@@ -109,21 +109,6 @@ In this case, the managed device is responsible for authorizing the product base
### 5.2.2 Cryptographic key intialisation and rotation
***[REQ-CRYPTO-4]** The product shall support and implement a on-demand rotation of cryptographic keys.
***[REQ-CRYPTO-5]** The product shall support the initialisation of trust.
***[REQ-CRYPTO-6]** The product shall support cryptographic mechanisms used to accept managed elements to the network.
***[REQ-CRYPTO-7]** The product shall support a method to replace or update the cryptographic keys in the system and in the managed elements the product has control over.
***[REQ-CRYPTO-8]** The prodcut shall not trust expired keys.
Trust is inherited from a parenting system or from an existing entity.
Rollout automation and zero touch configuration approaches rely on concepts, which are not nessesarily well established, and vendor specific.
When nothing prior trust source exists, there is always an initialisation and manual acceptanse that involves human intervention.
This intervention enables the administrator to transfer the seed of trust.
> Example: Every PKI tree starts from the creating of the Certificate Authority. The administrator intervention is then to distribute the public part of the CA to all targets, which needs to trust the derived keys from this CA.
This document focuses on defining the expected outcomes of the chosen mechanisms without defining the details of the implementation.
### 5.2.3 Network segmentation
The best practise is to use dedicated network segment for network management and control traffic.
@@ -1267,6 +1267,8 @@ Products are delivered without known exploitable vulnerabilities and that compri
However, certain use cases or the product installation into a present user infrastructure may require the use of legacy protocols and cryptography.
As the product is delivered without known exploitable vulnerabilities, those legacy configurations cannot be the factory default setting, and may only be enabled after the user has been sufficiently informed about the security consequences.
***CON_CRYPTO-1** The product’s default configuration shall only use cryptographic mechanisms that meet at least one of the following criteria:
1. ACM-listed: the cryptographic mechanism is listed in the ECCG Agreed Cryptographic Mechanisms (ACM) catalogue [reference].
2. ACM-extended: the cryptographic mechanism is not listed in the ECCG Agreed Cryptographic Mechanisms (ACM) catalogue [reference] and meets at least one of the following conditions:
@@ -1306,10 +1308,10 @@ As the product is delivered without known exploitable vulnerabilities, those leg
## 5.8 Integrity protection
<mark>_Proposed ESR code: INT_</mark>
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (f).
### 5.8.1 Configuration integrity
***INT_CONF-1** The product shall interface only through a [5.2.1 Secure channel].
***INT_CONF-2** Where the product distributes or makes available configuration to managed devices
* The product shall ensure that the configuration is protected against unauthorized modification and disclosure;
@@ -1317,6 +1319,21 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
* The prodcut shall ensure that the device can verify the integrity of the configuration.
***INT_CONF-3** The configuration interfacing design shall enable the managed device to verify the authenticity of the product.
### 5.8.2 Cryptographic key intialisation and rotation
***INT_ROTATE-4** The product shall support and implement a on-demand rotation of cryptographic keys.
***INT_ROTATE-5** The product shall support the initialisation of trust.
***INT_ROTATE-6** The product shall support cryptographic mechanisms used to accept managed elements to the network.
***INT_ROTATE-7** The product shall support a method to replace or update the cryptographic keys in the system and in the managed elements the product has control over.
***INT_ROTATE-8** The prodcut shall not trust expired keys.
Trust is inherited from a parenting system or from an existing entity.
Rollout automation and zero touch configuration approaches rely on concepts, which are not nessesarily well established, and vendor specific.
When nothing prior trust source exists, there is always an initialisation and manual acceptanse that involves human intervention.
This intervention enables the administrator to transfer the seed of trust.
> Example: Every PKI tree starts from the creating of the Certificate Authority. The administrator intervention is then to distribute the public part of the CA to all targets, which needs to trust the derived keys from this CA.
