Guidelines to Set up a Certification Authority for Digital Signatures

Descrizione

PRESENTATION. 1. INTRODUCTION 1.1 OBjectives and scope of the book. 1.2 Additional Certkfication Authority Issues. 2. BASIC CONCEPTS 2.1 Introduction. 2.2 Symmetric Criptography. 2.3 Public-key Criptography. (2.3.1 Digital Signatures. / 2.3.2 Key Exchange with Public key Criptosystems) 2.4 Certificates. (2.4.1 certificates and certification Authorities. / 2.4.2 X.509 Certificates) 2.5 Qualified certificates. 2.6 X.500 Directory Service. 2.7 LDAP. 2.8 Certificate Revocation Lists. 2.9 Certficate status Management. 2.10 Multiple Key Pairs. 2.11 OpenPKI and ClesedPKI model. 3. PROCUREMENT PROCESS MODEL 3.1 Purpose. 3.2 Procurement Process Scheme. 3.3 Procurement Process. (3.3.1 Activities. / 3.3.2 Trasversal activities.) 4. FUNCTIONAL AND TECHNICAL SPECIFICATIONS 4.1 PKI Related Standards. 4.2 PKI Components. (4.2.1 Certification Authority. / 4.2.2 Registration Authority. / 4.2.3 Certificate-CRL Respository.) 4.3 CA Policies and Procedures. (4.3.1 Certificate policies. / 4.3.2 Security Policy. / 4.3.3 Certification Practice Statements.) 4.4 Implications of EU Legislation on running a CA. (4.4.1 Implications of Data Protection Legislation). 4.5 PKI Functionality. 5. INSOURCING OR OUTSOURCING DECISION 5.1 Reliability. (5.1.1 Documentation regarding reliability.) 5.2 Liability. (5.2.1 Liability in OpenPKI and ClosedPKI models. / 5.2.2 Liability and Specific Applications. / 5.2.3 User Liability vs. Service Benefits. / 5.2.4 CA Liability vs. CA Service Costs-Prices.) 5.3 Human Resources needed. (5.3.1 Project sepervisor. / 5.3.2 Technical support staff. / 5.3.3 Registration Authority staff. / Technical operational staff.) 5.4 Costs physical security and technical infrastructure. (5.4.1 Costs for hardware and software. / 5.4.2 Costs for consulting. / 5.4.3 Costs for licensing. / 5.4.4 Cost of maintenance, administration, and software updates.) 5.5 Total Impact Risk Analysis. (5.5.1 General Benefits. / 5.5.2 Flexibility. / 5.5.3 Implementation Risks. / 5.5.4 Costs.) 5.6 Insourcing or Outsourcing decision – A summary scheme. 5.7 Two experiences in setting a CA in a large Municipality. (5.7.1 Dig-ID Case. / 5.7.2 OpenCA Case.) 6. CONTRACT AWARD CRITERIA 6.1 Interoperability. 6.2 Operations and tools. 6.3 Support of standard client applications. 6.4 Development of ad-hoc applications. 6.5 CA Administration. (6.5.1 Delegation and distribution of Domain administration. / 6.5.2 Longevity of the CA service and software. / 6.5.3 The riability of the certification activity.) 6.6 Key Material Management. 6.7 Operation of the whole PKI. 6.8 Outsourcing of the CA service. 6.9 An example of overall evaluation. 7. SURVEY OF RESOURCES FOR PKI IMPLEMENTATIONS 7.1 The Survey. 7.2 The Results. (7.2.1 In House PKI Implementation. / 7.2.2 Outsourced PKI Implementation. / 7.2.3 Using a public PKI service. / 7.2.4 Exploiting a PKI) 7.3 Conclusions. 7.4 The Questionnaire. 8. ANNEX A – EU PROCUREMENT LEGISLATION. 9. ANNEX B – DATA PROTECTION IN THE EUROPEAN UNION. 10. ANNEX C – THE EUROPEAN DIRECTIVE. 11. REFERENCES AND TERMINOLOGY.