Update file EN-304-624.md

  - APPLICABILITY: UC1.

- REFERENCE: 	REQ-PKI-CON-02

  - REQUIREMENT: Where the private key is stored in a cryptographically protected way, the cryptographic mechanisms shall conform to the general state of the art as defined in Annex K.

  - REQUIREMENT: Where the private key is stored in a cryptographically protected way, those cryptographic mechanisms shall conform to the general state of the art as defined in Annex K.

  - RATIONALE: Cf. Annex K rational.

  - APPLICABILITY: UC2, UC3, UC4 and UC5

  - APPLICABILITY: UC5

- REFERENCE: 	REQ-PKI-CON-04

  - REQUIREMENT: If the product sends data intended/labelled as personal or sensitive to another entity the product shall ensure that such data is protected from eavesdropping in a cryptographically protected way. The cryptographic mechanisms shall conform to the general state of the art as defined in Annex K.

  - RATIONALE: Analysis has to be performed and justified by the developper to ensure that the product protects personal and sensitive data. This requires to define what data are considered personnal or sensitive.

  - REQUIREMENT: If the product sends data intended/labelled as personal or sensitive to another entity the product shall ensure that such data is protected from eavesdropping in a cryptographically protected way. These cryptographic mechanisms shall conform to the general state of the art as defined in Annex K.

  - RATIONALE: Analysis has to be performed and justified by the developper to ensure that the product protects personal and sensitive data. This requires to define what data are considered personnal or sensitive and provide and associate cryptographic protection mechanisms.

  - NOTE: This includes any remote administration.

  - APPLICABILITY: UC1, UC2, UC3, UC5

  - APPLICABILITY: UC1, UC2, UC3 and UC5

- REFERENCE: REQ-PKI-CON-05

  - REQUIREMENT: A public key certificate request containing explicit personal data shall be protected in integrity and confidentiality by implementing cryptographic mechanisms as defined in Annex K.

  - RATIONALE: XXX

  - NOTE:XXX

  - APPLICABILITY: XXXX

  - REQUIREMENT: A public key certificate request containing explicit personal data shall be protected in integrity and confidentiality by implementing cryptographic mechanisms conform to the general state of the art as defined in Annex K.

  - RATIONALE: Cf. Annex K rational.

   - APPLICABILITY: UC2, UC3, UC4 and UC5

- REFERENCE: 	REQ-PKI-CON-06

  - REQUIREMENT: TODO When a product receives data that has been confidentiality protected by a known key  e.g. by the use of encryption, it should have the capability to recover the plain text data. (i.e. the appropriate cryptographic mechanisms).

  - RATIONALE: XXX

  - NOTE:XXX

  - APPLICABILITY: XXXX

  - REQUIREMENT: The product shall implement a chosen set of cryptographic algorithms to decrypt data that has been confidentiality-protected using a known key (e.g., via encryption), ensuring it can recover the plaintext data. Those cryptographic mechanisms shall conform to the general state of the art as defined in Annex K.

  - RATIONALE: Communication with external components requires to encrypt use case sensitive data using state of the art mechanisms (cf. Annex K rational). 

  - APPLICABILITY: UC1, UC2, UC3 and UC5

- REFERENCE: 	REQ-PKI-CON-07

  - REQUIREMENT: The cryptographic mechanisms used to sign and verify content shall conform to the general state of the art, as defined in Annex K.

  - RATIONALE: XXX

  - RATIONALE:  Cf. Annex K rational.

  - NOTE: If the product is intended for a specific environment with a defined set of agreed cryptographic mechanisms, the product has to be able to be used in accordance with those cryptographic requirements.

  - APPLICABILITY: XXXX

  - APPLICABILITY: UC1, UC2, UC3 and UC5

- REFERENCE: 	REQ-PKI-CON-08

  - REQUIREMENT: TODO The product shall be able to maintain multiple key pairs.

  - RATIONALE: XXX

  - NOTE: Any PKCs stored in the product are intended for public dissemination and have, depending on the particular certificate specification, explicit means of protecting the content, thus no requirements are placed on the product that define the format and protections inherent to the PKC.

  - REQUIREMENT: The product shall be able to maintain multiple key pairs.

   - RATIONALE: A PKI product requires multiple key pairs to provide essential services, including: support for different authorities (e.g., root CA, intermediate CAs, end-entities), use of various cryptographic mechanisms (e.g., separate key pairs for signing and encryption), facilitation of key rotation and lifecycle management (e.g., active and backup keys), etc.

  - APPLICABILITY: All use cases.

### 5.6.2 Secure storage and communications

### 5.7.1 Monitoring

(TODO cf HAS comment - not to be enforce to less critical use cases - UC1?)

- REFERENCE: REQ-PKI-INT-01

  - REQUIREMENT: The product shall be able to detect unauthorised modifications to the stored audit records during the audit.

  - RATIONALE: The audit record intergrity and availability ensure that all auditable events are traceable and misuse of the product functions can be traced.

   - RATIONALE: The use of recognized and validated cryptographic algorithms is mandatory for a PKI and thus a PKI product to ensure trust. Known weak or insufficiently validated algorithms are not allowed.

  - APPLICABILITY: All use cases.

## 5.8 Data minimisation

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (g).

- REFERENCE: 	REQ-PKI-DM-01

  - REQUIREMENT: The product shall only maintain configuration data sufficient to connect to other elements of the PKI system that the product serves.

  - RATIONALE: XXX

  - NOTE:XXX

  - RATIONALE: Unecessary elements adds unecessary complexity and potential attack surface.

  - APPLICABILITY: UC1, UC2, UC3, and UC5

- REFERENCE: 	REQ-PKI-DM-02