@@ -977,15 +977,17 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
(TODO cf HAS comment - not to be enforce to less critical use cases - UC1?)
- REFERENCE: REQ-PKI-INT-001
- REQUIREMENT: The product shall be able to detect unauthorised modifications to the stored audit records during the audit.
- RATIONALE: The audit record intergrity and availability ensure that all auditable events are traceable and misuse of the product functions can be traced.
- APPLICABILITY: All use cases.
- APPLICABILITY: UC2, UC3, UC4 and UC5.
- REFERENCE: REQ-PKI-INT-002
- REQUIREMENT: The timestamp shall be in the scope of the integrity protection of the audit record (to prevent manipulation of the time stamp after the event).
- RATIONALE: The audit record intergrity and timestamping validity ensure that all auditable events are traceable and misuse of the product functions can be traced.
- APPLICABILITY: All use cases.
- APPLICABILITY: UC2, UC3, UC4 and UC5.
- REFERENCE: REQ-PKI-INT-003
- REQUIREMENT: The product shall periodically create an audit log signing event in which it computes a digital signature, keyed hash, or authentication code over the entries in the audit log. The digital signature, keyed hash, or authentication code shall be computed over, at least:
@@ -993,19 +995,20 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
- the digital signature, keyed hash, or authentication code from the previous audit log signed event. The digital signature, keyed hash, or authentication code from the audit log signing event shall be included in the audit log.
- RATIONALE: All entries of the audit log, and the order and exhaustivity of batches of entries should impact authenticity checks of the audit log. The audit record integrity ensure that all auditable events are traceable and misuse of the product functions can be traced.
- NOTE: An audit log signing event is performed even if no entry was added to the audit log since the last one.
- APPLICABILITY: UC3 and UC4
- APPLICABILITY: UC3, UC4 and UC5.
- REFERENCE: REQ-PKI-INT-004
- REQUIREMENT: The product shall ensure the integrity of audit logs.
- RATIONALE: Integrity protection of audit logs ensures that all auditable events are traceable and that product operations can be reliably tracked for accountability and security monitoring.
- NOTE: Not all integrity protection mechanisms can be foreseen so for use cases with lower regulation of standardization constraints (UC1, UC2) other approaches can be valid and so not identified here. Acceptable mechanisms include: append-only log storage, file-system integrity monitoring, hash-chained log entries, or forwarding to a trusted external log management system. The choice should be proportionate to the risk profile.
- APPLICABILITY: UC1, UC2
- APPLICABILITY: UC2
- REFERENCE: REQ-PKI-INT-005
- REQUIREMENT: The specified frequency at which the audit log signing event occurs shall be configurable.
- RATIONALE: The audit record intergrity ensure that all auditable events are traceable and misuse of the product functions can be traced.
- APPLICABILITY: All use cases.
### 5.7.2 Certificate signing
- REFERENCE: REQ-PKI-INT-06
@@ -1235,6 +1238,12 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
These requirements are about the collection and handling of "auditable events", that is, particular events happening during the product operations which require to be traced so as to allow an authorised third-party to audit the PKI's operation. A PKI may produce other types of logs that do not fall under these requirements.
- REFERENCE: REQ-PKI-MON-001
- REQUIREMENT: The product shall record events related to all product functions identified for each use case (as defined in Annex U), as well as all privileged user login attempts and product updates.
- RATIONALE: All management functions of the PKI can impact the overall confidence in the system. Therefore, events related to Registration, Certificate Generation, Certificate Status, and Revocation Management must be recorded. Additionally, the management of privileged user accounts and their login activities must be logged to ensure accountability, which is critical for maintaining trust in the produced and managed PKI certificates.
- APPLICABILITY: All use cases.
- REFERENCE: REQ-PKI-MON-002
- REQUIREMENT: The product shall record within each audit record at least the following information:
- Date and time of the event
- Type of event
@@ -1244,17 +1253,17 @@ These requirements are about the collection and handling of "auditable events",
- NOTE: The audit shall not include in plaintext any secret keys or other critical security parameters.
- APPLICABILITY: All use cases.
- REFERENCE: REQ-PKI-MON-002
- REFERENCE: REQ-PKI-MON-003
- REQUIREMENT: The audit record shall identify the timing source used to generate the timestamp.
- RATIONALE: The audit record timestamping validity ensure that all auditable events are traceable and misuse of the product functions can be traced.
- APPLICABILITY: All use cases.
- REFERENCE: REQ-PKI-MON-003
- REFERENCE: REQ-PKI-MON-004
- REQUIREMENT: For audit events resulting from actions of identified users, the product shall be able to associate each auditable event with the identity of the user that caused the event.
- RATIONALE: The audit record intergrity and timestamping validity ensure that all auditable events are traceable and misuse of the product functions can be traced.
- APPLICABILITY: All use cases.
- REFERENCE: REQ-PKI-MON-004
- REFERENCE: REQ-PKI-MON-005
- REQUIREMENT: The product shall prevent auditable events, except those taken by the auditor, if the audit log is full.
- RATIONALE: If the PKI system is properly deployed—with appropriate policies, effective system management, and regular log reviews—an overload of logs should be seen as a symptom of a potentially significant security issue. In such cases, corrective actions should be taken before operations return to normal. Meanwhile, a full audit log should never result in the loss of old audit records or prevent future auditable events from being recorded. The audit record intergrity and availability ensure that all auditable events are traceable and misuse of the product functions can be traced.
- APPLICABILITY: Not applicable where the product implements or supports automatic log management mechanisms (e.g. log rotation with archival, log pruning, log forwarding to an external system) ensuring continuity of audit recording without data loss. Otherwise applicable to
