comments. By default, the evaluation results listed in
the "Overall Match" field indicates all results when multiple policy
elements from the XXXX are mapped to a particular FBCA CP requirement.

+------+--------------+------------------------------------------------+
| T    | **CP         | **Mapping Phrase**                             |
| able | Section**    |                                                |
| No.  |              |                                                |
+======+==============+================================================+
| 1.   | FBCA:        | The OIDs are registered under the id-infosec   |
|      |              | arc as follows:                                |
|      | **1.2**      |                                                |
|      |              | id-fpki-certpcy-rudimentaryAssurance           |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 2.   | FBCA:        | The sensitivity of the information processed   |
|      |              | or protected using certificates issued by FBCA |
|      | **1.3.4**    | or an Entity CA will vary significantly.       |
|      |              |                                                |
|      |              | Rudimentary - This level provides the lowest   |
|      |              | degree of assurance concerning identity of the |
|      |              | individual. One of the primary functions of    |
|      |              | this level is to provide data integrity to the |
|      |              | information being signed. This level is        |
|      |              | relevant to environments in which the risk of  |
|      |              | malicious activity is considered to be low. It |
|      |              | is not suitable for transactions requiring     |
|      |              | authentication, and is generally insufficient  |
|      |              | for transactions requiring confidentiality,    |
|      |              | but may be used for the latter where           |
|      |              | certificates having higher levels of assurance |
|      |              | are unavailable.                               |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 3.   | FBCA:        | There is no audit requirement for CAs and RAs  |
|      |              | operating at the Rudimentary or Test levels of |
|      | **2.7.1**    | assurance.                                     |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 4.   | FBCA:        | The table below describes the naming           |
|      |              | requirements that apply to each level of       |
|      | **3.1.1**    | assurance.                                     |
|      |              |                                                |
|      |              | Rudimentary -- Non-Null Subject Name, or Null  |
|      |              | Subject Name if Alternative Subject Name is    |
|      |              | populated and marked critical                  |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 5.   | FBCA:        | The table below summarizes the identification  |
|      |              | requirements for each level of assurance.      |
|      | **3.1.9**    |                                                |
|      |              | Rudimentary - No identification requirement;   |
|      |              | applicant may apply and receive a certificate  |
|      |              | by providing his or her e-mail address         |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 6.   | FBCA:        | The process documentation and authentication   |
|      |              | requirements shall include the following       |
|      | **3.1.9**    | depending upon the level of assurance (as set  |
|      |              | forth below):                                  |
|      |              |                                                |
|      |              | -   The identity of the person performing the  |
|      |              |     identification;                            |
|      |              |                                                |
|      |              | -   A signed declaration by that person that   |
|      |              |     he or she verified the identity of the     |
|      |              |     Subscriber (including verification of any  |
|      |              |     roles or authorizations that apply to that |
|      |              |     certificate) as required by the applicable |
|      |              |     certificate policy which may be met by     |
|      |              |     establishing how the applicant is known to |
|      |              |     the verifier as required by this           |
|      |              |     certificate policy;                        |
|      |              |                                                |
|      |              | -   A unique identifying number from the ID of |
|      |              |     the verifier and, if in-person identity    |
|      |              |     proofing is done, from the ID of the       |
|      |              |     applicant;                                 |
|      |              |                                                |
|      |              | -   The date and time of the verification; and |
|      |              |                                                |
|      |              | -   A declaration of identity signed by the    |
|      |              |     applicant using a handwritten signature.   |
|      |              |     If in-person identity proofing is done,    |
|      |              |     this shall be performed in the presence of |
|      |              |     the person performing the identity         |
|      |              |     authentication.                            |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 7.   | FBCA:        | Subscribers of Entity CAs shall identify       |
|      |              | themselves for the purpose of re-keying as     |
|      | **3.2.1**    | required in table below.                       |
|      |              |                                                |
|      |              | []{.mark}                                      |
|      |              |                                                |
|      |              | Rudimentary - Identity may be established      |
|      |              | through use of current signature key           |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 8.   | FBCA:        | For all levels of assurance, this binding may  |
|      |              | be accomplished using cryptography. If         |
|      | **4.1.1**    | cryptography is used, it must be at least as   |
|      |              | strong as that employed in certificate         |
|      |              | issuance.                                      |
|      |              |                                                |
|      |              | For Rudimentary Assurance, no trusted delivery |
|      |              | mechanism is required.                         |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 9.   | FBCA:        | The following table provides CARL/CRL issuance |
|      |              | requirements.                                  |
|      | **4.4.3.1**  |                                                |
|      |              | Rudimentary --                                 |
|      |              |                                                |
|      |              | Not Applicable (Routine)                       |
|      |              |                                                |
|      |              | Not Applicable (Loss or Compromise of Private  |
|      |              | Key)                                           |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 10.  | FBCA:        | Audit log files shall be generated for all     |
|      |              | events relating to the security of the FBCA or |
|      | **4.5**      | Entity CAs.                                    |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 11.  | FBCA:        | Audit logs shall be reviewed in accordance to  |
|      |              | the table below.                               |
|      | **4.5.2**    |                                                |
|      |              | Rudimentary - Only required for cause          |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 12.  | FBCA:        | At a minimum, the following data shall be      |
|      |              | recorded for archive in accordance with each   |
|      | **4.6.1**    | assurance level:                               |
|      |              |                                                |
|      |              | -   FBCA or Entity CA accreditation (if        |
|      |              |     applicable)                                |
|      |              |                                                |
|      |              | -   Certificate Practice Statement             |
|      |              |                                                |
|      |              | -   Contractual obligations                    |
|      |              |                                                |
|      |              | -   System and equipment configuration         |
|      |              |                                                |
|      |              | -   Modifications and updates to system or     |
|      |              |     configuration                              |
|      |              |                                                |
|      |              | -   Certificate requests                       |
|      |              |                                                |
|      |              | -   All certificates issued or published       |
|      |              |                                                |
|      |              | -   Record of FBCA or Entity CA Re-key         |
|      |              |                                                |
|      |              | -   All Audit Logs                             |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 13.  | FBCA:        | The minimum retention periods for archive data |
|      |              | are identified below.                          |
|      | **4.6.2**    |                                                |
|      |              | Rudimentary -- 7 Years & 6 Months              |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 14.  | FBCA:        | The separation of roles for the FBCA and       |
|      |              | Entity CAs shall be as follows:                |
|      | **5.2.2**    |                                                |
|      |              | Rudimentary - No stipulation                   |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 15.  | FBCA:        | At all assurance levels other than             |
|      |              | Rudimentary, an individual shall identify and  |
|      | **5.2.4**    | authenticate him/herself before being          |
|      |              | permitted to perform any actions set forth     |
|      |              | above for that role or identity.               |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 16.  | FBCA:        | Cryptographic keying material for certificates |
|      |              | issued by the FBCA or Entity CAs shall be      |
|      | **6.1.1**    | generated in FIPS 140 validated cryptographic  |
|      |              | modules. For Entity CAs, the modules shall     |
|      |              | meet or exceed Security Level 1 (for           |
|      |              | Rudimentary).                                  |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 17.  | FBCA:        | For subscribers, software or hardware shall be |
|      |              | used to generate pseudo-random numbers, key    |
|      | **6.1.8**    | pairs, and symmetric keys, as set forth in the |
|      |              | table below.                                   |
|      |              |                                                |
|      |              | Rudimentary -- Software or Hardware            |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 18.  | FBCA:        | Test, Rudimentary, Basic and Medium Assurance  |
|      |              | Level certificates may include a single key    |
|      | **6.1.9**    | for use with encryption and signature in       |
|      |              | support of legacy Secure Multipurpose Internet |
|      |              | Mail Extensions (S/MIME) applications.         |
|      |              |                                                |
|      |              | Such "dual-use" certificates shall be          |
|      |              | generated and managed in accordance with their |
|      |              | respective signature certificate requirements, |
|      |              | except where otherwise noted in this CP. Such  |
|      |              | "dual-use" certificates shall never assert the |
|      |              | non-repudiation key usage bit, and shall not   |
|      |              | be used for authenticating data that will be   |
|      |              | verified on the basis of the dual-use          |
|      |              | certificate at a future time.                  |
|      |              |                                                |
|      |              | Entities are encouraged at all levels of       |
|      |              | assurance to issue Subscribers two key pairs,  |
|      |              | one for data encryption and one for digital    |
|      |              | signature and authentication.                  |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 19.  | FBCA:        | The table below summarizes the minimum         |
|      |              | requirements for cryptographic modules; higher |
|      | **6.2.1**    | levels may be used.                            |
|      |              |                                                |
|      |              | Rudimentary --                                 |
|      |              |                                                |
|      |              | Latest version of FIPS 140 series -- N/A       |
|      |              |                                                |
|      |              | Federal Bridge Certification Authority - Level |
|      |              | 3 (Hardware)                                   |
|      |              |                                                |
|      |              | Certification Authority - Level 1 (Hardware or |
|      |              | Software)                                      |
|      |              |                                                |
|      |              | Subscriber -- N/A                              |
|      |              |                                                |
|      |              | Registration Authority - Level 1 (Hardware or  |
|      |              | Software)                                      |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 20.  | FBCA:        | Subscriber private signature keys whose        |
|      |              | corresponding public key is contained in a     |
|      | **6.2.4.2**  | certificate asserting the FBCA                 |
|      |              | mediumAssurance, basicAssurance, or            |
|      |              | rudimentaryAssurance policies (or an entity    |
|      |              | policy which maps to these policies) may be    |
|      |              | backed up or copied, but must be held in the   |
|      |              | Subscriber's control.                          |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 21.  | FBCA:        | The activation data used to unlock FBCA,       |
|      |              | Entity CA or subscriber private keys, in       |
|      | **6.4.1**    | conjunction with any other access control,     |
|      |              | shall have an appropriate level of strength    |
|      |              | for the keys or data to be protected.          |
|      |              |                                                |
|      |              | For Rudimentary, Basic, and Medium assurance   |
|      |              | levels, activation data may be user selected.  |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+
| 22.  | FBCA:        | Certificates issued by Entity PKI's operating  |
|      |              | at the Basic and Rudimentary shall comply with |
|      | **7.1.2**    | RFC2459.                                       |
+------+--------------+------------------------------------------------+
|      | XXXX:        |                                                |
+------+--------------+------------------------------------------------+
|      | [Overall     | Comments:                                      |
|      | Ma           |                                                |
|      | tch:]{.mark} |                                                |
+------+--------------+------------------------------------------------+

(Note: this information is derived from the Certificate Issuing and
Management Components Protection Profile being developed by NIST):

+-----+------------------------------------------+---------+---------+
|     | **Auditable Event**                      | XXXX    | **FBCA  |
|     |                                          |         | Rudime  |
|     |                                          | Rudi    | ntary** |
|     |                                          | mentary |         |
+=====+==========================================+=========+=========+
|     | **SECURITY AUDIT**                       |         |         |
+-----+------------------------------------------+---------+---------+
| 1   | Any changes to the Audit parameters,     |         |         |
|     | e.g., audit frequency, type of event     |         |         |
|     | audited                                  |         |         |
+-----+------------------------------------------+---------+---------+
| **  | Any attempt to delete or modify the      |         |         |
| 2** | Audit logs                               |         |         |
+-----+------------------------------------------+---------+---------+
|     | **IDENTIFICATION AND AUTHENTICATION**    |         |         |
+-----+------------------------------------------+---------+---------+
| **  | Successful and unsuccessful attempts to  |         |         |
| 3** | assume a role                            |         |         |
+-----+------------------------------------------+---------+---------+
| **  | Change in the value of maximum           |         |         |
| 4** | authentication attempts                  |         |         |
+-----+------------------------------------------+---------+---------+
| **  | Maximum number of unsuccessful           |         |         |
| 5** | authentication attempts during user      |         |         |
|     | login                                    |         |         |
+-----+------------------------------------------+---------+---------+
| **  | An Administrator unlocks an account that |         |         |
| 6** | has been locked as a result of           |         |         |
|     | unsuccessful authentication attempts     |         |         |
+-----+------------------------------------------+---------+---------+
| **  | An Administrator changes the type of     |         |         |
| 7** | authenticator, e.g., from password to    |         |         |
|     | biometrics                               |         |         |
+-----+------------------------------------------+---------+---------+
|     | **KEY GENERATION**                       |         |         |
+-----+------------------------------------------+---------+---------+
| **  | Whenever the FBCA or Entity CA generates |         | **X**   |
| 8** | a key. (Not mandatory for single session |         |         |
|     | or one-time use symmetric keys)          |         |         |
+-----+------------------------------------------+---------+---------+
|     | **PRIVATE KEY LOAD AND STORAGE**         |         |         |
+-----+------------------------------------------+---------+---------+
| **  | The loading of Component private keys    |         | **X**   |
| 9** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **1 | All access to certificate subject        |         | **X**   |
| 0** | private keys retained within the FBCA or |         |         |
|     | Entity CA for key recovery purposes      |         |         |
+-----+------------------------------------------+---------+---------+
|     | **TRUSTED PUBLIC KEY ENTRY, DELETION AND |         |         |
|     | STORAGE**                                |         |         |
+-----+------------------------------------------+---------+---------+
| 11  | All changes to the trusted public keys,  |         | **X**   |
|     | including additions and deletions        |         |         |
+-----+------------------------------------------+---------+---------+
|     | **PRIVATE KEY EXPORT**                   |         |         |
+-----+------------------------------------------+---------+---------+
| **1 | The export of private keys (keys used    |         | **X**   |
| 2** | for a single session or message are      |         |         |
|     | excluded)                                |         |         |
+-----+------------------------------------------+---------+---------+
|     | **CERTIFICATE REGISTRATION**             |         |         |
+-----+------------------------------------------+---------+---------+
| **1 | All certificate requests                 |         | **X**   |
| 3** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
|     | **CERTIFICATE REVOCATION**               |         |         |
+-----+------------------------------------------+---------+---------+
| **1 | All certificate revocation requests      |         |         |
| 4** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
|     | **CERTIFICATE STATUS CHANGE APPROVAL**   |         |         |
+-----+------------------------------------------+---------+---------+
| **1 | The approval or rejection of a           |         |         |
| 5** | certificate status change request        |         |         |
+-----+------------------------------------------+---------+---------+
|     | **FBCA OR ENTITY CA CONFIGURATION**      |         |         |
+-----+------------------------------------------+---------+---------+
| **1 | Any security-relevant changes to the     |         |         |
| 6** | configuration of the FBCA or Entity CA   |         |         |
+-----+------------------------------------------+---------+---------+
|     | **ACCOUNT ADMINISTRATION**               |         |         |
+-----+------------------------------------------+---------+---------+
| **1 | Roles and users are added or deleted     |         | **X**   |
| 7** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **1 | The access control privileges of a user  |         | **X**   |
| 8** | account or a role are modified           |         |         |
+-----+------------------------------------------+---------+---------+
|     | **CERTIFICATE PROFILE MANAGEMENT**       |         |         |
+-----+------------------------------------------+---------+---------+
| 19  | All changes to the certificate profile   |         | **X**   |
+-----+------------------------------------------+---------+---------+
|     | **REVOCATION PROFILE MANAGEMENT**        |         |         |
+-----+------------------------------------------+---------+---------+
| **2 | All changes to the revocation profile    |         |         |
| 0** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
|     | **CERTIFICATE REVOCATION LIST PROFILE    |         |         |
|     | MANAGEMENT**                             |         |         |
+-----+------------------------------------------+---------+---------+
| **2 | All changes to the certificate           |         |         |
| 1** | revocation list profile                  |         |         |
+-----+------------------------------------------+---------+---------+
|     | **MISCELLANEOUS**                        |         |         |
+-----+------------------------------------------+---------+---------+
| **2 | *Installation of the Operating System*   |         |         |
| 2** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **2 | *Installation of the FBCA or Entity CA*  |         |         |
| 3** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **2 | *Installing hardware cryptographic       |         |         |
| 4** | modules*                                 |         |         |
+-----+------------------------------------------+---------+---------+
| **2 | *Removing hardware cryptographic         |         |         |
| 5** | modules*                                 |         |         |
+-----+------------------------------------------+---------+---------+
| **2 | *Destruction of cryptographic modules*   |         |         |
| 6** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **2 | *System Startup*                         |         |         |
| 7** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **2 | *Logon Attempts to FBCA or Entity CA     |         |         |
| 8** | Apps*                                    |         |         |
+-----+------------------------------------------+---------+---------+
| **2 | *Receipt of Hardware / Software*         |         |         |
| 9** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **3 | *Attempts to set passwords*              |         |         |
| 0** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **3 | *Attempts to modify passwords*           |         |         |
| 1** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **3 | *Backing up FBCA or Entity CA internal   |         |         |
| 2** | database*                                |         |         |
+-----+------------------------------------------+---------+---------+
| **3 | *Restoring FBCA or Entity CA internal    |         |         |
| 3** | database*                                |         |         |
+-----+------------------------------------------+---------+---------+
| **3 | *File manipulation (e.g., creation,      |         |         |
| 4** | renaming, moving)*                       |         |         |
+-----+------------------------------------------+---------+---------+
| **3 | *Posting of any material to a            |         |         |
| 5** | repository*                              |         |         |
+-----+------------------------------------------+---------+---------+
| **3 | *Access to FBCA or Entity CA internal    |         |         |
| 6** | database*                                |         |         |
+-----+------------------------------------------+---------+---------+
| **3 | *All certificate compromise notification |         |         |
| 7** | requests*                                |         |         |
+-----+------------------------------------------+---------+---------+
| **3 | *Loading tokens with certificates*       |         |         |
| 8** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **3 | *Shipment of Tokens*                     |         |         |
| 9** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **4 | *Zeroizing tokens*                       |         |         |
| 0** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **4 | *Rekey of the FBCA or Entity CA*         |         | **X**   |
| 1** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
|     | *Configuration changes to the CA server  |         |         |
|     | involving:*                              |         |         |
+-----+------------------------------------------+---------+---------+
| **4 | *Hardware*                               |         |         |
| 2** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **4 | *Software*                               |         |         |
| 3** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| 44  | *Operating System*                       |         |         |
+-----+------------------------------------------+---------+---------+
| **4 | *Patches*                                |         |         |
| 5** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **4 | *Security Profiles*                      |         |         |
| 6** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
|     | **PHYSICAL ACCESS / SITE SECURITY**      |         |         |
+-----+------------------------------------------+---------+---------+
| **4 | *Personnel Access to room housing FBCA   |         |         |
| 7** | or Entity CA*                            |         |         |
+-----+------------------------------------------+---------+---------+
| **4 | *Access to the FBCA or Entity CA server* |         |         |
| 8** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **4 | *Known or suspected violations of        |         |         |
| 9** | physical security*                       |         |         |
+-----+------------------------------------------+---------+---------+
|     | **ANOMALIES**                            |         |         |
+-----+------------------------------------------+---------+---------+
| **5 | *Software Error conditions*              |         |         |
| 0** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **5 | *Software check integrity failures*      |         |         |
| 1** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **5 | *Receipt of improper messages*           |         |         |
| 2** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **5 | *Misrouted messages*                     |         |         |
| 3** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **5 | *Network attacks (suspected or           |         |         |
| 4** | confirmed)*                              |         |         |
+-----+------------------------------------------+---------+---------+
| **5 | *Equipment failure*                      |         | **X**   |
| 5** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **5 | *Electrical power outages*               |         |         |
| 6** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **5 | *Uninterruptible Power Supply (UPS)      |         |         |
| 7** | failure*                                 |         |         |
+-----+------------------------------------------+---------+---------+
| **5 | *Obvious and significant network service |         |         |
| 8** | or access failures*                      |         |         |
+-----+------------------------------------------+---------+---------+
| **5 | *Violations of Certificate Policy*       |         | **X**   |
| 9** |                                          |         |         |
+-----+------------------------------------------+---------+---------+
| **6 | *Violations of Certification Practice    |         | **X**   |
| 0** | Statement*                               |         |         |
+-----+------------------------------------------+---------+---------+
| **6 | *Resetting Operating System clock*       |         |         |
| 1** |                                          |         |         |
+-----+------------------------------------------+---------+---------+

# **5.0 REFERENCES**

\[1\] Request for Comments (RFC): 2527; Internet X.509 Public Key
Infrastructure Certificate Policy and Certification Practices Framework,
March 1999, <http://www.ietf.org/rfc/rfc2527.txt>

\[2\] X.509 Certificate Policy for **XXXX** Public Key Infrastructure
(PKI), Revision XXXX, **DD MM YYYY**.

\[3\] X.509 Certificate Policy For The Federal Bridge Certification
Authority (FBCA), <http://www.cio.gov/fpkipa/documents/FBCA-CP.pdf>

\[4\] CPWG General CP Requirements Mapping for the **XXXX** PKI, **DD MM
YYYY**

# **6.0 CONTACT DETAILS**

Comments about this document may be sent to the following people:

Tim Polk, NIST 301.975.3348 <tim.polk@nist.gov>