@@ -1016,6 +1016,13 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
- RATIONALE: The use of recognized and validated cryptographic algorithms is mandatory for a PKI and thus a PKI product to ensure trust. Known weak or insufficiently validated algorithms are not allowed.
- APPLICABILITY: All use cases.
- REFERENCE: REQ-PKI-AP-03
- REQUIREMENT - [CONDITIONAL]: If Certificate Revocation Lists (CRLs) concerning end users certificates including any variants (e.g. Delta CRLs) are used, the CRL shall be signed using a valid certificate.
- NOTE: This Requirement correspond to CSS-6.3.9-08 contained in ETSI EN 319 411-1 [\[i.10\]](#_ref_i.10)
- RATIONALE: If the CRL is not signed by the CA or a TSP-appointed entity, it may be usurped to mislead end-users regarding a certificate's status.
- APPLICABILITY: Where the product has a certificate status service, issuing CRLs.
## 5.8 Data minimisation
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (g).
@@ -1063,18 +1070,12 @@ In this section we consider that certificates status availability and trust are
- APPLICABILITY: Where the product has a certificate status service, issuing CRLs.
- REFERENCE: REQ-PKI-AP-03
- REQUIREMENT - [CONDITIONAL]: If Certificate Revocation Lists (CRLs) concerning end users certificates including any variants (e.g. Delta CRLs) are used, the CRL shall be signed by the CA or an entity designated by the TSP.
- NOTE: This Requirement correspond to CSS-6.3.9-08 contained in ETSI EN 319 411-1 [\[i.10\]](#_ref_i.10)
- RATIONALE: If the CRL is not signed by the CA or a TSP-appointed entity, it may be usurped to mislead end-users regarding a certificate's status.
- APPLICABILITY: Where the product has a certificate status service, issuing CRLs.
- REFERENCE: REQ-PKI-AP-04
- REQUIREMENT - [CONDITIONAL]: If CARL is used, a new CARL shall be generated at least once a year with a nextUpdate of at most 1 year after the issuing date.
- NOTE: This Requirement correspond to CSS-6.3.9-12 contained in ETSI EN 319 411-1 [\[i.10\]](#_ref_i.10)
- RATIONALE: With respect to the severity of a CA compromission, a revocation should be made known as quickly as possible by immediately issuing a new CARL, rather than waiting for the next scheduled CARL.
- APPLICABILITY: Where the product has a certificate status service, issuing CARLs.
- REFERENCE: REQ-PKI-AP-05
- REFERENCE: REQ-PKI-AP-04
- REQUIREMENT:
- [CONDITIONAL]: If CARL is used, a new CARL shall be generated once a CA certificate has been revoked.
- NOTE: This Requirement correspond to CSS-6.3.9-13 contained in ETSI EN 319 411-1 [\[i.10\]](#_ref_i.10)
@@ -2022,7 +2023,36 @@ The validity of the cryptographic mechanisms used to encure those funtions is co
### 6.7.3 INT- CRL signing
- REFERENCE: ACC-PKI-INT-07
- REFERENCE: ACC-PKI-AP-07
- OBJECTIVE:
- Verify that CRLs are digitally signed.
- PREPARATION:
- Determine whether CRLs are supported.
- CRL signing procedures and trust model documentation.
- Prepare certificate and signature validation tools.
- ACTIVITIES:
- Generate CRLs.
- Inspect the signer identity and signature information.
- Verify that the signer corresponds to a CA (e.g. "basicConstraints" field contains "CA:TRUE") or an authorized delegated entity (certificate with "keyUsage" including "cRLSign").
- Validate the digital signature.
- Attempt to validate a CRL modified after signing.
- VERDICT:
- SUCCESS:
- All CRLs are signed by authorized entities.
- Signature validation succeeds.
- Tampered CRLs fail validation.
- FAIL:
- CRLs are unsigned.
- CRLs are signed by unauthorized entities.
- Signature validation does not detect tampering.
- EVIDENCE:
- CRL samples.
- Signature validation reports.
- Trust model documentation.
- Delegation documentation.
- Test execution records.
- REFERENCE: ACC-PKI-INT-08
- OBJECTIVE:
- Verify that CRL signatures are created exclusively using an SCD.
- PREPARATION:
@@ -2196,35 +2226,6 @@ The validity of the cryptographic mechanisms used to encure those funtions is co
- CRL inspection outputs.
- Test records.
- REFERENCE: ACC-PKI-AP-03
- OBJECTIVE:
- Verify that CRLs are digitally signed by the CA or an authorized entity designated by the TSP.
- PREPARATION:
- Determine whether CRLs are supported.
- CRL signing procedures and trust model documentation.
- Prepare certificate and signature validation tools.
- ACTIVITIES:
- Generate CRLs.
- Inspect the signer identity and signature information.
- Verify that the signer corresponds to the CA or an authorized delegated entity.
- Validate the digital signature.
- Attempt to validate a CRL modified after signing.
- VERDICT:
- SUCCESS:
- All CRLs are signed by authorized entities.
- Signature validation succeeds.
- Tampered CRLs fail validation.
- FAIL:
- CRLs are unsigned.
- CRLs are signed by unauthorized entities.
- Signature validation does not detect tampering.
- EVIDENCE:
- CRL samples.
- Signature validation reports.
- Trust model documentation.
- Delegation documentation.
- Test execution records.
- REFERENCE: ACC-PKI-AP-04
- OBJECTIVE:
- Verify that CARLs are generated at least annually and that the `nextUpdate` value does not exceed one year after issuance.
