DM - Key mgnt req moved to CON

  - APPLICABILITY: All use cases where the product implements encryption mechanisms either for data storage or external communications.

  - NOTE:	If the product is intended for a specific environment with a defined set of agreed cryptographic mechanisms, the product has to be able to be used in accordance with those cryptographic requirements.

- REFERENCE: REQ-PKI-CON-09

  - REQUIREMENT: The product shall be able to establish and maintain a secure and link with the SCD or KMS, and that the SCD or KMS interfaces are properly called.

  - RATIONALE: To ensure the secure key managment, the proper and secure use of exteranl SCD or KMS is required.

  - APPLICABILITY: UC2, UC3, UC4, UC5

### 5.6.2 CON - Key management

- REFERENCE: REQ-PKI-CON-09

- REFERENCE: REQ-PKI-CON-10

  - REQUIREMENT: If the product exports private or symmetric keys it shall use state of the art techniques for guaranteeing its confidentiality as defined in Annex K.

  - RATIONALE: A secret key should not be compromised if its exported form is intercepted.

  - EXAMPLES: The exported private or symmetric key can be encrypted such that only its designated recipient can decrypt it.

  - APPLICABILITY: All use cases

- REFERENCE: REQ-PKI-CON-11

  - REQUIREMENT: Secret keys shall not be stored persistently in plaintext form. They shall be stored within a secure cryptographic device or encrypted using approved algorithms as defined in Annex K using independently managed keys. They may only be accessed in plaintext form temporarily for a single operation or batch of operations.

  - RATIONALE: To ensure trust the product must rely on secure and valid key creation and management systems accessible only to authorised users provided by hardware security devices.

  - APPLICABILITY: All use cases.

## 5.7 Integrity

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (f).

  - RATIONALE: To ensure trust the product software must rely on secure and valid key creation and management systems accessible only to authorised users provided by hardware security devices.

  - APPLICABILITY: UC2, UC3, UC4, UC5

- REFERENCE: REQ-PKI-DM-04

  - REQUIREMENT: The product shall be able to establish and maintain a secure and link with the SCD or KMS, and that the SCD or KMS interfaces are properly called.

  - RATIONALE: To ensure the secure key managment, the proper and secure use of exteranl SCD or KMS is required.

  - APPLICABILITY: UC2, UC3, UC4, UC5

- REFERENCE: REQ-PKI-DM-05

  - REQUIREMENT: Secret keys shall not be stored persistently in plaintext form. They shall be stored within a secure cryptographic device or encrypted using approved algorithms as defined in Annex K using independently managed keys. They may only be accessed in plaintext form temporarily for a single operation or batch of operations.

  - RATIONALE: To ensure trust the product must rely on secure and valid key creation and management systems accessible only to authorised users provided by hardware security devices.

  - APPLICABILITY: All use cases.

## 5.9 Availability protection

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (h).