Intermediate updates on clause 4

# 4 Product context

## 4.1 Intended purpose of use

## 4.0 Introduction

The technical requirements of the present document apply under the product context described herein, which shall be in accordance with its intended use. The equipment shall comply with all the technical requirements of the present document at all times when operating in such product context.

A PKI is a system that enables the management of public keys, and requires that the private key is kept secret. The assurance of the secrecy of the private key is most often achieved by maintaining the secret key in a hardware security module and limiting access to the key to cryptographic functions in such a way that the secret key itself is never visible externally to the device. Assertions that are signed by the private key similarly require that the only the device holding the private key is able to create the signature. Verifications of signed attestations need access to the public key of the signer, and often that public key is distributed in a public key certificate (PKC) that is stored securely on the verifying device.

>   - NOTE:	A public key has limited security value as it is intended to be known to all, but the PKC may contain some identifying information and therefore the PKC content should be protected in accordance with any general data protection rules for personal, or personal identifying information (PII).

The present document describes product contexts for products with digital elements used as part of a Public Key Infrastructure (PKI) that manage the validation, creation, issuance, distribution, status publication, renewal or revocation of digital certificates, or the generation, storage, escrow, exchange, destruction or rotation of cryptographic keys associated with such digital certificates.

The reasonably foreseeable use of the product is to support certification services where a compromise carries a significant risk of impact to the security of other products, networks or services, or to the health, security or safety of the public.

>   - EXAMPLE 1:	eIDAS. In the context of the present document ETSI EN 319 411-1 [[i.10](#_ref_i_10)] defines requirements on security hardware elements of the PKI and requirement of software elements of the PKI for use in eIDAS.

>   - EXAMPLE 2:	C-ITS. In the context of the present document ETSI TS 102 941 [[i.7](#_ref_i_7)] and the EU C-ITS Certificate Management System policy [[i.11](#_ref_i_11)] and security profile [[i.12](#_ref_i_12)] documents  identify specific requirements on hardware elements and their certification.

>   - EXAMPLE 3:	Software used to issue certificates for public web sites and to validate the identity of web sites (these capabilities are often built into web-browsers and for such cases the provisions of EN … apply).

>   - EXAMPLE 4:	Trust services. Software used to issue certificates for trust services including those used in electronic attribute attestation.

>   - EXAMPLE 5:	Online Certificate Status Protocol support. Software used to verify the status of PKCs.

A single box PKI solution wherein one or more of the examples above are deployed in a single device and interfacing to other client devices within a closed environment.

## 4.2 Product Functions

Products with digital elements used as part of a public key cryptography scheme to manage asymmetric cryptographic keys and digital certificates, including their creation, issuance, distribution, validation, renewal, storage or revocation, support the functions outlined in this clause.

- **F.PublicPrivateKeyPair_generation**: generates the public-private key pair;

>   - NOTE 1:	This function may be specialised to address use cases for generation using a Secure Cryptographic Device (SCD) or without use of an SCD.

- **F.SubjectCertificate_signatureCreation**: creates and signs subject certificates using the product's private key

>   - NOTE 2:	The policy frameworks of eIDAS and C-ITS identify the use of protection profiles in support of signature creation. In particular the European commission's eIDAS Dashboard [https://eidas.ec.europa.eu/efda/home ] identifies a list of Qualified Signature/Seal Creation Devices and Secure Signature Creation Devices [https://eidas.ec.europa.eu/efda/browse/notification/qscd-sscd]. For C-ITS the Security and Certificate policy documents [[i.11](#_ref_i_11)],[[i.12](#_ref_i_12)] identify specific Protection Profiles as identified in references [**TBD**] and [**TBD**].

 - **F.CertificateDissemination**: distributes signed certificates to subscribers;

 - **F.PKC storage management**: Stores received PKCs and makes them available to relying parties.

 - **F.SignedArtefactDissemination**: distributes signed artefacts to subscribers

 - **F.Revocation management**: processes revocation reports (e.g. CRLs) to determine the status of PKCs; and may provide updates to the certificate status service (e.g. if the private key is withdrawn and the product invalidates its public key).

 - **F.Certificate status**: maintains certificate status information (e.g. active, expired, revoked).

 - **F.Logging of security events**: Logging of events as per the configuration enabled by F.Log management

 - **F.Log management**: Configuration of audit events to be stored and their associated format. Search or erasure capabilities associated to stored audit events.

## 4.3 Product Architecture

The product contains the following elements:

 - Private key store

 - Public Key Certificate store

 - Access Control layer

 - Access Control policy element

 - Signature creation entity

 - Signature verification entity

In addition the elements can be configured in multiple ways:

 - **ARC.Monolithic**: All components are integrated and run on a single machine or platform.

 - **ARC.Distributed**:  Functions are split across multiple machines or services, often communicating over a network.

![Figure 4.3-1: Indicative product architecture](media/indicative_architecture.png)

<!-- ## 4.1 Intended purpose of use

The present clause describes product contexts for products with digital elements used as part of a public key infrastructure (PKI) that manage the validation, creation, issuance, distribution, status publication, renewal or revocation of digital certificates, or the generation, storage, escrow, exchange, destruction or rotation of cryptographic keys associated with such digital certificates.

![Figure 4.3-1: PKI diagram](media/PKI-diagram.png)

**Figure 4.3-1: PKI diagram**

**Figure 4.3-1: PKI diagram** -->

## 4.4 Operational Environment