B1(a)._Attachment_J.7_digital_signature_guidance.pdf

ATTACHMENT J.7: DIGITAL

SIGNATURE REQUIREMENTS

GUIDANCE DOCUMENTS AND

STANDARDS

Reference Document Importance of Standard Link to Reference Document

Paper: Machine readable, 2-dimensional Barcode in PDF417 standard, field population; Mobile: Aztec, Datamatrix and QR code

IATA Resolution 792, “Bar Coded Boarding Pass”, Version 5

Maintains consistency of boarding passes to allow for validation via boarding pass scanner http://www.iata.org/whatwedo/stb/Documents/resol ution792-june2010.pdf

The TSA accepts 4 types of algorithms:

• RSA (2048 bits)

• DSA

• Elliptic Curve

• ECDSA (Curve P-256)

FIPS PUB 186-3, “Federal Information Processing Standards Publication, Digital Signature Standard

(DSS)”

Allows TSA to confirm that the barcode was issued by the airline and that none of the information in the barcode (such as passengers name or vetting status) has been tampered with.

http://csrc.nist.gov/publications/fips/fips186- 3/fips_186-3.pdf

The TSA will require a minimum of 112 security level elliptic curve; however, 128 elliptic curve is recommended. The Hash function to be utilized will be at a minimum SHA-224 (112 bit level of security);

however, SHA-256 (128 bit level of security) is recommended.

FIPS 180-4, “Secure Hash Standard” This document lays out the required security elliptic curves.

http://csrc.nist.gov/publications/fips/fips180-4/fips- 180-4.pdf

At a minimum, all private keys must be managed in level 2 hardware security modules (HSMs), however, level 3 is recommended.

FIPS 140-2, “Security Requirements for Cryptographic Modules”

This document specifies the container and the protections afforded by it for the housing of private keys and the algorithms used for digital signatures and hashing.

http://csrc.nist.gov/publications/fips/fips140- 2/fips1402.pdf

Carriers must obtain a Certificate Authority (CA) CMVP Validation List FIPS 140-1 and FIPS 140-2 Vendor List http://csrc.nist.gov/groups/STM/cmvp/validation.htm l

It is the carrier’s responsibility to document and ensure that the actual person(s) who is acquiring the keys has been vetted and cleared by the airline. This means the individual(s) requires positive identification by the issuer and airline.

SP 800-152, “DRAFT A Profile for U.S. Federal Cryptographic Key Management Systems

This document provides guidance on private key management and storage http://csrc.nist.gov/publications/drafts/800- 152/draft_sp_800_152_2nd.pdf

For information purposes only ITL BULLETIN FOR JULY 2012 Preparing for and Responding to Certification Authority Compromise and Fraudulent Certificate Issuance

Additional plain-language guidance, based on recent government private keys that were comprised http://csrc.nist.gov/publications/nistbul/july-2012_itl-bulletin.pdf

Carriers must obtain a Certificate Authority (CA) SP 800-32 Introduction to Public Key Technology and the Federal PKI Infrastructure

Additional guidance on obtaining a CA and the importance of Public Key Infrastructures (PKIs) and digital signature http://csrc.nist.gov/publications/nistpubs/800- 32/sp800-32.pdf