1、ETSI TR 102 153 1.1.1 (2003-02) Technical Repor Electronic Signatures and Infrastructures (ESI); Pre-study on certificate profiles 2 ETSI TR 102 153 VI .I .I (2003-02) Reference DTR/ESI-000015 Keywords authentication, e-commerce, electronic signature, secu rity ETSI 650 Route des Lucioles F-O6921 So
2、phia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 O0 Fax: +33 4 93 65 47 16 Siret No 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-prfecture de Grasse (06) No 7803/88 Important notice Individual copies of the present document can be downloaded from: http:lwmv.etsi .a
3、rq The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ET
4、SI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at ha p:/pa rta I.
5、etsi I a rgltbistat uslstatus .as p If you find errors in the present document, send your comment to: Cori vriaht Notifica tion No part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media. O European Telecommun
6、ications Standards Institute 2003. All rights reserved. DECTTM, PLUGTESTSTMand UMTSTMare Trade Marks of ETSI registered for the benefit of its Members. TIPHONTM and the TIPHON logo are Trade Marks currently being registered by ETSI for the benefit of its Members. 3GPPTM is a Trade Mark of ETSI regis
7、tered for the benefit of its Members and of the 3GPP Organizational Partners. ETSI 3 ETSI TR 102 153 VI . 1 . 1 (2003-02) Contents Intellectual Property Rights 4 Foreword . 4 1 2 3 3.1 3.2 4 5 6 6.1 6.2 6.2.1 6.2.2 7 Scope 5 References 5 Definitions and abbreviations . 6 Definitions 6 Abbreviations
8、. 6 Implications from the requirements of the Directive . 6 Documents scrutinized . 7 Analysis outcomes 7 Profile comparison . 7 Profiles inconsistencies 11 Inconsistencies list 11 Comments on the findings 12 Proposed strategy and implementation phases . 13 Annex A: Participation to the task . 14 Hi
9、story 15 ETSI 4 ETSI TR 102 153 VI .I .I (2003-02) Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can
10、be found in ETSI SR O00 314: “Intellectual Property Rights (7PRs); Essential, orpotentially Essential, IPRs notlJied to ETSI in respect ofETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (5). All published ETSI deliverables shall incl
11、ude information which directs the reader to the above source of information. Foreword This Technical Report (TR) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI). ETSI TC ES1 has remarked that existing certificate profiles, among them TS 101 862 6, are co
12、nsidered too open, allowing too many choices, which lead to incompatible implementations. It has then agreed to launch a pre-study to assess the preconditions for an action to further profile the certificate formats. The purpose of this study is to cover, but not be limited to, qualified certificate
13、s. The main finding of this study is that more rigid profiles are deemed necessary to actually achieve interoperability and, therefore, “to ensure the free movement within the internal market and to build trust in electronic signature“ (see Directive 1999/93/EC recital (5) i). Therefore the next ste
14、p should be to issue a Technical Standard speciSl the full format of a Qualified Certificate both from an issuer point of view and from a verifier point of view. Formats for “citizen“ certificates (Electronic Identity Certificates (EIC) could also be indicated. ETSI 5 ETSI TR 102 153 VI .I .I (2003-
15、02) 1 Scope The study was intended to include: Investigation on the major sources of incompatibility. Review of existing certificate configurations in the public domain, i.e. for open user communities. Review of proposed profiles. Conclusion whether a normative task is feasible and meaningful. Since
16、 the conclusion reached is that a normative task is required, the study also covers the rest of what the TOR required: Proposed strategy for harmonization with existing standards in the area, notably with the IETF and ETSI QC-profiles. Proposal for the way of publishing, e.g. annex to existing stand
17、ard or stand-alone document. TOR of the task to be carried out, including estimated effort and time. The following two certificate types have been covered: certificates to be used in a qualified signature; 1) 2) authentication certificates. It is to be noted that the purpose of the study was mainly
18、to investigate if there actually are risks of major incompatibilities among existing profiles. In other words, the survey was not intended to take into exam all existing profiles, which would have been too broad an effort for the limited resources available. The goal was instead to collect, if appli
19、cable, sufficient evidence of such risks. When it has been achieved, no additional certificate profiles have been taken into exam. For this reason a few certificate profiles have been left out; for example: the Italian Electronic Identity Document (EID) certificate profile and the corresponding expe
20、rimental French one. This simply means that the purpose had been achieved before their turn to be taken in exam had arrived. 2 References For the purposes of this Technical Report (TR), the following references apply: il Directive 1999/93/EC of the European Parliament and of the Council of 13 Decemb
21、er 1999 on a Community framework for electronic signatures. IETF RFC 3279: “Algorithms and Identifiers for the Internet X.509 Public Key Infiastructure Certificate and Certificate Revocation List (CRL) Profile“, W. Polk, R. Housley, L. Bassham. April 2002. 21 31 41 51 IETF RFC 3280: “Internet X.509
22、Public Key Infiastructure Certificate and Certificate Revocation List (CRL) Profile“. R.Housley, W. Ford, W. Polk, D. Solo. April 2002. IETF RFC 3039: “Internet X.509 Public Key Infrastructure - Qualified Certificates Profile“. S. Santesson, W. Polk, P. Barzin, M. Nystrom. January 2001. ISO/IEC 9594
23、-8: “Information technology - Open Systems Interconnection - The Directory: Public-key and attribute certificate frameworks“ - Fourth Edition 200 1-08-0 1. ETSI TS 101 862: “Qualified certificate profile“ IETF RFC 2459: “Internet X.509 Public Key Infrastructure Certificate and CRL Profile“. ETSI 6 E
24、TSI TR 102 153 VI .I .I (2003-02) 3 3.1 Definitions and abbreviations Definitions For the purposes of the present document, the following terms and definitions apply: authentication certificate: Public Key Certificate (PKC) intended to be used in an electronic signature which serves as a method of a
25、uthentication, as specified in Directive i, article 2.1. Certification Authority: authority trusted by one or more users to create and assign public key certificates Public Key Certificate (PKC): data structure containing the public key of an end-entity and some other information, which is digitally
26、 signed with the private key of the CA which issued it Qualified Certificate: Public Key Certificate (PKC) that conforms to Directive i, annex I and that is issued by a Certification Authority that conforms to the requirements of Annex II of the same Directive. 3.2 Abbreviations For the purposes of
27、the present document, the following abbreviations apply: CA CRL CSP EESSI EIC EID IETF IS0 PKC PKI PKIX TOR QC Certification Authority Certificate Revocation List Certificate Service Provider European Electronic Signature Standardization Initiative Electronic Identity Certificates Electronic Identit
28、y Document Internet Engineering Task Force International Organization for Standardization Public Key Certificate Public Key Infiastructure Public Key Infrastructure X.509 based Qualified Certificate Terms of Reference 4 Implications from the requirements of the Directive Directive 11 whereas (5) pro
29、vides a clear hint to interoperability: “The interoperability of electronic-signature products should bepromoted; in accordance with Article 14 of the Treaty, the internal market comprises an area without internal frontiers in which the free movement of goods is ensured; essential requirements speci
30、fic to electronic-signature products must be met in order to ensure free movement within the internal market and to build trust in electronic signatures,. . . I. Directive 11 whereas (7) stresses the need to promote international communications: “The internal market ensures the free movement ofperso
31、ns, as a result of which citizens and residents of the European Union increasingly need to deal with authorities in Member States other than the one in which they reside; the availability of electronic communication could be of great sewice in this respect“. Similarly whereas (10) states: “The inter
32、nal market enables certification-service providers to develop their cross-border activities with a view to increasing their competitiveness, and thus to offer consumers and businesses new opportunities to exchange information and trade electronically in a secure way, regardless of frontiers. From th
33、e above quotations a strong need stems for interoperability that has as a first pillar the certificate profile. Other main pillars are: signature formats, certificate status information format, Certificate Service Provider (CSP) status information format, time stamping format. From the Directive i,
34、article 5 both subsections, both qualified certificates and non qualified certificates appear to be subject to interoperability issues and therefore both deserve an interoperability focussed study. Actually it is impossible to profile every non qualified certificate type. Furthermore such an effort
35、would be somewhat questionable. ETSI 7 ETSI TR 102 153 VI .I .I (2003-02) Document name A-Trust - Certificate and CRL Specification FINEID S4-1 - Implementation profile 1 of the To focus on a feasible and useful purpose, thus endeavouring in an effort both effective and efficient, this study address
36、ed only two meaningful certificate types: 1) 2) certificate to be used in qualified signatures; authentication certificates (for both purposes: “peer entity authentication“ and “data origin authentication“). Organization A-Trust Gesellschaft fr Sicherheitssysteme im ele kt ron isc hen Zahl u ngsverk
37、e h r Gm bH . Population Register Centre 5 Documents scrutinized The following profiles and documents have been analysed by the task components. FINEID - SI specification. FINEID S4-2 - Implementation profile 2 (for organizational usage) of the FINEID SI specification. Common ISIS-MTT specification
38、for PKI applications from T7 dateofBirth; placeofBirth; gender; countryOfCitizenship; and countryOfResidence. This information most likely will be necessary to better specify the certificate users information. digitalsignature topic. Ce yUsage Su bjectDirectoryAttributes rivate extensions IAlso in t
39、his case additional investigation is to be performed. IThese extensions are still in their infancy, so no definite S3 assessment is reasonable to be done. Additional investigation is therefore recommended. 6.2.2 Comments on the findings Major concerns arise from the previous table: 1) 2) non full in
40、teroperability among certificates; questionable choices, mostly in the authentication certificate profile. Both concerns may lead to major problems in exchanging signed electronic documents across frontiers and in mutually recognizing Member States electronic identification documents. It is therefor
41、e highly recommended that a thorough investigation is implemented across European Member States to overcome the previous problems. ETSI 13 ETSI TR 102 153 VI .I .I (2003-02) 7 Proposed strategy and implementation phases It has already been pointed out that an actual interoperability is indispensable
42、 to achieve the Directive purposes, as specified in clause 4. It is a common belief of those who took part in the study that a task force is to be charged of working out certificate profiles that meet the following requirements: 1) 2) 3) achieve acceptance and consensus throughout Europe; leave open
43、 only options that do not give way to interoperability issues with a higher than level 3 Severity; meet the recognized specifications, namely ISO/IEC 9594-8 (2001) 5, RFC 3039 4, RFC 3279 2, RFC 3280 3, TS 101 862 6 or their follow on; 4) achieve consensus on formats compliant with generally deemed
44、“best practice“ specifications. These requirements imply the following implementation specifications: a) Since profiles are to be developed so that all Member States will de facto implement them in their regulations, team members must have suitable political clout and standing as well as diplomatic
45、skill and undisputed technical knowledge. If necessary, EESSI SG may be involved as well by providing its support. At first sight, interoperability issues appear not to stem out of RFC 3280 3, RFC 3039 4, TS 101 862 6 themselves; rather, from misunderstanding of their provisions or from having certi
46、ficates been issued before them. A more thorough investigation is therefore required to ascertain, jointly with the national bodies responsible for each certificate profile, the rationale of their choices alongside the mentioned specifications. Should the outcomes demonstrate the latter are to be am
47、ended, such amendments must achieve consensus among at least the majority of the involved bodies, prior to be proposed to the IETF PKIX as well. However, completely new profiles, complying with the requirements agreed upon with the bodies, will have to be defined and will need achieve TC ES1 consens
48、us before being submitted to the involved bodies for their approval. It will also be necessary to work out with each and all involved bodies a harmonized phase-idphase-out plan of current and newhevised profiles. All Member States relevant bodies will be made aware of such each others profiles and r
49、elevant phasing in and out plan. The outcome of the above effort will be a new ETSI Technical Specification. b) ETSI 14 ETSI TR 102 153 VI .I .I (2003-02) Annex A: Participation to the task Although it is the ETSI habit not to mention the components of a task that drafted one document, given this task peculiarity of voluntary participation and, moreover, in order to give a better understanding of the profiles assessment relevance, name, country and organization of those who enlisted as volunteers are hereafter specified. ETSI 15 ETSI TR 10
