Certification Practice Statement

1. INTRODUCTION

INTRODUCTION

  

1.1 Overview

A Public Key infrastructure (PKI) is a set of policies, technical, human, documentary and contractual means put at the disposal of users to ensure, together with the asymmetric cryptographic system, a secured environment for digitalized exchanges.

The putting in place of such an infrastructure is indispensible for a secured and confident environment that offers a range of value added services for electronic transactions. The main function of a PKI is to ensure:

  • The integrity of messages;
  • The identification and authentication of the source;
  • The non-repudiation from source;
  • Confidentiality.

The Certification Practice Statement(CPS) or Certification Practice Statement(CPS) as defined in the present document is destined to be applied within the framework of provision of services by the Cameroon’s Government Certification Authority (CamGovCA). It covers the management and usage of certificates, for the functions of verification, authentication, integrity, conformability of keys, and of confidentiality.

The CamGovCA is submitted to laws and regulations in force on the Cameroonian territory, as well as to norms and directives enacted by member countries of CEMAC and to international conventions ratified by Cameroon and which touch on the application, elaboration, interpretation and the validity of certification policies in conformity with the present CPS.

Law No. 2010/012 of 21st December relating to Cybersecurity and Cybercriminality in Cameroon, in its Article 8, subsection 2, defines ANTIC as Government’s certification authority. The activities of digital certification of state institutions are therefore rigorously and exclusively reserved to the CamGovCA. On other hand, the state certification authority does not assume this right in the private domain.

 

1.2 Titling of the CPS

This document bears the following title: “Certification Practice Statement of the National Agency for Information and Communication Technologies, Government’s Certification Authority”.

The designation of object identification (OID) for the present  Certification Practice Statement is: 2.16120.200001.4.2.1.   

1.3 Responsibility of actors concerned

 

1.3.1 Responsibility of actors concerned

A certification authority is a trustworthy entity charged with creating and attributing public and private keys as well as electronic certifications. It is an autonomous entity designed in conformity with the regulations in order to carry out, in a credible and secured manner, activities of accredited certification authority.

The entity to be accredited as a certification authority can either be the central services of an administration, an agency of a local authorities or a moral person. It must possess the technical and financial capacity, as well as the exigencies prescribed by Decree No. 2012/1318/PM of 22nd May 2012 fixing conditions and modalities for obtaining authorization for the exercise of digital certification activity in Cameroon.

The functions of the Certification Authority are the following:           

1.3.1.1 Furnishing and notification of correct information

           

A certification authority must furnish to the root certification authority correct information relating notably to the creation of certificates, their suspension, revocations and renewal.

A certification authority must immediately keep subscribers and all directly concerned with the certification process, of information that can have an incident on the credibility or validity of a certificate. This concerns information linked to the following aspects:

  • The suspension or revocation of the certificate of the said certification authority;
  • Information on a certificate;
  • Subscriber to a certificate;
  • The list of revoked certificates;
  • Other information relating to activities of certificates contained in the document of certified practices etc;          

1.3.1.2 Protection of the keys for digital signature creation

             

A certification authority must create its proper digital signature keys in a secured manner with the aid of credible software or material. Thereafter, it must manage the said keys with the highest degree of security by using a security module respecting the technical norms required in the domain, in order to avoid any loss, damage, or even theft of the keys.

The creation of a subscriber’s digital signature key by a certification authority must be done through a secured means and by using credible material. Furthermore, the certification authority must encode the key of the digital signature of the subscriber and this is stored in a secured medium in conformity with the specifications of the algorithm of passwords. In order to ensure the integrity of digital signature creation keys, the said authority must equally safeguard all the other information that that will be directly furnished to the subscriber; in this case, it is the authentication code of messages.

1.3.1.3 Usage of certified digital keys for signature creation

              

For the provision of certification services, a certification authority must use its key for digital signature creation certified by the root certification authority.

1.3.1.4 Notification on the loss, damage, theft of creation keys and Measures to be taken

If the keys used in creating digital signature of a certification authority are lost, damaged, or even stolen, the authority concerned reports immediately to the root certification authority that examines the measures to be taken to ensure the security and the credibility of its certification practices.

1.3.1.5 Notification as to the vulnerability of digital signature creation keys and measures to be taken

If a certification authority recognizes the insecurity of its digital signature creation keys, the root certification authority must be informed of the fact, and later examines the measures to be taken to ensure the security and the credibility of its certification practices.

1.3.1.6 Notification as to the vulnerability of the digital signature  algorithm and Measures to be taken

If a certification authority recognizes that its digital signature algorithm is not secured, it must immediately notify the root certification authority of the situation, and examine the measures to be taken to ensure the security and the credibility of its certification practices.

1.3.2 Registration authorities

A registration authority (RA) is an entity that identifies and authenticates applicants for certificates. Following this context, it can equally initiate or transmit the applications for revocation of certificates, those for re-emission and renewal of certificates.

The Registration Authority must conform to all the exigencies of certification and of the Certification Practice Statementof the certification authority to which it has contractual links. Moreover, the RA can put in place more restrictive verification practices if recommended by its internal policy.

A registration authority interacts with a subscriber in order to furnish her with services of certificate management. Within this framework, the registration authority carries out the following operations:

  • Accepts, evaluates, approves or rejects the registration of application for certificates;
  • Registers all subscribers to services of the registration authority;
  • Assists in all the stages of identification of subscribers conferred to it by the certification authority;
  • Where need arises, use all official documents, notary or judicial acts to evaluate the subscriber’s application;
  • After the approval of the request, notify the certification authority for the issuance of the certificate;
  • Launches the process of re-emission, renewal, suspension, reactivation, revocation of a certificate.

1.3.3 Subscribers

A subscriber is a physical or moral person who has successfully subscribed to a certificate. He is guarantor of the veracity of information relative to the Client, as contained in the file, to manager(s) of certificates and to the carrier or owner of the certificate, as well as a regular update of the said information. The root accredited certification authority does not assume any responsibility with regard to the subscriber as to the form, the exactitude, authenticity or legal effects of the supporting documents submitted by the subscriber, managers of the certificate and the carriers(owner).

           

1.3.3.1 Conditions of usage of certificates

           

The subscriber takes the engagement to use the certificates as stipulated in the criteria defined in Section 1.4.1 of the present Certification practice statement. The subscriber recognizes that the criteria can be modified.

           

1.3.3.2 Obligations to inform

The subscriber guarantees that the managers and carriers of the certificate have been fully informed of the stipulations contained in the subscription contract.

      

1.3.3.3 Respect of obligations by the managers of certificates and carriers

The subscriber takes the engagement to, amongst other things, ensure the respect of the subscription contract by both certificate holders and carriers.

           

1.3.3.4 Publication

The clients, certificate managers and carriers or owners of certificate take the engagement to consult:

  • The Certificates Revocation List (CRL), which is updated every 24 hours;
  • The Certification Practice Statement of the certification authority which is in charge of the management of the lifecycle of certificate(s) used.

These documents are put at the disposal of the subscriber on the web site of the certification authority.

            

1.3.4 Trust worthy parties

The user parties are parties that have confidence to certificates signed by the root certification authority, these are:

  • Certification authorities, including foreign certification authorities that have signed a mutual recognition agreement with Cameroonian authorities, in conformity with Article 7 sub section 2 of the law relating to Cybersecurity and Cybercriminality in Cameroon;
  • Subscribers to certification authorities, and also subscribers to foreign certification authorities that have signed a mutual recognition agreement with Cameroonian authorities, in conformity with Article 7 sub section 2 of the law relating to Cybersecurity and Cybercriminality in Cameroon;

           The rights of user parties are the following:

       

1.3.4.1 Understanding the object of usage of certificates

Trustworthy third parties must understand the justification behind the use of the CamGovCA certificate relating to the field of application and the usage of the certificates.

        

1.3.4.2 Verification of certificates

Before the use of a certificate, trust third parties must verify information relating thereto, notably its validity period, its impact, its use, its authenticity, etc.

         

1.3.4.3 Verification of the suspension and revocation of certificates

Before using a certificate, the trustworthy third parties must verify the state of validity in order to ensure that it has not been suspended or revoked.

       

1.3.5 Other Participants

The National Agency for Information and Communication Technologies (ANTIC)

According to the terms of Article 7 of Law No. 2010/012, ANTIC ensures, on behalf of the state, the regulation, control and the follow-up of activities linked to the security of information systems and electronic communication network, as well as electronic certification.

In this wise, it fulfills the mission of:

  • Getting acquainted with applications for accreditation, prepares the scope statement for certification authorities and submits them for the Minister in-charge of telecommunications’ signature.
  • Controlling the conformity of issued digital signatures;
  • Participating in the elaboration of the national policy for security of digital certification network and of certification;
  • Giving, in a consultative role, its opinion on texts touching its domain of competence;
  • Controlling the activities of security of digital communication network, of information systems and certification;
  • Controlling applications for homologation of cryptographic medium and delivers homologated certificates for security equipment;
  • Preparing mutual recognition conventions with foreign parties and submit same for the signature of the Minister in-charge of Telecommunications;
  • Participating in activities of research, training and related studies in electronic communication network security, of information systems and of certification.

As Government’s Certification Authority, ANTIC has the duty of performing the following functions:

1. Management of the lifecycle of certificates

ANTIC, as Government’s Certification Authority, has the duty of emitting, re-emitting, renewing, reactivating, modification of information, of suspending and revoking electronic certificates of its subscribers.

 2. Securing applications

ANTIC, as Government’s Certification Authority, must secure Government’s applications.

Within the framework of securing the national cyberspace, it also has the duty of securing applications of private institutions while waiting for the accreditation of Certification Authorities that will exercise in the private domain.

           3. Furnishing and notification of credible information

ANTIC must notify Registration Authorities, clients, subscribers as well as all stake holders, of information likely to have an impact on the  credibility and the validity of a certificate that are verifiable. It concerns:

  • Information on CamGovCA certificates, of RAs, of clients and subscribers. It equally concerns its number and validity;
  • The Certificate Revocation List;
  • Other information linked to the practice of certification.

          4. Putting in place of applicable measures for the creation of illicit digital signatures

If the Agency, as Government’s Certification Authority, takes notice of the corruption of its system of creation of digital keys. It must immediately revoke all certificates issued from the said system as well as the keys, and regenerate the certificate by creating new digital signature keys. After these operations, the Agency must inform its clients, subscribers of the above facts, verifiable by anyone in order to take into account the credibility and the security of certification practices.

Equally, if ANTIC is notified by a Registration Authority, or of a client, a subscriber, an agent of the loss, damage, theft or weaknesses of its digital signature keys, the Agency must revoke the issued certificate from the latter and an announcement is made so that any person can verify same.

Moreover, if the notification received by ANTIC has been emitted by a registration authority under the control of a national organization or of a local autonomous entity, of the loss, damage, theft or the weaknesses of its electronic signature creation keys, the Agency must promptly inform the President of the Committee in charge of conflict management.

           5. Putting in place of applicable measures for the vulnerability of the digital signature algorithm

In case of an indisputable fact as to the insecurity of the digital signature algorithm used in the practice of certification, ANTIC will revoke all the certificates emitted from the said algorithm. The verification of this act can be effected by whosoever is within the system of management of certification, this in view of ensuring the security and credibility of certification practices.

If ANTIC is notified by a Registration Authority, a client, a subscriber, or an agent of a flaw in its algorithm for digital signature, the Agency must revoke the issued certificate, and shall without delay, make an announcement so that any person can within the certification chain can confirm of this.

Moreover, if the notification received by ANTIC has been emitted by a registration authority under the control of a national organization or of a local autonomous entity, of the vulnerability of the algorithm of digital signature, the Agency must promptly inform the Chairperson of the Committee in charge of conflict resolution.

1.3.6 Committee in-charge of conflicts resolution between accredited certification authorities, security auditors, software security auditors and other authorised security service providers

A special provision from the Board of Directors of the Agency fixes the organization and the modalities of operation of this Committee.

 

1.4 Usage of the certificates

 

1.4.1 Domains of applicable usage

The certificates signed and delivered by CamGovCA must be used to verify the concordance of its digital signature keys.

The certificates issued by virtue of the present CPS are appropriate to establish the link that exist between an entity and a public key.

The CamRootCA signs the certificate of the Government’s certification authority (CamGovCA).

The CamGovCA signs the certificates of RAs, clients, subscribers, agents and also signs the Certificate Revocation List.

The CamGovCA bi-keys and certificates are used for purposes of signature of certificates, and of CRL. They can also be used for confidentiality purposes or for authentication.

1.4.2 Domains of forbidden usage

 No usage other than that defined in paragraph 1.4.1 is covered by the present CPS. A subscriber or a RA whose certificate is emitted by CamGovCA is not authorised to:

  • Emit or use certificates non compatible to X.509;
  • Provide services not covered by the present CPS;
  • Use its certificate to accredit a ACA, a RA or another subscriber;
  • Provide services not declared by the certification policy at the moment of the signature of its certificate by the CamGovCA.

 

1.5 Management of the Certification Practice Statement

 

1.5.1 Entity in charge of management of the CPS

The present CPS is under the responsibility of ANTIC.

1.5.2 Contact point

The General Manager of the National Agency for Information and Communication Technologies (ANTIC), Yaounde, Republic of Cameroon.

  • P.O Box 6170 Yaounde;
  • Telephone: (+237) 242 08 64 97- (+237) 242 08 64 98;
  • Facsimile: (+237) 22 20 39 31;
  • Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

1.5.3 Entity determining the conformity of this CPS with the CP

ANTIC’s management validates the conformity of the present Certification Practice Statement with the Certification Policy prescribed by the CamRootCA.

1.5.4 Procedure of approbation of the conformity of the CPS

The CamGovCA is guarantor of the application of the present CPS with the Certification Policy. It is equally responsible for its management and updating. All application for updating of the CPS follows the approbation process put in place by ANTIC. Any new version of the CPS is published without delay, in conformity to the exigencies of paragraph 2.2.

The CPS shall be declared standard after the approbation process established by the Agency that reports to the Ministry of Posts and Telecommunications for its establishment or for the revision of the said CPS, and individually, notifies the root certification authority and the registration authorities placed under its control of this fact.

The attestation of practice established or revised enters into force as from the date of validation of the CPS.

1.6 Definitions and abbreviations

 

1.6.1 Definitions

Subscriber: entity to whom a certificate has been issued.

Certificate subscriber: physical person empowered by a client of the CamGovCA to apply for a certificate on behalf of one or many holders, physical persons, functions or applications.

Certification Authority (CA): Trustworthy authority charged with creating and attributing public and private keys as well as digital certificates;

Registration Authority: entity charged with identifying and authenticating applicants for certificates, as well as initiating and transmitting applications for revocation of certificates, re-emission and renewal of certificates.

Certification: the act of controlling the conformity of digital signature verification keys with regard to the creation of digital signatures belonging to a moral or physical person.

Digital certificate: a digital document secured by a digital signature of the person who issued it and who attests after certifying and verifying its contents.

Digital signature creation key: A set of digital data that are used for the creation of a digital signature.

Digital signature key: A device for the creation of digital signature as well as correspondences in view of the verification of the said signatures.

Digital signature verification key: a set of digital data that are used for the verification of digital signature.

Client: organization, application, moral or physical person that has signed a contract with the CamGovCA to acquire a digital certificate.

Control of identity: act of verification of the authenticity of information on the applicant or on a certification authority, in order to ensure the credibility of the certificate during creation, the suspension, revocation and renewal.

Digital data: information generated, sent and received or stocked in digital form by use of devices such as a computer for the processing of data,.

Agent: A person that either directly by law or by delegation have the power to authorise application for certificates carrying the name of the organization. He can equally have other powers in the name of his organization such as revocation. Failure to designate one, the legal representative is the only accepted certification agent.

Distinctive name: name used to identifier the authority that has delivered the certificate as well as the proprietor of the certificate. It must respect the technical norms relating to establishments of certification authorities and peripheries.

Certification practices: Practices consisting of providing services such as certification, issuing of certificates and the management of data relating to digital certification.

Digital signature: signature obtained by an asymmetric encryption algorithm that enables the authentication of a transmitted message and the verification of its integrity.

Trust third parties: person or entity that uses the certificate received from ANTIC, based on the trust that it has for it.

1.6.2 Abbreviations

CA: Certification Authority;

ACA: Accredited Certification Authority;

ANTIC: National Agency for Information and Communication Technologies

CamGovCA: Cameroon Governmental Certification Authority

CamRootCA: Cameroon Root Certification Authority

CRL: Certificate Revocation List

CPS: Certification Practice Statement

HSM: Hardware Security Module       

PKI: Public Key Infrastructure

LDAP: Lightweight Directory Access Protocol

OCSP: Online Certificate Status Protocol

RCA: Root Certification Authority

TSA: TimeStamping Authority

joomla templatesjoomla template
      Copyright (c) CamGovCA 2015, All Rights Reserved
PUBLIC KEY INFRASTRUCTURE CENTER - ANTIC - CAMEROON Tel.: +237 242 08 64 97 Fax: 222 20 39 31 email: pki@antic.cm