KISTI CA Report Status & Self-Audit sahn@kisti.re.kr For KISTI Certification Authority

KISTI CA Overview Subject: C=KR, O=KISTI, CN=KISTI Certification Authority Valid from Apr 14, 2017 until Apr 9, 2037 (20 years) Signature algorithm: SHA-256 (CA Key size: 4096 bits) Online repository: http://ca.gridcenter.or.kr Deployed upon IPv6: http://cvmfs-6.ndgf.org/ipv6/overview.php Contact: kisti-grid-ca@kisti.re.kr

Operation status Subscribers Certificates Total number of subscribers: 342 Total number of institutes: 50 Certificates Total number of certificates: 62 Total number of issued certificates: 54 (user:29, host:25) Total number of revoked certificates: 8 (user:5, host:3) New in 2018: 1 user, 2 hosts

Self-Audit overview Auditing References IGTF CAs auditing Checklist version 1 : CA – 55, RA – 12 IGTF PKI Technology Guidelines Version 1.0-2016 Assurance Assessment-v02-20170926 Overall Scoring: CA – A(51), D(4) / RA – A(12) D (must change) : CA (16, 43, 45, 47) Logs and archive of them in issuing system are configured by default to be kept for one month; the system must be re-configured to keep all logs and their archives Self-Audit should be performed at least once a year

D (must chaNge) - CA (16, 43, 45, 47) (16) The CA must record and archive all requests for certificates, along with the issued certificates, all the requests for revocation, all the issued CRLs and the login, logout, start-up, and shutdown of the issuing system (43) The CA must record and archive all requests for certificates, along with all the issued certificates, all the requests for revocation, all the issued CRLs and the login, logout, start-up, and shutdown of the issuing system (45) The Issuing Authority (IA) must keep these records for at least three years (47) ASPEN, BIRCH, CEDAR: The Issuing Authority (IA) should perform internal operational audits of the Issuing Authority (IA)/RA staff and any underlying systems at least once per year to verify its compliance with the rules and procedures specified in its policies and practices documents

Actions required Issuing Machine Internal operational audits System logs in the issuing system are rotated weekly and only 4 weeks of backlogs are kept Rotating frequency is changed from weekly to yearly and the number of rotating has been increased up to 20 times, in principle the logs and their archives will be kept at least 20 years from now on Internal operational audits Perform self-audit and report the result at least once per year