Subject: RFC3647 Question

From: "Turner, Sean P." <[email-masked]>
Date: Thu, 8 Nov 2007 15:06:41 -0500

Where would you put statements about physically moving a CA's private from
one location to another (e.g., from New York to L.A.)?   There doesn't seem
to be a place to put it in the RFC3647 format.  Has anybody got something
like this in their CP/CPS?

spt

---

From: Scott Rea <[email-masked]>
Date: Thu, 08 Nov 2007 15:53:36 -0500

Sean,

I am not quite sure what you are asking here? Are you talking about 
moving keys in terms of where back-ups (or perhaps archival data) are 
kept, or is there some reason an operational key needs to move??
Anyway the following 3 places may be good candidates...
6.1  Key pair generation and installation
6.2  Private Key Protection and Cryptographic Module Engineering Controls
6.3  Other aspects of key pair management

Regards,
-Scott

Turner, Sean P. wrote:
>
> Where would you put statements about physically moving a CA's private 
> from one location to another (e.g., from New York to L.A.)?   There 
> doesn't seem to be a place to put it in the RFC3647 format.  Has 
> anybody got something like this in their CP/CPS?
>
> spt
>

-- 
Scott Rea

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 8 Nov 2007 13:22:08 -0800

Sean,

Sections 5.1.2, 5.2.2, and/or 6.2.2 are appropriate places.  They can
address generation, backup transport and invocation of the CA private
key requires multi-party control.  In addition, Section 5.1.2 can
address the multi-party control on the HSM transportation.

________________________________

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Turner, Sean P.
Sent: Thursday, November 08, 2007 3:07 PM
To: [email-masked]
Subject: RFC3647 Question

Where would you put statements about physically moving a CA's private
from one location to another (e.g., from New York to L.A.)?   There
doesn't seem to be a place to put it in the RFC3647 format.  Has anybody
got something like this in their CP/CPS?

spt

---

From: "Turner, Sean P." <[email-masked]>
Date: Thu, 8 Nov 2007 16:29:01 -0500

Sorry I should have been more specific, I was definitely thinking about
moving the HSM that has the private key from one location to another.  

  _____  

From: Santosh Chokhani [mailto:[email-masked]] 
Sent: Thursday, November 08, 2007 4:22 PM
To: Turner, Sean P.; [email-masked]
Subject: RE: RFC3647 Question

Sean,

Sections 5.1.2, 5.2.2, and/or 6.2.2 are appropriate places.  They can
address generation, backup transport and invocation of the CA private key
requires multi-party control.  In addition, Section 5.1.2 can address the
multi-party control on the HSM transportation.

  _____  

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Turner, Sean P.
Sent: Thursday, November 08, 2007 3:07 PM
To: [email-masked]
Subject: RFC3647 Question

spt

---

From: Russ Housley <[email-masked]>
Date: Thu, 08 Nov 2007 17:11:28 -0500

I think Sean is asking where to document the protection necessary if 
the CA is physically moved from one facility to another.

Russ

At 03:53 PM 11/8/2007, Scott Rea wrote:

>moving keys in terms of where back-ups (or perhaps archival data) 
>are kept, or is there some reason an operational key needs to move??
>>Where would you put statements about physically moving a CA's 
>>private from one location to another (e.g., from New York to 
>>L.A.)?   There doesn't seem to be a place to put it in the RFC3647 
>>format.  Has anybody got something like this in their CP/CPS?
>>
>>spt
>
>--
>Scott Rea
>
>

---

From: "Terwilliger, Ann" <[email-masked]>
Date: Fri, 9 Nov 2007 08:18:36 -0800

I think that the same provisions that apply to protection of the CA in
situ also apply to protection of the CA components in transit--dual
control, audit trails on transfer of custody, etc.  When we moved our
root CA several years ago, that was the approach we used.  I think that
the sections of 3647 already cited cover it.  

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Russ Housley
Sent: Thursday, November 08, 2007 2:11 PM
To: Scott Rea; Turner, Sean P.
Cc: [email-masked]
Subject: Re: RFC3647 Question

Russ