Treasury X.509 Certificate Policy [TREASURYCP].” It Only Addresses Where an OLT PKI’S Requirements Differ from the Requirements for Basic Assurance in [TREASURYCP]

UNCLASSIFIED UNITED STATES DEPARTMENT OF THE TREASURY DEPARTMENT OF THE TREASURY PUBLIC KEY INFRASTRUCTURE (PKI) X.509 CERTIFICATE POLICY VERSION 3.4 April 27, 2021 Digitally signed by Daniel W. Wood Daniel W. Wood Date: 2021.04.27 10:48:30 -04'00' PKI Policy Management Authority (PMA) DANIEL W. WOOD DATE 1UNCLASSIFIED DOCUMENT VERSION CONTROL Version 2.0 <ul style="display: flex;"><li style="flex:1">Date </li><li style="flex:1">Author(s) </li><li style="flex:1">Description </li><li style="flex:1">Reason For Change </li></ul>Bring the Treasury PKI Policy into compliance with FPKIPA change proposal requiring all cross certified PKI Policies to be in RFC 3647 format. Department of the Treasury PKI Policy in RFC <ul style="display: flex;"><li style="flex:1">January 2008 </li><li style="flex:1">James Schminky </li></ul>3647 format. As a result of mapping the Treasury PKI Policy to Federal Policy, a number of minor changes and omissions where identified and corrected. Errata changes to sections 2.2.1, 2.1 2.2 March 17, 2009 March 11, 2010 James Schminky James Schminky 4.8, 4.912, 5.5, and 7.1.3. As a result of the PMA annual review a number of minor Errata changes to sections 5.6, and 6.3.2. Change proposal changes to 2.4, 4.2.2, 5.1, 5.1.1 5.1.2.1, 5.4.4, 5.4.5, 6.1.6, 6.5.1, and 6.7. corrections, Federal Bridge Certification Authority (FBCA) Policy Change Proposal Number: 2009-02 and 2010-01, and Treasury Change Proposal Change proposal changes As a result of FBCA Policy Change 2.3 2.4 April 15, 2010 March 22, 2011 James Schminky James Schminky <ul style="display: flex;"><li style="flex:1">to 8.1 and 8.4. </li><li style="flex:1">Proposal Number: 2010-02. </li></ul>Changes Proposal Changes to 1.3.1.8, 3.1.1&.2, 3.1.5, 3.2.3.1, 4.7, 6.1.5, 8.1, and 9.4.3. As a result of FBCA Policy Change Proposal Numbers; 2010-3 thru 8 and CPCA policy Change Proposal Number: 2011-1 Made changes to align the Treasury CP with the Common Policy Framework (CPF), removed allreference to the acronym “DoT” and replaced with the name “Treasury”. Changes Proposal Changes to 3.2.3.2 and 4.9.7 <ul style="display: flex;"><li style="flex:1">2.5 </li><li style="flex:1">September 11,2012 </li><li style="flex:1">Daniel Wood </li></ul>Daniel Wood Changes Proposal Changes to 1.2, 3.2.3.2, 6.1.5, 6.2.3, Made changes to align the Treasury CP with the CPF, 2.6 2.7 2.8 October 15, 2012 August 22, 2013 March 26, 2015 6.2.4.2, and 6.2.8. 1.3, 1.3.1, 1.3.1.1, 1.3.1.2, 1.3.1.3, 1.3.1.4, 1.3.1.5, 1.5.2, and 3.2.3.2. Fred Asomani- Atinkah Made changes to align the Treasury CP with the CPF, Clarified Treasury’s dual <ul style="display: flex;"><li style="flex:1">role as Federal Legacy and </li><li style="flex:1">Provide capabilities to customers </li></ul>SSP; Added PIV-I, role- and baseline update as requested by Daniel Wood, Terry McBride based, and group certificates FPKIPA 2UNCLASSIFIED Adds PIV-I, andInternal PKI OIDs, changed criteria for suspension, defined the PKIProgram Team, added theinternal PKI addendum, changes to Common/FederalCPs and editorial updates Changes to Treasury PKI based on user needs <ul style="display: flex;"><li style="flex:1">2.9 </li><li style="flex:1">March 25, 2017 </li><li style="flex:1">Daniel Wood </li></ul>Update based on TOCA Compliance Audit and introduction of the Fed Key Recovery Policyand other Common and Federal Bridge policy changes Correct minorerrors and maintain compliance withFed PKI (through <ul style="display: flex;"><li style="flex:1">2.91 </li><li style="flex:1">November 20, 2018 </li><li style="flex:1">Daniel Wood </li></ul>2018- 06) Updated based on Comments from BFS Maintain conformance with FBCA CP 3February 28, 2019 October 30, 1,2019 Daniel Wood Daniel Wood Updated Section 5.8with new language to cover CA terminations Maintain conformance with Federal/Common CPs 3.1 Updates in sections: 1, 1.1.1, 1.2, 1.4.1, 2.2.1, 4.4.2, 5.2.1, 5.2.1.1, 5.2.1.2, 5.3.1, 5.3.2, 5.3.7, roles from clearance requirements 5.4.2, 5.5.1, and 6.1.5 Responses to audit findings, annual review findings, change proposals, <ul style="display: flex;"><li style="flex:1">and for separation of Key Recovery </li><li style="flex:1">3.2 </li></ul>3.3 <ul style="display: flex;"><li style="flex:1">December 15, 2020 </li><li style="flex:1">Daniel Wood </li></ul>Daniel Wood on CA roles Removed the “offline” requirement on OLT Root CAs in section 1.3.1.2 of Addendum 1. Added Addendum 2 – Implementation of PKI Certificates on Treasury Systems To allow for remote administration on an OLT Root CA, and to define implementation policies on March 29, 2021 SSL/TLS certificates for HTTPS 3UNCLASSIFIED Table of Contents 1. INTRODUCTION...........................................................................................................................................................11 1.1 OVERVIEW................................................................................................................................................................................12 1.1.1 Certificate Policy...............................................................................................................................................................................12 1.1.2 Relationships between Treasury PKI CP & Treasury PKI CA CPSs.....................................................................................................12 1.1.3 Scope ................................................................................................................................................................................................12 1.1.4 Relationships between Treasury PKI CP, the FBCA and Other Entity CPs ........................................................................................13 1.1.5 Interaction with PKIs External to the Federal Government .............................................................................................................14 1.2 DOCUMENT IDENTIFICATION ..........................................................................................................................................................14 1.3 PKI ENTITIES....................................................................................................................................................................................15 1.3.1 Treasury PKI Program Team .............................................................................................................................................................15 1.3.2 Registration Authority ......................................................................................................................................................................18 1.3.3 Subscribers.......................................................................................................................................................................................19 1.3.4 Relying Parties ..................................................................................................................................................................................19 1.3.5 Other Participants ............................................................................................................................................................................20 1.4 CERTIFICATE USAGE ........................................................................................................................................................................20 1.4.1 Appropriate Certificate Uses ............................................................................................................................................................20 1.4.2 Prohibited Certificate Uses...............................................................................................................................................................22 1.5 POLICY ADMINISTRATION ...............................................................................................................................................................22 1.5.1 Organization administering the document ......................................................................................................................................22 1.5.2 Contact Person .................................................................................................................................................................................22 1.5.3 Person Determining CPS Suitability for the Policy............................................................................................................................23 1.5.4 CPS Approval Procedures .................................................................................................................................................................23 1.6 DEFINITIONS AND ACRONYMS........................................................................................................................................................23 2. PUBLICATION & REPOSITORY RESPONSIBILITIES .........................................................................................24 2.1 REPOSITORIES .................................................................................................................................................................................24 2.2 PUBLICATION OF CERTIFICATION INFORMATION ............................................................................................................................24 2.2.1 Publication of certificates and Certificate Status .............................................................................................................................24 2.2.2 Publication of CA Information ..........................................................................................................................................................25 2.2.3 Interoperability.................................................................................................................................................................................25 2.3 FREQUENCY OF PUBLICATION .........................................................................................................................................................25 2.4 ACCESS CONTROLS ON REPOSITORIES.............................................................................................................................................25 3. IDENTIFICATION & AUTHENTICATION...............................................................................................................26 3.1 NAMING..........................................................................................................................................................................................26 3.1.1 Types of Names ................................................................................................................................................................................26 3.1.2 Need for Names to Be Meaningful...................................................................................................................................................30 3.1.3 Anonymity or Pseudonymity of Subscribers ....................................................................................................................................30 3.1.4 Rules for Interpreting Various Name Forms.....................................................................................................................................31 4UNCLASSIFIED 3.1.5 Uniqueness of Names.......................................................................................................................................................................31 3.1.6 Recognition, Authentication, & Role of Trademarks........................................................................................................................31 3.2 INITIAL IDENTITY VALIDATION ........................................................................................................................................................31 3.2.1 Method to Prove Possession of Private Key.....................................................................................................................................32 3.2.2 Authentication of Organization Identity ..........................................................................................................................................32 3.2.3 Authentication of Individual Identity ...............................................................................................................................................33 3.2.4 Non-verified Subscriber Information ...............................................................................................................................................37 3.2.5 Validation of Authority.....................................................................................................................................................................38 3.2.6 Criteria for Interoperation................................................................................................................................................................38 3.3 IDENTIFICATION AND AUTHENTICATION FOR RE-KEY REQUESTS ....................................................................................................38 3.3.1 Identification and Authentication for Routine Re-key .....................................................................................................................38 3.3.2 Identification and Authentication for Re-key after Revocation .......................................................................................................40 3.4 IDENTIFICATION AND AUTHENTICATION FOR REVOCATION REQUEST ............................................................................................40 4. CERTIFICATE LIFE-CYCLE ........................................................................................................................................41 4.1 APPLICATION ..................................................................................................................................................................................41 4.1.1 Submission of Certificate Application ..............................................................................................................................................41 4.1.2 Enrollment Process and Responsibilities..........................................................................................................................................41 4.2 CERTIFICATE APPLICATION PROCESSING .........................................................................................................................................41 4.2.1 Performing Identification and Authentication Functions.................................................................................................................41 4.2.2 Approval or Rejection of Certificate Applications ............................................................................................................................42 4.2.3 Time to Process Certificate Applications..........................................................................................................................................42 4.3 ISSUANCE........................................................................................................................................................................................43 4.3.1 CA Actions during Certificate Issuance.............................................................................................................................................43 4.3.2 Notification to Subscriber of Certificate Issuance............................................................................................................................43 4.4 ACCEPTANCE...................................................................................................................................................................................43 4.4.1 Conduct constituting certificate acceptance....................................................................................................................................43 4.4.2 Publication of the Certificate by the CA ...........................................................................................................................................43 4.4.3 Notification of Certificate Issuance by the CA to other entities.......................................................................................................43 4.5 KEY PAIR AND CERTIFICATE USAGE .................................................................................................................................................44 4.5.1 Subscriber Private Key and Certificate Usage ..................................................................................................................................44 4.5.2 Relying Party Public key and Certificate Usage ................................................................................................................................44 4.6 CERTIFICATE RENEWAL....................................................................................................................................................................44 4.6.1 Circumstance for Certificate Renewal ..............................................................................................................................................44 4.6.2 Who may Request Renewal .............................................................................................................................................................45 4.6.3 Processing Certificate Renewal Requests.........................................................................................................................................45 4.6.4 Notification of new certificate issuance to Subscriber.....................................................................................................................45 4.6.5 Conduct constituting acceptance of a Renewal certificate ..............................................................................................................45 4.6.6 Publication of the Renewal certificate by the CA.............................................................................................................................45 4.6.7 Notification of Certificate Issuance by the CA to other entities.......................................................................................................45 4.7 CERTIFICATE RE-KEY ........................................................................................................................................................................45 4.7.1 Circumstance for Certificate Re-key.................................................................................................................................................46 4.7.2 Who may request certification of a new public key.........................................................................................................................46 4.7.3 Processing certificate Re-keying requests........................................................................................................................................46 5UNCLASSIFIED 4.7.4 Notification of new certificate issuance to Subscriber.....................................................................................................................46 4.7.5 Conduct constituting acceptance of a Re-keyed certificate.............................................................................................................46 4.7.6 Publication of the Re-keyed certificate by the CA............................................................................................................................46 4.7.7 Notification of certificate issuance by the CA to other Entities .......................................................................................................46 4.8 MODIFICATION ...............................................................................................................................................................................47 4.8.1 Circumstance for Certificate Modification .......................................................................................................................................47 4.8.2 Who may request Certificate Modification......................................................................................................................................47 4.8.3 Processing Certificate Modification Requests..................................................................................................................................47 4.8.4 Notification of new certificate issuance to Subscriber.....................................................................................................................48 4.8.5 Conduct constituting acceptance of modified certificate ................................................................................................................48 4.8.6 Publication of the modified certificate by the CA ............................................................................................................................48 4.8.7 Notification of certificate issuance by the CA to other Entities .......................................................................................................48

Treasury X.509 Certificate Policy [TREASURYCP].” It Only Addresses Where an OLT PKI’S Requirements Differ from the Requirements for Basic Assurance in [TREASURYCP]

Details

Download

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

Support