Programme of Requirements part 3d: Certificate Policy for certificates in Autonomous Devices (G3) Domain v4.7

Table of Contents

1 Introduction to the Certificate Policy

1.1 Overview

This is part 3d of the Programme of Requirements (PoR) for the PKI for the government and is known as the Certificate Policy (CP). Set out in the PoR are the standards for the PKI for the government. This section relates to the requirements laid down for the services of a Trust Service Provider (TSP) within the PKI for the government. Within the PKI for the government , a distinction is made between various domains. This document only relates to the device-linked certificates issued by TSPs in the Autonomous Devices domain.

This chapter includes a brief explanation of the CP. A more detailed explanation regarding the background and structure of the PKI for the government, as well as the cohesion between the various parts within the PoR is included in part 1 of the PoR.

For a list of the definitions and abbreviations used in this section, please refer to part 4 of the PoR.

1.1.1 Design of the Certificate Policy

As stated in part 1 of the PoR, the requirements that form part of the CP consist of requirements [^1]:

• that ensue from the Dutch legal framework in relation to the electronic signature;

• that ensue from the latest version of the ETSI EN 319 411-1 standard where policy NCP+ is applicable, so that a SUD is used (ETSI CP OID 0.4.0.2042.1.2)[^2];

• that are specifically drawn up by and for the PKIoverheid.

Incorporated in chapters 2 to 9 inclusive are references to the specific PKIoverheid requirements in the Additional Requirements. The table below shows the structure of the reference to the actual PKIoverheid requirement (PKIo requirement).

This CP also includes a number of provisions that are not formulated as PKIo requirements. These provisions do not make any demands on the TSPs within the PKI for the government, but do apply as a policy to the PKI for the government. This concerns provisions from paragraphs 1.1, 1.1.1, 1.1.2, 1.2, 1.3, 1.4, 1.5, 8, 9.12.1, 9.12.2, 9.14 and 9.17.

The profiles used within PKIoverheid relating to the device certificates are listed in appendix A.The status information is listed in the basic requirements.

1.1.2 Status

This is version 4.7 of part 3d of the PoR. The current version has been updated up to and including 8 February 2019.

The PA has devoted the utmost attention and care to the data and information incorporated in this CP. Nevertheless, it is possible that there are inaccuracies and imperfections. The PA accepts no liability for damage resulting from these inaccuracies or imperfections, nor is any liability assumed for damage caused by the use or distribution of this CP, if this CP is used for purposes other than for the use of certificates described in paragraph 1.4 of this CP.

1.2 References to this CP

Within the PKI for the government different structures or roots are used based on the SHA-256 algorithm (G2 and G3). Furthermore these structures are devided into different domains.

The G2 root is devided into an Organization, a Citizen and an Autonomous Devices domain.

Under the G3 root there are domains for Organization Person, Organization Services, Citizen, and Autonomous Devices.

Each CP is uniquely identified by an OID, in accordance with the following schedule.

The OID is structured as follows: {joint-iso-itu-t (2). country (16). the Netherlands (528). Dutch organization (1). Dutch government (1003). PKI for the government (1). CP (2). autonomous devices domain (6). authenticity (1)/ confidentiality (2)/ combination (3). version number}.

If requirements only apply to one or two types of certificates, this is expressly specified by stating the Object Identifier (OID) referencing the applicable CP or CPs.

1.3 User Community

Within the Autonomous Devices domain, the certificate holders are devices that, in their operational stage of life, independently safeguard the integrity and authenticity of (measurement) data for (a specific purpose within a core task of) a specific government agency. The relevant government agency publishes a framework of standards for the devices to be manufactured for the specified purpose and is therefore seen as the "party responsible for establishing the framework".

Based on the framework of standards, the party responsible for establishing the framework issues a conformity certificate to every manufacturer that, for every type of device that is to be produced by the manufacturer, conforms to the framework of standards (the party responsible for establishing the framework can appoint a regulator responsible for conducting conformity assessments and issuing conformity certificates). This enables (prospective) device manufacturers to market devices that conform to the framework of standards.

Before a device (that conforms with the framework of standards) is ready for operation, a certificate has to be assigned (linked) to that device from the Autonomous Devices domain. During the operational life of an autonomous device, the devices certificate can be replaced or revoked. The party responsible for establishing the framework has to authorize one or more organizations to perform these tasks. The aforementioned organization is considered in this CP to be a Subscriber.

A Subscriber can nominate one or more certificate managers for performing (on behalf of the Subscriber) one or more activities relating to certificates in the Autonomous Devices domain. There are two types of certificate managers:

• Natural personalities directly related to the Subscriber organization;

• Natural personalities related to one or more legal personalities who have an agreement with the Subscriber organization.

Taking into account the aforementioned, in the Autonomous Devices domain the user community consists of parties responsible for establishing frameworks, manufacturers, subscribers, certificate managers, certificate holders (the devices themselves) and relying parties (including the parties responsible for establishing the frameworks).

• A Party responsible for establishing a framework is a government agency that:

• for a specific core task has a need for (measurement) data that originates from outside its immediate sphere of influence;

• to safeguard the integrity and authenticity of that (measurement) data, wishes to use specific devices that operate autonomously;

• to safeguard the trustworthiness of specimens of that type of device:

• draws up a framework of standards for the production, activation, operation, maintenance, collection and use and formulates this in legislation and regulations;

• based on that framework of standards, authorizes organizations to:

• produce and distribute devices of a particular type;

• link certificates to particular devices;

• replace certificates on particular devices;

• revoke certificates of particular types of devices.

• A Manufacturer is an organization recognized in the Netherlands, that demonstrably conforms to the Framework of standards for producing, and distributing in the Netherlands of specific types of Autonomous Devices and is authorized to do so by the Party responsible for establishing the framework.

• A subscriber is a natural or legal personality who enters into an agreement with a TSP on behalf of one or more certificate holders for certification of the public keys. Within the framework of the Autonomous Devices domain, a Subscriber is an organization recognized in the Netherlands, who demonstrably conforms to the admission requirements for mapping certificates (from the Autonomous Devices domain) to specific types of Autonomous Devices.

• A certificate holder is an entity, characterized in a protected link with a certificate as the holder of the private key that is linked to the public key provided in the certificate.
  
  A Certificate holder is a device of which the operation and the method of production demonstrably conform to the framework of standards of a specific type of autonomous device and that, in that capacity, is authorized by the party responsible for establishing the framework to use an Autonomous Devices certificate linked to that device.
  
  The linkage between certificate and device is made and protected by an organizational entity for which a subscriber is the contracting party.

• A Certificate manager is a natural person or a combination of a natural person and a legal personality who perform activities on behalf of the Subscriber (linking, replacement and/or revocation) with regard to the certificate holder's certificate. The subscriber instructs the certificate manager to perform the relevant actions and records these in a proof of certificate management.

• A relying party is every natural or legal personality who is a recipient of a certificate and who acts with a trust in that certificate. Unlike with other CPs, relying parties derive security from both the interconnectedness between an autonomous device and its certificate, and with the approval shown by that certificate of the operation of the autonomous device. The CP Autonomous Devices therefore places an equal emphasis on offering security about the interconnectedness of a message signed by an autonomous device with on the one hand the identity of the autonomous device and on the other hand its approved operation. Establishing the identity of the certificate holder (device) is, in light of this, as equally important as establishing the approval of its operation.

1.4 Certificate Usage

The use of certificates issued under this CP relates to communication from certificate holders who act in accordance with their certified operation.

[OID 2.16.528.1.1003.1.2.6.1] Authenticity certificates, which are issued under this CP, can be used for electronically reliably identifying and authenticating the Autonomous Device and its certified operation.

Under this OID OCSP responder certificates may be issued for use within the domain Autonomous Devices. Said certificates can be used to sign OCSP responses for use in the verification of the validity of the end user certificate. More information can be obtained in appendix A of the base requirements.

[OID 2.16.528.1.1003.1.2.6.2] Confidentiality certificates, issued under this CP, can be used to protect the confidentiality of data that is exchanged with the Autonomous Device and/or stored in that in its electronic form.

[OID 2.16.528.1.1003.1.2.6.3] Combination certificates that are issued under this CP can be used to safeguard a connection between a specific client and an Autonomous Device.

1.5 Contact Information Policy Authority

The PA is responsible for this CP. Questions relating to this CP can be put to the PA; the address can be found at: http://www.logius.nl/pkioverheid.

2 Publication and Repository Responsibilities

2.1 Electronic Repository

Contains no additional requirements.

2.2 Publication of TSP Information

3 Identification and Authentication

3.1 Naming

Contains no additional requirements.

3.2 Initial Identity Validation

3.3 Identification and Authentication for Re-key Requests

Contains no additional requirements.

4 Certificate Life-Cycle Operational Requirements

4.1 Certificate Application

Contains no additional requirements.

4.2 Certificate Acceptance

Contains no additional requirements.

4.3 Key Pair and Certificate Usage

Contains no additional requirements.

4.4 Revocation and Suspension of Certificates

4.5 Certificate Status Services

Contains no additional requirements.

5 Facility, Management and Operational Controls

5.1 Procedural Controls

Contains no additional requirements.

5.2 Personnel Controls

Contains no additional requirements.

5.3 Audit Loggin Procedures

5.4 Records Archival

5.5 Compromise and Disaster Recovery

6 Technical Security Controls

6.1 Key Pair Generation and Installation

6.2 Private Key Protection and Cryptographic Module Engineering Controls

6.3 Other Aspects of Key Pair Management

6.4 Activation data

6.5 Computer Security Controls

Contains no additional requirements.

6.6 Life Cycle Technical Controls

Contains no additional requirements.

6.7 Network Security Controls

Contains no additional requirements.

7 Certificate and CRL profiles

7.1 Certificate Profile

7.2 CRL Profile

Contains no additional requirements.

8 Compliance Audit and Other Assessments

All subjects relating to the conformity assessment of the TSPs within the PKI for the government are covered in PoR part 2 and the basic requirements.

9 Other Business and Legal Matters

9.1 Financial Responsibility

9.2 Intellectual Property Rights

Contains no additional requirements.

9.3 Representations and Warranties

9.4 Limitations of Liability

9.5 Amendments

Contains no additional requirements.

9.6 Dispute Resolution Procedures

Contains no additional requirements.

9.7 Governing Law

Contains no additional requirements.

9.8 Other provisions

If by judicial decision one or more provisions of this CP are declared to be invalid or not applicable, this does not affect the validity and applicability of all other provisions.

10 Appendix A Certificate profile

Profile of device-linked certificates for the Autonomous Devices domain

Criteria

When defining the fields and attributes within a certificate, the following codes are used:

• V : Compulsory; indicates that the attribute is compulsory and MUST be used in the certificate.

• O : Optional; indicates that the attribute is optional and MAY be used in the certificate.

• A : Advised against; indicates that the attribute is advised against and SHOULD NOT be used in the certificate.

• N: Is NOT ALLOWED.

It is not allowed to use fields that are not specified in the certificate profiles.

For the extensions, fields/attributes are used that, in accordance with international standards, are critical, are marked in the 'Critical' column with 'yes' to show that the relevant attribute MUST be checked using a process by means of which a certificate is evaluated. Other fields/attributes are shown with 'no'.

Device-linked certificates

Basic attributes

Standard extensions

Private extensions