6.6.1 update

Validity of access control requirement are covered by section 6.5:

- REQ-PKI-CON-01

## 6.6.1 CON - General

- REFERENCE: ACC-PKI-DM-01  

- REFERENCE: ACC-PKI-CON-01

  -  OBJECTIVE:

  Verify that when a pseudonymous certificate is used to exchange a public key associated with an ephemeral identity, the certificate contains no information that could directly or indirectly reveal, correlate, or facilitate identification of the sender, thereby preserving sender pseudonymity.

    - Verify that private keys generated by the product are protected against unauthorized export, copying, disclosure, or removal.

  -  PREPARATION:

    -  (If available) Key management architecture documentation.

    -  Documentation describing private key generation, storage, and access controls.

    -  Identify interfaces, APIs, administrative functions, backup mechanisms, and export capabilities that may provide access to private keys.

    -  Access to authorized and unauthorized user accounts.

  -  ACTIVITIES:

    - (If available) Review the design of private key generation and storage mechanisms.

    - Verify that generated private keys are stored in protected locations or secure cryptographic devices.

    - Verify that export or copy operations require explicit authorization.

    - Attempt to access, export, copy, or remove private keys using unauthorized accounts and interfaces.

    - Verify that unauthorized operations are denied and appropriately logged.

    - Where controlled migration of key pairs is supported, verify that transfer is performed only under documented and authorized procedures.

  -  VERDICT:

    -  SUCCESS:

      -  Unauthorized users cannot access, export, copy, or remove private keys.

      -  All key management interfaces enforce authorization controls.

      -  Any permitted key transfer mechanisms are appropriately controlled and documented.

    -  FAIL:

      -  Unauthorized users can obtain, copy, export, or remove private keys.

      -  Key protection mechanisms can be bypassed.

      -  Key migration mechanisms lack appropriate controls.

  -  EVIDENCE:

    -  Key management design documentation.

    -  Access control configurations.

    -  Security architecture diagrams.

    -  Test results of attempted unauthorized exports.

    -  Audit logs of key management operations.

    -  Configuration files and screenshots.

- REFERENCE: ACC-PKI-DM-02

  - OBJECTIVE:

    - Verify that when a pseudonymous certificate is used to exchange a public key associated with an ephemeral identity, the certificate contains no information that could directly or indirectly reveal, correlate, or facilitate identification of the sender, thereby preserving sender pseudonymity.

  -  PREPARATION:

      -  Product security architecture documentation describing the implementation of pseudonymous certificates and ephemeral identities.  

      -  The certificate profile specification, including all mandatory and optional certificate fields and extensions.

      -  Product configuration settings for certificate generation and identity management.

      -  Tools for certificate parsing and inspection.

      -  Identify any external repositories, certificate databases, or services that may be used to correlate certificate information.

  -  ACTIVITIES:

    - Review the product design documentation to determine how pseudonymous certificates are generated and associated with ephemeral identities.

    - Examine the certificate profile and identify all fields and extensions included in the pseudonymous certificate.

      - Assess whether certificate serial number generation, extension values, and metadata are randomly generated or otherwise designed to prevent sender correlation.

      - Review product configuration and operational procedures to ensure that pseudonymous certificates cannot be configured to include identifying information.

      - Attempt to correlate multiple pseudonymous certificates issued to the same sender and determine whether any certificate data enables identity linkage.

  -  VERDICT:

    -  SUCCESS:

        - The product generates pseudonymous certificates containing only technical information necessary for cryptographic processing and validation.

        - No certificate field or extension contains identifying information, persistent identifiers, or metadata that can directly or indirectly reveal the sender's identity.

        - Multiple certificates associated with the same sender cannot be correlated using certificate contents.

        - Product configuration prevents the inclusion of identifying information in pseudonymous certificates.

    -  FAIL:

      -  One or more certificate fields contain information that directly or indirectly identifies the sender.

      -  Certificate contents include persistent identifiers or metadata that enable correlation of certificates belonging to the same sender.

      -  Certificate serial numbers, extensions, naming conventions, or custom attributes permit sender re-identification.

      -  Product configuration allows pseudonymous certificates to include user-related identifying information.

  -  EVIDENCE:

    -  Product architecture and design documentation describing pseudonymous certificate generation.

    -  Certificate profile specifications and extension definitions.