SIST-TP ETSI/TR 102 040 V1.1.1:2005

• Abstract:

  To investigate the potential for international harmonization of policy requirements for CAs. This relates to the work in the US and other international activities specifying security management and policy requirements for CSPs issuing certificates (qualified or other) to ensure harmonization with the European standardization in this area. As well as influencing these other international activities, this work will identify variations in the requirements as specified in ETSI TS 101 456 (Policy requirements for CA issuing qualified certificates). This activity will include discussions and where possible achieve harmonisation with relevant organisations such as: ABA, FPKI, IETF, PKI Forum, WAP Forum.

• Status: Published
• Publication Date: 30-Apr-2005
• ICS: 35.040.01 - Information coding in general
• Technical Committee: SPN - Services and Protocols for Networks
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 01-May-2005
• Due Date: 01-May-2005
• Completion Date: 01-May-2005
• Ref Project: ETSI TR 102 040 V1.1.1 (2002-03) - International Harmonization of Policy Requirements for CAs issuing Certificates

SIST-TP ETSI/TR 102 040 V1.1.1:2005 is the Slovenian adoption of ETSI TR 102 040 V1.1.1, a Technical Report on international harmonization of policy requirements for certification authorities (CAs) issuing certificates. It compares ETSI policy requirements with other PKI policy and practice frameworks and sets out a direction for harmonizing them with the European electronic signature framework. It is aimed at people who define, assess, or align certificate policy and certification practice in public key infrastructure (PKI) environments.

What does SIST-TP ETSI/TR 102 040 V1.1.1:2005 specify?

SIST-TP ETSI/TR 102 040 V1.1.1:2005 specifies a study of how ETSI policy requirements for CAs can be harmonized with other internationally recognized approaches. The report focuses on certificate policy, security management, and cross-recognition between PKI policy environments.

The document is organized into a short analytical structure:

• Clause 1 - Scope
• Clause 2 - References
• Clause 3 - Definitions and abbreviations
• Clause 4 - Objective
• Clause 5 - Relevant activities
• Clause 6 - Recommendations

The scope ties the report to ETSI TS 101 456 and ETSI TS 102 042, and to the aim of meeting the European Electronic Signature Directive while operating in a more widely harmonized policy framework.

What are the key requirements of SIST-TP ETSI/TR 102 040 V1.1.1:2005?

SIST-TP ETSI/TR 102 040 V1.1.1:2005 is a recommendations report rather than a prescriptive requirements standard. Its main value is the set of policy directions it gives for aligning ETSI certificate policy work with international practice.

1) Harmonization must preserve European electronic signature objectives

Clause 4 states that international certificate policy harmonization should support CA policy requirements that meet the European Electronic Signature Directive and comparable frameworks outside Europe. In practice, this means any aligned policy needs to remain acceptable for European approval and also understandable in wider markets.

2) ETSI policy structures should stay easy to relate to external frameworks

Clause 4 says the structure and requirements of ETSI documents should have a simple relationship to other recognized standards. For implementers and assessors, that means a certificate policy should be traceable across frameworks instead of being an isolated local format.

3) RFC 2527 gives structure, but not enough specific policy content

Clause 5.2 explains that the IETF PKIX framework in RFC 2527 provides a structure for certificate policies and certification practice statements, but not the full set of specific requirements used by ETSI. This matters because a CA can use RFC 2527 as a framework, but still needs additional policy detail for security management and organization.

4) ISO/IEC 14516 is background guidance, not a full CA policy basis

Clause 5.3 says ISO/IEC 14516 gives general guidance on trusted third party services, but does not include the specific policy requirements needed to assess a CA. In practice, it is useful as context, but not enough on its own for CA policy drafting or assessment.

5) ABA PAG is mainly legal and general

Clause 5.4 describes the American Bar Association PKI Assessment Guidelines as useful general guidance, especially on the legal side, while noting that it does not set out specific certificate policy requirements. That means legal and policy teams can use it for orientation, but not as a complete CA policy template.

6) ANSI X9.79 and ISO TC68 are the closest harmonization targets

Clauses 5.6 and 5.7 identify ANSI X9.79 and the ISO TC68 PKI framework work as closely aligned with ETSI policy requirements. The report recommends focusing future harmonization work there, because those frameworks are structured in a way that can support options for different CA policy objectives.

7) Future work should stay linked to related bodies

Clause 6 recommends following future revisions to RFC 2527, feeding work into ISO JTC1 SC27, and keeping links with the ABA Information Security Committee. For organizations, this means PKI policy alignment is an ongoing coordination task, not a one-time mapping exercise.

What terms does SIST-TP ETSI/TR 102 040 V1.1.1:2005 define?

• Certificate - a user's public key together with other information, protected so it cannot be forged by encipherment with the issuing CA's private key.
• Certificate policy - a named set of rules that states where a certificate applies and which community or application class it supports.
• Certification authority (CA) - an authority trusted by one or more users to create and assign certificates.
• Certification practice statement (CPS) - the statement describing the practices a CA uses when issuing certificates.
• Public Key Infrastructure (PKI) - the environment of policies, practices, and services used to manage public key certificates and related trust services.
• PKI Assessment Guidelines (PAG) - the ABA document cited as general guidance for assessing PKI arrangements.

Who uses SIST-TP ETSI/TR 102 040 V1.1.1:2005?

SIST-TP ETSI/TR 102 040 V1.1.1:2005 is relevant to CAs, PKI policy authors, trust service providers, auditors, and accreditation or assessment bodies. It is also useful for organizations in electronic signatures, e-commerce, and financial services that need to compare certificate policy frameworks or plan cross-recognition.

The report also speaks directly to standards and liaison work involving ETSI, IETF, ISO, ANSI, ABA, APEC, PKI Forum, and related policy groups. In practice, these groups use it to align policy structures, identify gaps, and decide where harmonization is realistic.

Which standards are used with SIST-TP ETSI/TR 102 040 V1.1.1:2005?

• ETSI TS 101 456 - policy requirements for CAs issuing qualified certificates; the main ETSI reference point for harmonization.
• ETSI TS 102 042 - policy requirements for CAs issuing public key certificates; the related ETSI policy specification.
• RFC 2527 - the IETF certificate policies and certification practices framework; provides structure for CP and CPS documents.
• ISO/IEC 14516 - guidelines on the use and management of Trusted Third Party services; provides background guidance.
• Directive 1999/93/EC - the European electronic signature framework that drives the report's harmonization هدف.
• ABA PKI Assessment Guidelines (PAG) - general guidance for PKI assessment, with a legal perspective.
• ANSI X9.79 - PKI Practices and Policy Framework; a close reference for policy structure and requirements.
• ISO/TC68/SC2 N1140 - the proposed PKI for Financial Services framework, later designated ISO 21188.

What does the SIST-TP ETSI/TR 102 040 V1.1.1:2005 document contain?

The document contains a foreword, the scope, reference list, definitions and abbreviations, the harmonization objective, a review of related international activities, and final recommendations. Its main content is comparative and policy-oriented: it explains how ETSI certificate policy work relates to RFC 2527, ISO/IEC 14516, ABA PAG, APEC eSTG, ANSI X9.79, and ISO TC68 work.

It also gives practical direction on where future harmonization efforts should focus and why those bodies matter for recognition across different PKI environments. The report is used for policy planning, framework comparison, and liaison work rather than testing or product certification.

SLOVENSKI STANDARD
01-maj-2005
Mednarodna uskladitev politike zahtev za overitelje (certifikacijske
agencije/organe), ki izdajajo certifikate
International Harmonization of Policy Requirements for CAs issuing Certificates
Ta slovenski standard je istoveten z: TR 102 040 Version 1.1.1
ICS:
35.040 Nabori znakov in kodiranje Character sets and
informacij information coding
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

Technical Report
International Harmonization
of Policy Requirements for CAs issuing Certificates

2 ETSI TR 102 040 V1.1.1 (2002-03)

Reference
DTR/SEC-004015
Keywords
e-commerce, electronic signature, public key,
trust services, security
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE

Tel.: [phone]  Fax: [phone]

Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88

Important notice
Individual copies of the present document can be downloaded from:
http://www.etsi.org
The present document may be made available in more than one electronic version or in print. In any case of existing or
perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF).
In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive
within ETSI Secretariat.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
http://portal.etsi.org/tb/status/status.asp
If you find errors in the present document, send your comment to:
[e-mail]
Copyright Notification
No part may be reproduced except as authorized by written permission.
The copyright and the foregoing restriction extend to reproduction in all media.

© European Telecommunications Standards Institute 2002.
All rights reserved.
ETSI
3 ETSI TR 102 040 V1.1.1 (2002-03)
Contents
Intellectual Property Rights.4
Foreword.4
1 Scope.5
2 References.5
3 Definitions and abbreviations.5
3.1 Definitions.5
3.2 Abbreviations.6
4 Objective.6
5 Relevant activities.6
5.1 Introduction.6
5.2 IETF PKIX policy and practices framework.6
5.3 ISO SC27 TTP guidelines .7
5.4 ABA PKI assessment guidelines .7
5.5 APEC TEL eSTG .7
5.6 ANSI X9.79 - PKI policy and practices framework.7
5.7 ISO TC68 - PKI policy and practices framework .8
6 Recommendations.8
History .9

ETSI
4 ETSI TR 102 040 V1.1.1 (2002-03)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (http://webapp.etsi.org/IPR/home.asp).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web
server) which are, or may be, or may become, essential to the present document.
Foreword
This Technical Report (TR) has been produced by ETSI Technical Committee Security (SEC).
ETSI
5 ETSI TR 102 040 V1.1.1 (2002-03)
1 Scope
The present document presents the results of ongoing work to harmonize existing ETSI technical specification on policy
requirements for certification authorities (TS 101 456 [1] and TS 102 042 [2]) with other internationally recognized
standards and related activities.
The aim of the present document is to identify the way forward to meet the requirements of European Electronic
Signature Directive 1999/93/EC [5] whilst operating within an internationally harmonized certificate policy framework
to facilitate cross recognition between PKI policy environments.
2 References
For the purposes of this Technical Report (TR) the following references apply:
[1] ETSI TS 101 456: "Policy requirements for certification authorities issuing qualified certificates".
[2] ETSI TS 102 042: "Policy requirements for certification authorities issuing public key
certificates".
[3] RFC 2527: "Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices
Framework".
[4] ISO/IEC 14516: "Information technology - Security techniques - Guidelines on the use and
management of Trusted Third Party services".
[5] Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a
Community framework for electronic signatures.
[6] American Bar Association: "PKI Assessment Guidelines (PAG)".
[7] ANSI X9.79: "Public Key Infrastructure (PKI) Practices and Policy Framework".
[8] ISO/TC68/SC2 N1140 - New Work Item Proposal - Public Key Infrastructure for Financial
Services - Practices and Policy Framework.
NOTE: This work item has been agreed and the resulting standard has been designated the identifier ISO 21188.
3 Definitions and abbreviations
3.1 Definitions
For the purposes of the present document, the following terms and definitions apply:
certificate: public key of a user, together with some other information, rendered un-forgeable by encipherment with the
private key of the certification authority which issued it
certificate policy: named set of rules that indicates the applicability of a certificate to a particular community and/or
class of application with common security requirements
certification authority: authority trusted by one or more users to create and assign certificates
certification practice statement: statement of the practices which a certification authority employs in issuing
certificates
ETSI
6 ETSI TR 102 040 V1.1.1 (2002-03)
3.2 Abbreviations
For the purposes of the present document, the following abbreviations apply:
ABA American Bar Association
ANSI American National Standards Institute
APEC Asia-Pacific Economic Community
CA Certification Authority
EESSI European Electronic Signature Standardization Initiative
IETF Internet Engineering Task Force
ISO International Organization for Standardization
PAG PKI Assessment Guidelines (document published by the ABA [6])
PKI Public Key Infrastructure
4 Objective
The major objective of the present document on international certificate policy harmonization is that other
internationally recognized policies are harmonized with CA policy requirements which meet the requirements of
European electronic signature Directive [5] and other equivalents which are not constrained by the European legal
framework.
Thus, the main aim of harmonization is:
- To ensure that European CAs, both operating within the framework of European Directive and more generally,
have at least equal recognition in the wider international marketplace;
- To ensure that certification schemes accredited under the internationally recognized standards are recognized to
meet the security and management re
...