Transcription
NOT CLASSIFIED0REFERENCEISSUEDGSI 038666DATE12/09/2013DASSAULT AVIATION PKIDASSAULT AVIATIONCertificate PolicySCOPEDGSI 038666 ARELEASED document issued from Dassault Aviation repository.Sécuritédu Systèmed’InformationDirection Générale du Système rWriter's signatureAprovers's signatureJ.P. DAVIDJ.P. WEBERE. MONTACUTELLILast Editionpage : 1 / 90This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEDGSI 038666INDICEDATE12/09/2013DGSI 038666 ARELEASED document issued from Dassault Aviation repository.TABLE OF CONTENTS1.PREAMBLE . 41.1 Document issues . 41.2 List of updated pages . 41.3 Summary . 42.INTRODUCTION . 52.1 Overview . 52.2 Document Name and Identification . 62.3 PKI Participants . 92.4 Certificate Usage . 132.5 Policy Administration . 132.6 Definitions and Acronyms . 143.PUBLICATION AND PKI REPOSITORY RESPONSIBILITIES. 213.1 PKI Repositories. 213.2 Publication of Certificate Information . 213.3 Time or Frequency of Publication . 223.4 Access Controls on PKI Repositories . 224.IDENTIFICATION AND AUTHENTICATION . 234.1 Naming. 234.2 Initial Identity Validation . 244.3 Identification and Authentication for Re-Key Requests . 284.4 Identification and Authentication for Revocation Requests . 295.CERTIFICATE LIFE-CYCLE OPERATIONAL REQUIREMENTS . 305.1 Certificate Application . 305.2 Certificate Application Processing . 315.3 Certificate Issuance . 335.4 Certificate Acceptance. 345.5 Key Pair and Certificate Usage. 355.6 Certificate Renewal . 355.7 Certificate Re-Key . 375.8 Certificate Modification . 385.9 Certificate Revocation and Suspension . 395.10 Certificate Status Services. 435.11 End Of Subscription. 445.12 Key Escrow and Recovery. 446.FACILITY MANAGEMENT & OPERATIONAL CONTROLS. 456.1 Physical Controls. 456.2 Procedural Controls. 476.3 Personnel Controls . 516.4 Audit Logging Procedures . 536.5 Records Archival . 566.6 Key Changeover. 586.7 Compromise and Disaster Recovery . 58TABLE OF CONTENTS2This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEDGSI 038666DGSI 038666 ARELEASED document issued from Dassault Aviation repository.6.8INDICEDATE12/09/2013CA, CMS, and RA Termination . 607.TECHNICAL SECURITY CONTROLS . 617.1 Key Pair Generation and Installation. 617.2 Private Key Protection and Cryptographic Module Engineering Controls . 647.3 Other Aspects of Key Management . 677.4 Activation Data . 677.5 Computer Security Controls. 687.6 Life-Cycle Technical Controls . 697.7 Network Security Controls . 707.8 Time Stamping . 708.CERTIFICATE, CRL, AND OCSP PROFILES . 718.1 Certificate Profile . 718.2 CRL Profile . 728.3 OCSP Profile . 739.COMPLIANCE AUDIT AND OTHER ASSESSMENT . 749.1 Frequency or Circumstances of Assessments . 749.2 Identity and Qualifications of Assessor . 749.3 Assessor's Relationship to Assessed Entity. 749.4 Topics Covered by Assessment . 749.5 Actions Taken as a Result of Deficiency. 749.6 Communication of Results. 7510. OTHER BUSINESS AND LEGAL MATTERS . 7610.1 Fees 7610.2 Financial Responsibility . 7610.3 Confidentiality of Business Information . 7710.4 Privacy of Personal Information . 7710.5 Intellectual Property Rights. 7810.6 Representations and Warranties . 7910.7 Disclaimers of Warranties. 8310.8 Limitations of Liabilities. 8310.9 Indemnities . 8410.10Term and Termination . 8510.11Individual Notices and Communications with Participants. 8610.12Amendments . 8610.13Dispute Resolution Provisions . 8710.14Governing Law . 8710.15Compliance with Applicable Law . 8810.16Miscellaneous Provisions . 8810.17Other Provisions . 8911. CERTIFICATE PROFILES . 90TABLE OF CONTENTS3This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 0386661.PREAMBLE1.1Document dating PurposeE.Document creationMONTACUTELLIList of updated pagesAll the pages of this document are at the latest issue.Not applicable to this issue.1.3SummaryDGSI 038666 ARELEASED document issued from Dassault Aviation repository.This Certificate Policy is consistent with the Internet Engineering Task Force (IETF) RFC3647, “Internet X.509 Public Key Infrastructure Certificate Policy and CertificationPractice Statement Framework”.1. PREAMBLE4This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 0386662.DATE12/09/2013INTRODUCTIONThis Certificate Policy is consistent with the Internet Engineering Task Force (IETF) RFC3647, “Internet X.509 Public Key Infrastructure Certificate Policy and Certification PracticeStatement Framework”.2.1OverviewThis Certificate Policy (CP) defines several assurance levels that may be used byapplications and companies within Dassault Aviation domain to facilitate interoperabilitybetween Public Key Infrastructure (PKI) in Dassault Aviation domain. The term “assurance”used in this CP means how confident a Relying Party may be in the identity binding betweena public key it is presented, and the individual who's subject name is in the associated X.509Certificate (Security Principal). In addition, it may also give an indication of how assured aRelying Party may be that the Security Principal truly is in sole possession of thecorresponding private key, as well as how secure the system was that was used to producethe Certificate.Dassault Aviation intends to operate several Certification Authority (CA) based on thispolicy to facilitate interoperability at a technical level among aerospace PKIs. Such PKIswill be required to comply with all aspects of this CP, as demonstrated through the use ofpolicy mapping between such a PKI's CP and this CP.DGSI 038666 ARELEASED document issued from Dassault Aviation repository.All CA managed by this CP are signed by the Root CA (RCA) named “Dassault AviationRoot CA 1”.Any use of this CP outside of the scope here above mentioned is entirely at the using party'srisk. No Entity shall assert any OID listed in section 2 of this CP.2.1.1 Certificate PolicyAll X.509 Subscriber Certificates (not RCA, Intermediate CA (CA that signs other CAwithout being a Root CA and CA), issued under this Certificate Policy must contain onlyone registered Certificate Policy Object Identitiers (OID), each of which is associated with agiven assurance level as indicated in section 2 of this CP. The same Entity that is describedby the OID also publishes the corresponding CP, and Relying Parties may use this CP toestablish if a given Certificate satisfies their requirements for identity assurance.Depends of the type of certificate issued by the “CA”, “CA” contains the OID defined in thisCP.2. INTRODUCTION5This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 038666DATE12/09/20132.1.2 Relationship between this CP and the Dassault Aviation domain Bridge CPS andDassault Aviation domain Root CPSThis CP states what assurance can be placed in a Certificate issued under this policy. Theassociated Certification Practice Statement (CPS) states how the respective certificationauthorities establish that assurance.2.1.3 ScopeThis CP imposes requirements on: The Dassault Aviation domain PKI; and Any CA that is signed by DASSAULT AVIATION RCA (named RCA in the CP); and The Dassault Aviation PKI shall only issue Certificates to:o Other CAs upon approval by the Dassault Aviation PMA; ando Individuals who operate the PKI, in strict measure with operational necessity; ando Subscribers requiring certificates inside the Dassault Aviation domain context(collaboration portals, messaging.).1. The scope of this CP, in terms of Subscriber Certificate types is limited to those listed inSection 9.DGSI 038666 ARELEASED document issued from Dassault Aviation repository.2.2Document Name and IdentificationThis CP identifies 3 levels of assurance which are further described in the rest of thisdocument (Basic-hardware, Medium-hardware and Basic-software). Each assurance levelhas a distinct OID according rule set in CPS, which is asserted in the CertificatePoliciesX.509 extension of a Certificate which is issued in a manner that complies with therequirements herein for that assurance level.The OID are the following:Dassault Aviation OID root is : 1.3.6.1.4.1.18396.This root is completed by 4 digits A.B.C.D which means :-A : 2 means that is a PKI service.2. INTRODUCTION6This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 038666DATE12/09/2013-B : indicates a Certification Authority.o B 1 for CA « Dassault Aviation CA 2 »o B 2 for CA « Dassault Aviation EXP CA 1 »-C : indicates a version and a type a document :o C 101 for version 1 of Certificate Policy document (01).o C 102 for version 1 of Certificate Practice Statement document CPS (02)-D : indicates a certificate profile : environment, usage type and assurance level managedby the Certification Authority indicates by the digit B.D ENPE for Environment : E 1 production environment.E 2 validation environment.E 3 developpement environment.N for Assurance Level : N 1 Basic-software : Certificate software.N 2 Basic-hardware : Certificate on hardware token – distribution bypaper mailN 3 Medium-hardware : Certificate on hardware token – distributionwith the presence of the holderDGSI 038666 ARELEASED document issued from Dassault Aviation repository.P for Certificate Profile (usage) : P X number of certificate usage.1 : user auth2 : user chiff3 : user sign4 : user auth sign5 : tls server6 : tls client7 : tls server client8 : server sign9 : domain controller10 : subca11 : code sign12 : divers2. INTRODUCTION7This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 038666DATE12/09/2013Under Certification Authority : Dassault Aviation EXP CA 1 :Certificate ProfileAuthentification personnelDassaultAuthentification personnelDassaultAuthentification personnelextérieurAuthentification personnelextérieur (Local SecurityOfficer)Authentification machineclient TLS n’appartenantpas à Dassault AviationChiffrement deZoneCentral/CryhodChiffrement deZoneCentral/CryhodLevel 8396.2.1.101.E32Under Certification Authority : Dassault Aviation CA 2 :Dassault Aviation Type-2 CA 2DGSI 038666 ARELEASED document issued from Dassault Aviation repository.Certificate ProfileAuthentification personneld’atelierLevel 01.E31Dassault Aviation Type-3 CA 2Certificate ProfileAuthentification personnelmédicalLevel 01.E31Dassault Aviation Type-5 CA 2Certificate ProfileBlueCoat pour @WebLevel 1.E13Dassault Aviation Machines CA 2Certificate ProfileAuthentification machineLevel 1.E162. INTRODUCTION8This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 038666DATE12/09/2013client TLS appartenant pasDassault Aviation (visiblede l’intérieur)Dassault Aviation Machines Pub CA 2Certificate ProfileAuthentification machineclient TLS appartenant pasDassault Aviation (visiblede l’extérieur)Level 1.E16Dassault Aviation Acces Reseau CA 2Certificate ProfileAuthentification 802.1Xpour les machinesLevel 1.E16Dassault Aviation TMS V2 CA 2Certificate ProfileAuthentification destéléphones TMS V2Level 1.E16Dassault Aviation Signature CA 2DGSI 038666 ARELEASED document issued from Dassault Aviation repository.Certificate ProfileCertificats de signature decode2.3Level 1.E111PKI Participants2.3.1 PKI Authorities2.3.1.1 Policy Management Authority (PMA)The PMA is responsible for: Drafting and approval of this CP; and Drafting, compliance analysis, and approval of the CPS; and2. INTRODUCTION9This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 038666DATE12/09/2013 Accepting and processing applications from Entities desiring to certify a CA with anexternal Root CA ; and Determining the mappings between Certificates issued by Dassault Aviation domain PKIand the levels of assurance set forth in the CP (which will include objective andsubjective evaluation of the respective CP contents and any other facts deemed relevantby the PMA); and Manage all the internal certificate request and revocation request in order to sign andrevoke internal CA within DASSAULT AVIATION domain, and Ensuring continued conformance of the CPSs with applicable requirements as acondition for continued securing of the assurance levels as stipulated in this CP, and Ensuring continued conformance of this PKI and other domains’ PKI with applicablerequirements as a condition for allowing continued interoperability with certificationprovided by external Root CAs.A complete description of PMA roles and responsibilities are provided in the CPS.2.3.1.2 Dassault Aviation Operational AuthorityThe Operational Authority (OA) is the organization responsible for the operation of the PKIissuing Subscriber Certificates, CA Certificates and Certificate Revocation Lists (CRLs) andAuthorities Revocation List (ARL) into the PKI Repository, as well as ensuring that allservice levels for availability, reliability, and timeliness of execution outlined in this CP aremet.DGSI 038666 ARELEASED document issued from Dassault Aviation repository.2.3.1.3 Dassault Aviation Operational Authority AdministratorThe OA Administrator (OAA) is the individual in the OA that has principal responsibilityfor overseeing the proper operation of the PKI, including the Repository, and who appointsindividuals to the positions of Operational Authority Members. The OA Administrator isnominated by the organization operating the PKI, and approved by the PMA.OA Administrator is a member of PMA.2.3.1.4 Operational Authority MembersThe OA Members are individuals within the OA who, under the supervision of the OAAdministrator, operate the PKI infrastructure components, including executing the PMAdirections to issue Certificates to CAs or taking other action to enable interoperabilitybetween the CA and external domain PKIs.2. INTRODUCTION10This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 038666DATE12/09/2013The OA Members include those individuals performing roles as all described in Section4.2.1 of this CP.OA members are personnel of the OA.2.3.1.5 Root CAA Root CA is a CA which is characterized by having itself as the issuer (that is, it is selfsigned). Root CAs may not be revoked in the normal manner (they are not put on anAuthority Revocation List), and, when used as a Trust Anchor, must be securely transmittedto any Relying Parties which choose to accept it as one by the mechanisms outlined insection 5.1.4.The Root CA is “Dassault Aviation Root CA 1”.2.3.1.6 Intermediate CAAn Intermediate CA is a CA that is not a Root CA and whose primary function is to issueCertificates to other CAs. Intermediate CAs may or may not issue some end entityCertificates.DGSI 038666 ARELEASED document issued from Dassault Aviation repository.There are two intermediates CA under the root CA : “Dassault Aviation CA 2” and“Dassault Aviation EXP CA 1” .2.3.1.7 Signing CAA Signing CA is a CA whose primary function is to issue Certificates to the end entities. ASigning CA does not issue Certificates to other CAs. CPS referenced all signing CA.2.3.1.8 Certificate Status AuthoritiesA Certificate Status Authority (CSA) is an authority that provides status of Certificates orcertification paths. CSAs can be operated in conjunction with the CAs or independent of theCAs.Not applicable for this CP.2. INTRODUCTION11This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 038666DATE12/09/20132.3.2 Registration AuthoritiesThe Registration Authority (RA) is the entity that collects and verifies each Subscriber'sidentity and information that are to be entered into his or her Public Key Certificate. An RAinteracts with the CA to enter and approve the Subscriber Certificate request information.PMA acts as the RA for the CAs. It performs its function in accordance with the concernedCPS approved by the PMA.RA can delegate some operation to Local RA for all or few RA’s operation to manageSubscriber certificate life cycle. In all cases, LRA perform operation according proceduredefined by RA. When LRA is a different legal person from Dassault Aviation, then acontract is established between legal person of the RA and legal person of the LRA.2.3.3 SubscribersA Subscriber is the entity whose name appears as the subject in a Certificate, who assertsthat it uses its key and Certificate in accordance with the Certificate Policy asserted in theCertificate, and who does not itself issue Certificates.Subscribers include Dassault Aviation employees, subcontractor’ personnel, suppliers,partners or customers, and hardware devices such as firewalls, routers or servers operated byor in the name of Dassault Aviation Entity.For device, there is a PKI Sponsor in charge of managing device key pair and certificaterequest.DGSI 038666 ARELEASED document issued from Dassault Aviation repository.2.3.4 Relying PartiesA Relying Party is the entity that relies on the validity of the binding between the Subscriberand a credential (in the context of a PKI, a Certificate and associated Public Key). TheRelying Party is responsible for deciding how to check the validity of the Certificate bychecking the appropriate Certificate status information (ARL and CRL). The Relying Partycan use the Certificate to verify the integrity of a digitally signed message, to identify thecreator of a message, or to establish confidential communications with the holder of theCertificate. A Relying Party may use information in the Certificate (such as CertificatePolicy identifiers) to determine the suitability of the Certificate for a particular use.2. INTRODUCTION12This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 038666DATE12/09/20132.3.5 Other Participants2.3.5.1 External Entity (Organization)An External Entity is a private or a government entity (legal person) which deployscertificate for Subscriber. External Entity’s Subscriber can be issued certificate either byDassault’s RA or LRA or External Entity’s RA or LRA.The External entity abides to this CP and the associated CPS.2.4Certificate Usage2.4.1 Appropriate Certificate UsesThe certificate signed by CA governed by this CP can only be used in the context ofDassault Aviation domain.2.4.2 Prohibited Certificate UsesAll the others usages are forbidden.2.5Policy AdministrationDGSI 038666 ARELEASED document issued from Dassault Aviation repository.2.5.1 Organization administering the documentThe PMA is responsible for all aspects of this CP.2.5.2 Contact PersonQuestions regarding this CP shall be directed to the Chair of the PMA. Current contactdetails for the chair may be found at:Jean-Pierre DAVID, jean-pierre.david@dassault-aviation.com2.5.3 Person Determining Certificate Practice Statement Suitability for the PolicyThe term CPS is defined in the [RFC 3647] as: "A statement of the practices, which aCertification Authority employs in issuing Certificates." It is a comprehensive description ofsuch details as the precise implementation of service offerings and detailed procedures of2. INTRODUCTION13This document is the intellectual property of DASSAULT AVIATION. It may not be used, reproduced, modified or disclosed without its authorization. DASSAULT AVIATION Proprietary Data.
NOT CLASSIFIEDREFERENCEINDICEDGSI 038666DATE12/09/2013Certificate life-cycle management. It shall be more detailed than the correspondingCertificate Policy defined above.A CPS may be approved as sufficient for fulfilling the obligations under this CP when sucha CPS has been reviewed by an auditor or compliance analyst competent in the operations ofa PKI, and when said person determines that the CPS is in fact in compliance with allaspects of this CP. The auditor or compliance analyst shall be from a firm which isindependent from the entity being audited. Additionally, the auditor or compliance analystmay not be the author of the subject CPS.The PMA shall approve the CPS, and shall furthermore make the determination whether acompliance analyst meets the requirements outlined herein.2.5.4 CPS Approval ProceduresThe PMA Charter shall outline the specific procedures necessary to approve the CPS.2.5.5 WaiversThere shall be no waivers to this CP.2.6Definitions and AcronymsDGSI 038666 ARELEASED document issued from Dassault Aviation repository.AccreditationActivation DataAssurance LevelAuthorityRevocation List(ARL)AuthenticationFormal declaration by a Designated Approving Authority that anInformation System is approved to operate in a particular securitymode using a presc
DASSAULT AVIATION PKI DASSAULT AVIATION Certificate Policy SCOPE Sécurité du Système d'Information Direction Générale du Système d'Information Edition Date Issue Author Writer's signature Aprovers's signature Origin 12/09/2013 E. MONTACUTELLI Last Edition J.P. DAVID J.P. WEBER page : 1/ 90 This document is the intellectual property of .
