SNIP_CLASSIC_KEYM_SECTION_7_2_3_Certificate_configuration

7.2.3 Certificate configuration [SWS_KeyM_00024] Upstream requirements: SRS_CryptoStack_00111 ⌈At least one certificate shall be defined as the Root certificate of a PKI. The KeyMCert UpperHierarchicalCertRef of the corresponding KeyMCertificate container is referencing to itself.⌋ Rationale: A root certificate has the characteristics, that the signature is verified with the public key stored in the same certificate (self-signed certificate). It is the top certificate in the hierarchy. Figure 7-3 shows a configuration of three KeyMCertificate containers in a hierarchal way. It illustrates the configuration of the CSM job and key and the references from the KeyMCertificate. This shows, which CSM job and key are referenced by the containers and which job is used for signature verification. Figure 7.3: Exemplary configuration of a certificate chain in a hierarchy with references to CSM jobs and keys. [SWS_KeyM_00025] Upstream requirements: SRS_CryptoStack_00120 ⌈A certificate is stored for verification with the call of the function KeyM_SetCertificate(). The certificate will be placed in the preconfigured storage class of the KeyMCertificate/ KeyMCertificateStorage.⌋ Note: Such a certificate is typically placed in RAM and is not intended to be used for permanent storage. KeyM_SetCertificate() is just used for the verification of a presented certificate. It is not intended to be used for permanent storage like for example the Root certificate. For operation to store a certificate permanently, the function KeyM_ ServiceCertificate{ByCertId}() shall be used. Certificates can be represented in different formats. [SWS_KeyM_00175] Upstream requirements: SRS_CryptoStack_00112 ⌈The configuration shall support three different formats, [8] the X.509, CVC and CRL.⌋ Key elements that are assigned to certificates can be categorized into basic elements of the structure. This is configured with KeyMCertificateElement/KeyMCertificateElementOfStructure. The following tables give correspondences of the enum values of KeyMCertificateElementOfStructure to the naming convention of the respective specifications. X.509 RFC 5280 KeyM Configuration of KeyMCertificateElement/ Key MCertificateElementOfStructure Version CertificateVersionNumber Certificate Serial Number CertificateSerialNumber Signature Algorithm Identifier CertificateSignatureAlgorithmID Issuer Name CertificateIssuerName Validity Not Before Time CertificateValidityPeriodNotBefore Validity Not After Time CertificateValidityPeriodNotAfter Subject Name CertificateSubjectName Subject Public Key Algorithm CertificateSubjectPublicKeyInfo_PublicKeyAlgorithm Subject Public Key CertificateSubjectPublicKeyInfo_SubjectPublicKey Extensions CertificateExtension Table 7.1: Corresponding items of X.509 elements from RFC5280 with element item configuration of KeyMCertificateElement/KeyMCertificateElementOfStructure in [ECUC_KeyM_00038]. CVC BSI - Technical Guideline TR-03110 KeyM Configuration of KeyMCertificateElement/ Key MCertificateElementOfStructure Certificate Profile Identifier CertificateVersionNumber Certificate Authority Reference CertificateIssuerName Signature Algorithm Identifier CertificateSignatureAlgorithmID Public Key Object Identifier CertificateSubjectPublicKeyInfo_PublicKeyAlgorithm Public Key Domain Parameters CertificateSubjectPublicKeyInfo_SubjectPublicKey Certificate Holder Reference CertificateSubjectName Certificate Holder Authorization Template CertificateSubjectAuthorization Certificate Effective Date CertificateValidityPeriodNotBefore Certificate Expiration Date CertificateValidityPeriodNotAfter Certificate Extensions CertificateExtension Table 7.2: Corresponding items of CVC elements as defined in BSI - Technical Guideline TR-03110 with element item configuration of KeyMCertificateElement/KeyMCertificateElementOfStructure in [ECUC_KeyM_00038]. The element RevokedCertificates in [ECUC_KeyM_00038] is used to indicate that this element is the list of revoked certificates in the certificate revocation list (CRL). [SWS_KeyM_00731] Upstream requirements: SRS_CryptoStack_00115 ⌈A KeyM that supports encoding types beyond the pre-defined ones available in [ECUC_KeyM_00088] shall define custom specific Encoding types through the parameter KeyMCertEncodingTypeCustom.⌋