Secure Identity Services Accreditation Corporation.pptVIP

Secure Identity Services Accreditation Corporation NIST PKI RD Workshop April 17, 2007 Overview of SISAC Wholly-owned subsidiary of the Mortgage Bankers Association (MBA) Responsible for defining and maintaining interoperable policy, technical and accreditation requirements for issuing and managing digital certificates to be used in support of electronic mortgage processes and applications More information can be found at SISAC Model – Accreditation SISAC Model – Operations Assurance Levels SISAC Subscriber Certificate Taxonomy CA Certificate Profile Non-critical authorityKeyIdentifier Non-critical subjectKeyIdentifier Critical basicConstraints with cA=TRUE Non-critical keyUsage with keyCertSign and cRLSign asserted Non-critical certificatePolicies with SISAC approved policy OID asserted Non-critical cRLDistributionPoints containing location of CRL information Non-critical authorityInfoAccess containing location of OCSP Responder User Certificate Profile Non-critical authorityKeyIdentifier (must be same as subjectKeyIdentifier defined in CA Certificate for CA that issued this Device Certificate) Non-critical subjectKeyIdentifier Non-critical keyUsage with appropriate key usage bits asserted (except for keyCertSign and cRLSign, which are reserved for CA Certificates only) Non-critical certificatePolicies with SISAC approved policy OID asserted Non-critical cRLDistributionPoints containing location of CRL information Non-critical authorityInfoAccess containing location of OCSP Responder Device Certificate Profile Non-critical authorityKeyIdentifier (must be same as subjectKeyIdentifier defined in CA Certificate for CA that issued this Device Certificate) Non-critical subjectKeyIdentifier Non-critical keyUsage with appropriate usage asserted (except for keyCertSign and cRLSign, which are reserved for CA Certificates only) Non-critical extendedKeyUsage with appropriate usage asserted based on device application (e.g., SSL); must adhere to extendedKeyUsage