@@ -2487,122 +2487,121 @@ As stated in clause 5.10, since minimizing the impact on other systems relies on
- Generate, i.e. activate the certificate generation fonction with the correct inputs
- Verify that a certificate is generated including the inputed data
- Verify that the signature is correct and covers all the necessary fields
- VERDICT:SUCCESS if all the verifications pass; else FAIL.
- VERDICT:
- SUCCESS: Certificates are generated only when all required and correct inputs are provided, conform to the X.509 format, correctly include the supplied data, and have a valid signature covering all required fields.
- FAIL: Certificates are generated with missing or incorrect inputs, do not conform to the X.509 format, contain incorrect data, have an invalid signature, or omit required fields from signature protection.
- EVIDENCE:
- Certificate generation requests parameters
- Generated certficates or error messages generated by the product
- Signature verification input and output
- REFERENCE: ACC-PKI-EMM-02
- OBJECTIVE: Verify the format of public-key certificates issued by the certificate generation service complies with ITU-T X.509 [\[2\]](#_ref_2).
- PREPARATION: Document the circumstances in which the certificate generation service may issue a certificate. Ability to request a certificate issuance for the different identified circumstances.
- ACTIVITIES: For each way the product may issue a certificate:
- issue a certificate;
- verify points a,c,f of the NOTE of REQ-5.3-02;
- attempt to issue a certificate with a null Name for the issuer field, then verify the certificate contains a critical issuerAltName extension;
- attempt to issue a certificate with a null Name for the subject field, then verify the certificate contains a critical subjectAltName extension;
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
- The documentation of certificate issuance circumstances;
- the way issuances were requested, and the responses and issued certificates from the product.
- REFERENCE: ACC-PKI-EMM-03
- OBJECTIVE: Verify the product implements and follows a certificate profile for issued certificates.
- PREPARATION:
- Document the circumstances in which the certificate generation service may issue a certificate.
- Ability to request a certificate issuance for the different identified circumstances.
- Document the certificate profile implemented by the product.
- ACTIVITIES: For each way the product may issue a certificate:
a) issue a certificate;
b) verify the certificate to match the constraints of the certificate profile;
c) for all constraints of the certificate profile, attempt to issue a certificate disrespecting the constraint, and verify the issuance to fail.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- issue a certificate;
- verify the certificate to match the constraints of the certificate profile;
- for all constraints of the certificate profile, attempt to issue a certificate disrespecting the constraint, and verify the issuance to fail.
- VERDICT:
- SUCCESS: All documented certificate issuance scenarios produce certificates conforming to the documented certificate profile, and all attempts to violate profile constraints are rejected without issuing a non-conforming certificate.
- FAIL: Any valid issuance scenario fails, any issued certificate does not conform to the documented certificate profile, or any profile constraint can be bypassed to issue a non-conforming certificate.
- EVIDENCE:
a) The documentation of certificate issuance circumstances;
b) the documentation of the certificate profile;
c) the way issuances were requested, and the responses and issued certificates from the product.
- The documentation of certificate issuance circumstances;
- the documentation of the certificate profile;
- the way issuances were requested, and the responses and issued certificates from the product.
- REFERENCE: ACC-PKI-EMM-04
- OBJECTIVE: Verify the product enables the Administrator to specify the set of acceptable values for the following fields and extensions:
a) the authority key identifier;
b) the algorithm identifier for the subject’s public/private key pair;
c) the identifier of the certificate issuer;
d) the length of time for which the certificate is valid.
- REFERENCE: ACC-PKI-EMM-03
- OBJECTIVE: Verify the product enables the authorized user to specify the set of acceptable values for the following fields and extensions:
- the authority key identifier;
- the algorithm identifier for the subject’s public/private key pair;
- the identifier of the certificate issuer;
- the length of time for which the certificate is valid.
- PREPARATION:
- Administrator access, to enable configuration.
- Authorized user access, to enable configuration.
- Ability to request a certificate issuance for the different identified circumstances.
- ACTIVITIES:
- Configure a set of acceptable values for each of the identified fields and extensions, which does not contain all possible values.
- For each way the product may issue a certificate:
- For each of the identified fields and extensions:
a) attempt to issue a certificate, where all fields and extensions have acceptable values except the one being verified;
b) verify the issuance to fail or to be impossible.
- VERDICT: SUCCESS if no certificate is issued; else FAIL.
- attempt to issue a certificate, where all fields and extensions have acceptable values except the one being verified;
- verify the issuance to fail or to be impossible.
- VERDICT:
- SUCCESS: The authorized users can configure restricted sets of acceptable values for all specified certificate fields and extensions, and any certificate request containing a non-acceptable value is rejected or cannot be issued.
- FAIL: The product does not allow restricting acceptable values for one or more specified fields or extensions, or a certificate can be issued using a value outside the configured acceptable set.
- EVIDENCE:
a) The documentation of public-key certificate issuance circumstances;
b) The applied configuration of the identified fields and extensions;
c) the way issuances were requested, and the responses and issued certificates from the product.
- The documentation of public-key certificate issuance circumstances;
- The applied configuration of the identified fields and extensions;
- the way issuances were requested, and the responses and issued certificates from the product.
- REFERENCE: ACC-PKI-EMM-05
- OBJECTIVE: Verify that the product requires the Administrator to specify the set of acceptable values for the fields and extensions identified in REQ-PKI-EMM-03
- REFERENCE: ACC-PKI-EMM-04
- OBJECTIVE: Verify that the product requires the authorized user to specify the set of acceptable values for the fields and extensions identified in REQ-PKI-EMM-03
and REQ-PKI-EMM-04.
- PREPARATION: Document the circumstances in which the certificate generation service may issue a public-key certificate.
- Administrator access to not-installed or reinitialised product, or specifically its certificate generation service and related configuration.
- Authorized user access to certificate generation service and related configuration.
- ACTIVITIES: For each way the product may issue a public-key certificate:
- verify that no certificate may be issued until acceptables values for the identified fields and extensions are set.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- VERDICT:
- SUCCESS: The product prevents the issuance of any public-key certificate until the authorized user has configured acceptable values for all necessary fields and extensions.
- FAIL: A public-key certificate can be issued before acceptable values for one or more required fields or extensions have been configured by the authorized user.
- EVIDENCE:
a) The documentation of public-key certificate issuance circumstances;
b) the way issuances were requested, and the responses from the product.
- The documentation of public-key certificate issuance circumstances;
- the way issuances were requested, and the responses from the product.
- REFERENCE: ACC-PKI-EMM-06
- REFERENCE: ACC-PKI-EMM-05
- OBJECTIVE:
- Verify the product marks the keyUsage, basicConstraints and certificatePolicies as critical in issued certificates.
- PREPARATION: Document the circumstances in which the certificate generation service may issue a public-key certificate. Ability to request a certificate issuance for the different identified circumstances.
- ACTIVITIES: For each way the product may issue a public-key certificate:
a) issue a certificate;
b) verify the keyUsage, basicConstraints and certificatePolicies extensions to be marked critical;
c) if applicable, attempt to issue a certificate with either extension marked not critical, and verify the issuance to fail.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- issue a certificate;
- verify the keyUsage, basicConstraints and certificatePolicies extensions to be marked critical;
- if applicable, attempt to issue a certificate with either extension marked not critical, and verify the issuance to fail.
- VERDICT:
- SUCCESS: All issued public-key certificates mark the keyUsage, basicConstraints, and certificatePolicies extensions as critical, and any attempt to issue a certificate with these extensions marked non-critical is rejected.
- FAIL: Any issued public-key certificate does not mark one or more of the required extensions as critical, or a certificate can be issued with one of these extensions marked non-critical.
- EVIDENCE:
a) The documentation of public-key certificate issuance circumstances;
b) the way issuances were requested, and the responses and issued certificates from the product.
- The documentation of public-key certificate issuance circumstances;
- The way issuances were requested, and the responses and issued certificates from the product.
- REFERENCE: ACC-PKI-EMM-07
- REFERENCE: ACC-PKI-EMM-06
- OBJECTIVE:
- Verify the product disallows the keyUsage extension to offer both digital signature and encryption or key agreement capabilities.
- PREPARATION: Document the circumstances in which the certificate generation service may issue a public-key certificate. Ability to request a certificate issuance for the different identified circumstances.
- ACTIVITIES: For each way the product may issue a public-key certificate:
a) issue a certificate;
b) verify the keyUsage extension does not contain values from simultaneously:
b.1) digitalSignature, contentCommitment, keyCertSign, cRLSign; and
- if applicable, attempt to issue such a certificate and verify the issuance to fail.
- VERDICT:
- SUCCESS: No issued public-key certificate contains both signature capabilities (digitalSignature, contentCommitment, keyCertSign, cRLSign) and encryption or key agreement capabilities (keyEncipherment, dataEncipherment, keyAgreement) in the keyUsage extension, and any attempt to issue such a certificate is rejected.
- FAIL: A public-key certificate is issued containing both signature and encryption or key agreement capabilities in the keyUsage extension, or an attempt to issue such a certificate is not rejected.
- EVIDENCE:
a) The documentation of public-key certificate issuance circumstances;
b) the way issuances were requested, and the responses and issued certificates from the product.
- The documentation of public-key certificate issuance circumstances;
- The way issuances were requested, and the responses and issued certificates from the product.
- REFERENCE: ACC-PKI-EMM-08
- OBJECTIVE:
- Verify the product ensures a prospective certificate subject possesses the private key that corresponds to the public key in the certificate request before issuing a certificate, unless the private key never left the certificate issuance service.
- PREPARATION: Document the circumstances in which the certificate generation service may issue a public-key certificate. Ability to request a certificate issuance.
- ACTIVITIES: For each way the product may issue a public-key certificate:
a) attempt to issue a certificate with digital signature capabilities for a given public-key;
b) if the product does not generate the key pair itself, or it has left the issuance service:
b.1) provide an invalid signature when required;
b.2) verify the issuance to fail;
c) attempt to issue a certificate with encryption or key agreement capabilities for a given public-key;
d) if the product does not generate the key pair itself, or it has left the issuance service:
d.1) provide an invalid decryption when required;
d.2) verify the issuance to fail.
- attempt to issue a certificate with digital signature capabilities for a given public-key;
- if the product does not generate the key pair itself, or it has left the issuance service:
- provide an invalid signature when required;
- verify the issuance to fail;
- attempt to issue a certificate with encryption or key agreement capabilities for a given public-key;
- if the product does not generate the key pair itself, or it has left the issuance service:
- provide an invalid decryption when required;
- verify the issuance to fail.
Among all the issuance attempts involving signing or decryption, verify the random value to sign or decrypt is always distinct, and their concatenation of high entropy.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
a) The documentation of public-key certificate issuance circumstances;
b) the way issuances were requested, and the responses from the product;
c) the key pairs issued by the product if any, and how and when they were obtained;
d) the random values generated by the product.
- The documentation of public-key certificate issuance circumstances;
- The way issuances were requested, and the responses from the product;
- The key pairs issued by the product if any, and how and when they were obtained;
- The random values generated by the product.
### 6.12.2 EMM - Certificate status
@@ -2610,54 +2609,52 @@ and REQ-PKI-EMM-04.
- OBJECTIVE: Verify the certificate revocation statuses to be either or both of CRLs as defined by and subject to the requirements of ITU-T X.509 [\[2\]](#_ref_2), or OCSP responses as defined by and subject to the requirements of RFC 6960 [\[i.3\]](#_ref_i.3).
- PREPARATION: Document the circumstances in which the certificate generation service may issue a public-key certificate. Ability to request a certificate issuance. Ability to configure revocation aspects of the certificate profile if supported.
- ACTIVITIES:
a) Attempt to configure the certificate profile to not offer any revocation source in issued certificates;
a.1) if successful, request a certificate for each way the product may issue a public-key certificate, and verify the issuances to fail.
b) For each way the product may successfully issue a public-key certificate:
b.1) request a certificate;
b.2) verify the issued certificate to contain information allowing a verifier to obtain a CRL or OCSP response.
- Attempt to configure the certificate profile to not offer any revocation source in issued certificates;
- if successful, request a certificate for each way the product may issue a public-key certificate, and verify the issuances to fail.
- For each way the product may successfully issue a public-key certificate:
- request a certificate;
- verify the issued certificate to contain information allowing a verifier to obtain a CRL or OCSP response.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
a) The configuration attempts, or other evidence such configuration is not supported;
b) the way issuances were requested, and the responses from the product.
- The configuration attempts, or other evidence such configuration is not supported;
- the way issuances were requested, and the responses from the product.
- REFERENCE: ACC-PKI-EMM-010
- OBJECTIVE:
- Verify the product implements and enforces a CRL profile for issued CRLs.
- PREPARATION: Ability to request a CRL as certificate status for a given certificate. Document the CRL profile implemented by the product.
- ACTIVITIES:
a) Request a CRL;
b) verify the CRL to match the constraints of the CRL profile.
- Request a CRL;
- verify the CRL to match the constraints of the CRL profile.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE: The way the CRL was requested, and the response and CRL from the product.
- REFERENCE: ACC-PKI-EMM-011
- OBJECTIVE: Verify that the product requires the Administrator to specify the set of acceptable values for the fields and extensions identified in REQ-5.4-03.
- PREPARATION: Administrator access to not-installed or reinitialised product, or specifically its certificate status service and related configuration.
- OBJECTIVE: Verify that the product requires authorized users to specify the set of acceptable values for the fields and extensions identified in REQ-5.4-03.
- PREPARATION: authorized users access to not-installed or reinitialised product, or specifically its certificate status service and related configuration.
- ACTIVITIES: Verify that no CRL may be issued until acceptables values for the issuer, issuerAltName and nextUpdate fields and extensions are set.
- VERDICT: SUCCESS if the verifications passes; else FAIL.
- EVIDENCE: The way CRLs were requested, and the responses from the product.
- REFERENCE: ACC-PKI-EMM-012
- OBJECTIVE: Verify the product implements and enforces an OCSP response profile for issued OCSP responses.
- PREPARATION: Ability to request an OCSP response as certificate status for a given certificate. Document the OCSP response profile implemented by the product.
- ACTIVITIES:
a) Request an OCSP response;
b) verify the OCSP response to match the constraints of the OCSP response profile.
- Request an OCSP response;
- verify the OCSP response to match the constraints of the OCSP response profile.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE: The way the OCSP response was requested, and the response and OCSP response from the product.
- REFERENCE: ACC-PKI-EMM-013
- OBJECTIVE:
- Verify that the product requires the Administrator to specify the set of acceptable values for the responseType field.
- PREPARATION: Administrator access to not-installed or reinitialised product, or specifically its certificate status service and related configuration.
- OBJECTIVE: Verify that the product requires the authorized users to specify the set of acceptable values for the responseType field.
- PREPARATION: Authorized users access to not-installed or reinitialised product, or specifically its certificate status service and related configuration.
- ACTIVITIES: Verify that no OCSP response may be issued until acceptable values for the responseType field are set.
- VERDICT: SUCCESS if all the verification pass; else FAIL.
- EVIDENCE: The way OCSP responses were requested, and the responses and OCSP responses from the product.
- REFERENCE: ACC-PKI-EMM-014
- OBJECTIVE: Verify that the product requires the Administrator to specify the set of acceptable values for the responderID field.
- PREPARATION: Administrator access to not-installed or reinitialised product, or specifically its certificate status service and related configuration.
- OBJECTIVE: Verify that the product requires the authorized users to specify the set of acceptable values for the responderID field.
- PREPARATION: Authorized users access to not-installed or reinitialised product, or specifically its certificate status service and related configuration.
- ACTIVITIES: Verify that no OCSP response may be issued until acceptable values for the responderID field are set.
- VERDICT: SUCCESS if all the verification pass; else FAIL.
- EVIDENCE: The way OCSP responses were requested, and the responses and OCSP responses from the product.
