⊙ MIC Notification No. 2003-53
  The revised Rules on Accredited Certification Authority's Facilities and Equipments (MIC Notification No. 2002-47, November 15, 2002) are notified as follows in accordance with the provision of Article 2 of the Enforcement Regulations of the Electronic Signature Act.
                                               December 3, 2003
Minister of the Ministry of Information and Communication

Revised Rules on Accredited Certification Authority's Facilities and Equipments
Rules on Accredited Certification Authority's Facilities and Equipments are revised as follows.

Rules on Accredited Certification Authority's 
Facilities and Equipments

Chapter 1  General Provisions
1. Object
  The object of these regulations is to lay down details of facilities and equipment pursuant to the provision of Subclause 3 of Clause 1 of Article 2 of the Enforcement Decree of the Electronic Signature Act and internal regulations pursuant to the provision of Subclause 4 of the same Clause in connection with the asymmetric encryption-based electronic signature technology.
2. Definition
  Terms used in these regulations are defined as follows: 
  A. The "Private Key" refers to the electronic information used to generate electronic signatures.
  B. The "Public Key" refers to the electronic information used to verify electronic signatures.
  C. The "Key Pair" refers to the public key and the matching private key.
  D. The "Electronic Signature Certification System" (called the “Certification System” hereinafter) refers to the system used for issuance of certificates, management of certification-related records, and provision of supplementary services utilizing certificates.
  E. The "Accredited System" (called the “Accredited System” hereinafter) refers to the system installed in certification authorities for certification services, which supports management of subscribers' registration information, generation and management of key pairs, generation, issuance and management of certificates, and time stamping.
  F. The "Audit Manager" refers to the person who reviews and manages the audit records of the certification system.
  G. The "Operation Manager" refers to the person in charge of operating the accredited system.
  H. The "Policy Manager" refers to the person who establishes and manages policies related to the accredited system.
  I. The "Registration Information"”refers to the registration receipt number, name, address, telephone number, e-mail address, distinguished name (Distinguished Name, called "DN" hereinafter) of the subscriber, and the scope and intended use of the certificate.  
3. Scope of Application
  These regulations apply to certification services utilizing the asymmetric encryption-based electronic signature technology.

Chapter 2 Facilities and Equipment
4. Facilities for Managing Subscribers' Registration Information
 4.1 Identifying Subscribers
  4.1.1 Assigning DN in accordance with the certification system  technical specifications 1.3
 4.2 Managing Subscribers' Registration Information
  4.2.1 Entering, accessing, changing and deleting registration information
  4.2.2 Encryption and electronic signature of registration information transmitted over the network
 4.3 Audit and Security
  4.3.1 Generating and storing audit records concerning details of registration information
   A. Generating and storing audit records concerning details on how, when and by whom entry, access, change and deletion of registration information is entered, accessed, changed or deleted
   B. Backing up audit records
  4.3.2 The ability to cope with the following threats
   A. Coping with such threats as forgery, alteration and deletion of audit records
   B. Coping with such threats as forgery, alteration and deletion of the registration information management software
   C. Coping with illegal use of the registration information management software
    (1) Differentiating the roles of the operation manager and the audit manager and controlling access
    (2) Classifying the roles of other managers, if any, and controlling access
   D. Coping with such threats as forgery, alteration, deletion and leakage of registration information
 4.4 Managing the Configuration of the Registration Information Management Software
  4.5 Equipment for Storing Subscribers' Registration Information
   4.5.1 Certification authorities must have a cabinet or safe for storing subscribers' registration information with a locking mechanism in a place separated from the office area in certification authorities.
5. Equipment for Generating and Managing Key Pairs
 5.1 Algorithm
  5.1.1 Electronic Signature Algorithm
   A. Generating and verifying the electronic signature of the electronic signature algorithm
    (1) Generating and verifying electronic signatures by means of the electronic signature algorithm specified in certification system technical specifications 2.1 for the accredited system
     (A) Generating and validating RSA or KCDSA digital 
					 signature
     (B) Generating and validating ECDSA electronic signature
    (2) Generating and verifying electronic signatures by means of the electronic signature algorithm specified in certification system technical specifications 2.1 for subscriber equipment
     (A) Generating and validating RSA and KCDSA digital 
					signature
     (B) Generating and validating ECDSA electronic signature
   B. Generating key pairs based on the electronic signature algorithm
    (1) Generating key pairs in a way that satisfies the standard specified in certification system technical specifications 2.1 for the accredited system
     (A) Generating RSA or KCDSA 1024bit or longer key pairs
     (B) Generation of ECDSA 160bit or longer key pairs
    (2) Generating key pairs in a way that satisfies the standard specified in certification system technical specifications 2.1 for subscriber equipment
     (A) Generating RSA and KCDSA 1024bit or longer key pairs
     (B) Generating ECDSA 160bit or longer key pairs
  5.1.2 Hash Algorithm
   A. Generating hash values by means of the hash algorithm specified in certification system technical specifications 2.2 for the accredited system
    (1) Generating SHA-1 or HAS-160 160bit or longer hash values
   B. Generating hash values by means of the hash algorithm specified in certification system technical specifications 2.2 for subscriber equipment
    (1) Generating 160bit or longer of SHA-1 and HAS-160  hash values
  5.1.3 Cryptographic Algorithm
   A. Encryption and decryption by means of the cryptographic algorithm specified in certification system technical specifications 2.3
 5.2 Equipment for Generating and Managing Certification Authorities' Key Pairs
  5.2.1 Generating Key Pairs
   A. Generating key pairs by means of the electronic signature algorithm specified in 5.1.1
    (1) Setting and verifying information on the generation of key pairs like the type of algorithm, the length of the key, and its use
  5.2.2 Protecting Key Pairs
   A. Satisfies certification system technical specifications 6.4
  5.2.3 Generation of electronic signatures
   A. Signing by means of the electronic signature algorithm specified in 5.1.1
  5.2.4 Audit and Security
   A. Generating and storing audit records about the details of key pair generation and electronic signatures
   B. Backing up Audit Records
   C. Coping with the following threats
    (1) Coping with such threats as the forgery, alteration and deletion of audit records
    (2) Coping with such threats as the forgery, alteration and deletion of the key pair generation and management software
    (3) Coping with illegal use of the key pair generation and management software
     (A) Differentiating the roles of the operation manager and the audit manager and controlling access
     (B) Differentiating the roles of other managers, if any, and controlling access
  5.2.5 Three or more authorized employees jointly generate and manage key pairs by means of access control functions like passwords, hardware tokens and biometrics 
  5.2.6 Managing the configuration of the certification authority key pair generation and management software
  5.2.7 Redundancy of the equipment for generating and managing certification authority key pairs that have the same functions
 5.3 Equipment for Generating and Managing Subscriber Key Pairs
  5.3.1 Key Pair Generation
   A. Generating key pairs the electronic signature algorithm specified in 5.1.1
    (1) Setting and verifying information on the generation of key pairs like the type of algorithm, the length of the key, and its use
    (2) Encrypting and saving the private key by means of the password algorithm specified in 5.1.3 if the private key is saved in a diskette
    (3) Deleting the private keys remaining in the system memory or temporary file and related information immediately after saving the encrypted private keys 
    (4) Saving such information as the message authentication code (MAC) along with the private key to ensure the integrity of the private key
  5.3.2 Key Pair Protection
   A. Private Key Storage Devices
    (1) Supporting portable storage devices  (diskettes, smart cards, USB tokens, etc.)
  5.3.3 Audit and Security
   A. Generating key pairs and generating and storing audit records of electronic signatures
   B. Backing up audit records
   C. Coping with the following threats
    (1) Coping with such threats as forgery, alteration and deletion of audit records
    (2) Coping with such threats as forgery, alteration and deletion of the key pair generation and management software
    (3) Coping with the illegal use of the key pair generation and management software
     (A) Differentiating the roles of the operation manager and the audit manager and controlling access
     (B) Differentiating the roles of other managers if any, and controlling access
  5.3.4 Two or more authorized employee jointly generating key pairs
   A. Identifying and verifying two or more authorized employees by means of passwords, hardware tokens and biometrics
  5.3.5 Managing the configuration of the subscriber key pair generation and management software
6. Equipment for Generating, Issuing and Managing Certificates 
 6.1 Equipment for Generating and Issuing Certificates
  6.1.1 Generating and Issuing Certificates
   A. Processing subscribers' requests for issuance of certificates 
    (1) Processing certification system technical specifications 3.1
    (2) Verifying the fact that the private key belongs to the subscriber
    (3) Examining the uniqueness of the subscriber's public key
    (4) Handling a certificate issuing request in accordance with certification system technical specifications 3.2 If the request is made over the network 
   B. Establishing the certificate generation policy concerning the following
    (1) Electronic signature algorithm(5.1.1 Electronic Signature Algorithm)
    (2) Expiration date of certificates
    (3) Scope of application or intended use
    (4) Certificate extension field
   C. Performing access control separately by differentiating the certificate generation from the certificate generation policy formulation, and appointing separate managers 
   D. Generating Certificates 
    (1) Generating certificates in accordance with generation policies
    (2) Generating certificates by means of the electronic signature function of the key pair generation and management equipment (5.1.1)
    (3) Generating certificates in accordance with certification system technical specifications 1.1
   E. Querying the following information about certificates
    (1) Electronic signature algorithm
    (2) Expiration date of certificates
    (3) DN of the subscriber and the issuer
    (4) Scope of application or intended use
    (5) Certificate extension field
    (6) Certificate suspension and revocation
  6.1.2 Generating and Managing the Certificate Suspension and Revocation List
   A. Handling the subscriber's request for certificate suspension, restoration and revocation
    (1) Recording whether it is suspension, restoration and revocation, the request date and the reason
    (2) Checking if the status of the certificate is appropriate for the processing of the request
    (3) Handling a request for certificate suspension and revocation in accordance with certification system technical specifications 3.2 if the request is made and handled over the network
    (4) The Electronic signature of the received and transmitted information if a request for certificate suspension and revocation is made over the network
   B. Establishing certificate suspension and revocation list generation policies about the following
    (1) Electronic signature algorithm (Electronic signature algorithm in 5.1.1)
    (2) Next issuing date
    (3) Certificate suspension and revocation list extension field
    (4) Automatic update or alarm before the next issuing date
   C. Performing access control separately by differentiating the certificate generation function from the certificate generation policy formulation function, and appointing separate managers 
   D. Generating certificate suspension and revocation lists
    (1) Generating certificate suspension and revocation lists by means of the Electronic signature functions of the equipment for generating and managing key pairs (5.1.1)
    (2)	 Generating certificate suspension and revocation lists in accordance with the generation policy conforming to certification system technical specifications 1.2 for the certificate suspension and revocation list profile
   E. Querying the following information about certificate suspension and revocation lists
    (1) Electronic signature algorithm
    (2) issuing date and next issuing date
    (3) Serial numbers of suspended and revoked certificates
    (4) Date and reason certificate suspension and revocation
    (5) Certificate suspension and revocation list extension field
   E. Revoking certificates 6 months after suspension
  6.1.3 Storing Subscribers' Certificates
   A. Equipment to store subscribers' certificates and the records about their suspension and revocation for 10 years after their expiration
   B. Matters concerning remote storage equipment
    (1) Remote storage equipment at least 10km away that store subscribers' certificates and the records of their suspension and revocation
    (2) Physical access control devices and locking mechanism like a cabinet for remote storage equipment
    (3) Collecting and storing audit records about accesses to remote storage equipment
    (4) Intrusion monitoring devices for the remote storage equipment
  6.1.4 Audit and Security
   A. Generating and storing audit records about certificates
    (1) Generating and storing the details of certificate issuance, suspension, restoration, revocation and policy formulation
    (2) Backing up audit records
   B. Coping with the following threats
    (1) Coping with such threats as the forgery, alteration and deletion of audit records
    (2) Coping with such threats as the forgery, alteration and deletion of the certificate generation and issuance software
    (3) Coping with the illegal use of the certificate generation and issuance software
     (A) Differentiating the roles of the operation manager and the audit manager and controlling access
     (B) Differentiating the roles of other managers if any, and controlling access
  6.1.5 Managing Configuration of the Certificate Generation and Issuance Software
  6.1.6 Redundancy of Certificate Generation and Issuance Equipment
   A. Redundancy of certificate generation and issuance equipment with the same functions
   B. Emergency recovery by means of redundant certificate generation and issuance equipment
6.2 Equipment for Certificate Notification and Validation Equipment
 6.2.1 Notifying certificate, certificate suspension and revocation lists
   A. Registering and deleting certificate, certificate suspension and revocation lists
   B. Searching certificate, certificate suspension and revocation lists in accordance with certification system technical specifications 4.1
   C. Audit and security
    (1) Audit records about the registration and deletion of certificate, certificate suspension and revocation lists
     (A) Generating audit records of the fact that certificate, certificate suspension and revocation lists were registered and managed, the time they occurred, and the person who did it
     (B) Backing up audit records
    (2) Coping with the following threats
     (A) Coping with such threats as the forgery, alteration and deletion of audit records
     (B) Coping with such threats as the forgery, alteration and deletion of the certificate, certificate suspension and revocation list notification software
     (C) Coping with the illegal use of the certificate, certificate suspension and revocation list notification software
      1) Differentiating the roles of the operation manager and the audit manager and controlling access
      2) Differentiating the roles of other managers if any, and controlling access
    (D) Coping with such threats as the forgery, alteration and deletion of certificate, certificate suspension and revocation lists
   D. Redundancy of certificate, certificate suspension and revocation list notification equipment
    (1) Redundancy of certificate, certificate suspension and revocation list notification equipment with the same functions
    (2) Real-time emergency recovery function by means of redundant certificate, certificate suspension and revocation list notification equipment
  6.2.2 Certificate Validation
   A. Validating certificates in accordance with certification system technical specifications 5.3
   B. Audit and security
    (1) Generating and storing audit records about certificate validation
     (A) Generating and storing audit records about certificate validation, the time they occurred, and requesters
     (B) Backing up audit records
    (2) Coping with the following threats
     (A) Coping with such threats as the forgery, alteration and deletion of audit records
     (B) Coping with such threats as the forgery, alteration and deletion of the certificate validation software
     (C) Coping with the illegal use of the certificate validation software
      1) Differentiating the roles of the operation manager and the audit manager and controlling access
      2) Differentiating the roles of other managers if any, and controlling access
   C. Managing configuration of the certificate validation software
   D. Redundancy of certificate validation equipment
     (1) Redundancy of the certificate validation equipment with the same functions
     (2) Real-time emergency recovery function by means of redundant certificate validation equipment
7. Time Stamper
 7.1 Time Reception
  7.1.1 The time reception devices receiving time from the time sources
   A. Receiving time in accordance with certification system technical specifications 4.3
   B. Expressing time to 1/1000 of a second
   C. Notifying the manager if the time reception device has a problem,
   D. Providing correct time 24 hours of the day even if time reception from the time sources has stopped
  7.1.2 Correcting time for the time stamper system
   A. Correcting the time for the time stamper system by means of the time provided by the time reception device
    (1) Starting the stamper service after correcting the time of the time stamper system
    (2) Consistently providing the time correction function
   B. Printing error messages if error occurs to the time correction function, and immediately stopping the time stamper service automatically
 7.2 Time Stamper Service
  7.2.1 The time stamper service program capable of checking the time of electronic documents
   A. Providing the time stamper service in accordance with certification system technical specifications 4.2
   B. Providing the time stamper service by means of the algorithm specified in 5.1.1
   C. Checking if the time recorded in the time stamping token received by the user matches the issued time
   D. Providing the time stamper service by means of the Electronic signature function of the key pair generation and management equipment
  7.2.2 Audit and Security
   A. Generating, storing and backing up the audit records about the following
    (1) Records about time corrections
    (2) Time stamping, the time, who did it, the requester
    (3) Problems such as time asynchronism, and the time they occurred
    (4) Delays in providing the time stamper service, the time they took place, requesters
   B. Coping with the following threats
    (1) Coping with such threats as the forgery, alteration and deletion of audit records
    (2) Coping with such threats as the forgery, alteration and deletion of the time stamper software
    (3) Coping with the illegal use of the time stamper software
      (A) Differentiating the roles of the operation manager and the audit manager and controlling access
      (B) Differentiating the roles of other managers if any, and controlling access
   C. Managing the configuration of the time stamper software 
   D. Redundancy of the time stamper
    (1) Redundancy of the time stamper with the same functions
    (2) Emergency recovery by means of the redundant time stamper
8. Protection Equipment
 8.1 Network and System Security Devices
  8.1.1 Network Security
   A. Redundant network devices
    (1) Two or more network lines
     (A) Using two or more physically separated network physical
     (B) Using two or more different ISP (or IX) lines
     (C) Providing certification services continuously even if one line fails
     (D) Using network lines in a way suitable for the certification system
    (2) Building an internal network that provides two or more paths
     (A) Providing certification services continuously even if one path fails 
     (B) Using redundant routers
   B. Network security devices
    (1) Firewall
     (A) Redundant firewall
     (B) Using K4-class or better firewall software
     (C) Establishing access control rules necessary for the certification system
     (D) Saving and backing up the records of what was handled by the firewall
    (2) Intrusion detection system
     (A) Using K4-class or better intrusion detection software
     (B) Inspecting all traffics and detecting intrusion
     (C) Updating patterns of new types of intrusions continuously
     (D) Notifying managers when intrusion is detected
   C. Network and system management devices
    (1) Systems or equipment capable of checking the status of the network and equipment on a real-time basis
    (2) Systems or equipment capable of checking if the accredited system programs or processes work properly
   D. Others
    (1) Controlling access to network equipment like switches and routers
    (2) Storing audit records
     (A) Details of accesses, settings and traps generated by the network equipment
  8.1.2 System Security
   A. Safe and reliable accredited system
    (1) Assigning different accounts to different managers and controlling access
    (2) Registering users necessary for certification services
    (3) Installing only software suitable for the purpose of the system
    (4) Executing programs or processes suitable for the purpose of the system
    (5) Patching programs
    (6) Patching the operating system (OS)
    (7) Availability of an agreement for the maintenance of the system and related software
   B. Generating and storing audit records about the operation of the accredited system
    (1) Starting/stopping the system
    (2) Starting/ending the programs necessary for certification services
    (3) Login/out of root and users
   C. Other equipment
    (1) Operating web servers, name servers and mail servers for certification services in accordance with items A and B of 8.1.2
 8.2 Physical Security Devices
  8.2.1 Accredited System Room
   A. Availability of a separate controlled area for safe operation of the accredited system
    (1) Running the following accredited systems in separate rooms
     (A) Equipment for managing subscriber registration information and certification authority key pairs, and generating and issuing certificates may be installed in the same rooms, but they must be installed in a room separated from other equipment.
     (B) Equipment for certificate notification must be installed in a room separated from other equipment.
     (C) Equipment for checking the status of certificates, and those for time stamping may be installed in the same  rooms, but they must be installed in a room separated from other equipment.
    (2) The outer walls of the room where the accredited system is installed (the side adjoining the outside of the room with the accredited system) must be designed in a way that can protect the accredited system essential for certification services from external intrusions.
     (A) The outer walls must be made of bricks or steel-reinforced concrete, or 3T or thicker steel must be welded to the steel structure.
     (B) The outer walls must be finished completely from the ceiling to the floor. 
    (3) The internal walls of the room with the accredited system must be designed so that the room can be separated from others.
     (A) The internal walls adjoining the internal walls of the room with the accredited system and the hallway must be made of bricks or steel plates thicker than 1.8T must be welded on.
     (B) The internal walls must be finished completely from the ceiling to the floor (Vents conforming to the Fire Services Act are allowed).
    (4) Physical access control of the doors to the room with the accredited system
     (A) Tempered glass for glass doors
     (B) Reinforced and fireproof doors
   B. Windows with tempered glass and shutter screens for  ventilating windows
    (1) If there are windows
     (A) The windows must have tempered glass or glass coated with reinforcement film
     (B) The windows or the supports outside the windows connecting rooms must be removed so that no one can enter the room with the accredited system from the hallway or another room.
     (C) Windows must be coated so that no one can look in.
    (2) If ventilation windows are installed
     (A) Shutter screens must be installed if the ventilation window is big enough for a person to pass through.
  8.2.2 Multiple Access Control Devices
   A. Access control devices for restricting access to the accredited system room and collecting audit records
    (1) Physical access control to prevent unauthorized persons from access the accredited system room
    (2) Access control devices must collect audit records for the following information 
     (A) Serial number
     (B) Type of incident, failure/success and reason for failure
     (C) Date and time
     (D) The person who did it
   B. Access control devices that combine biological-feature-based and possession-based identification
    (1) Biological-feature-based identification (fingerprint recognition, iris recognition, etc.)
    (2) Possession-based identification (keys, cards, etc.)
   C. Equipment for preventing other people from entering the room or tagging along when they approach the accredited system room
   D. Access control and audit records must be available during blackouts.
  8.2.3 Intrusion Monitoring, Alarm, Monitoring and Control Devices
   A. Devices for detecting physical intrusion into the accredited system room and sounding an alarm
    (1) Intrusion monitoring and alarm
     (A) Intrusion detection devices such as vibration detection devices, sound detection devices must be installed in the room.
     (B) Detecting intrusion when the intrusion detection device 
						senses something.
     (C) Immediately notifying the manager in case the intrusion detection device senses intrusion
    (2) Verifying the location of intrusion linked to the intrusion 
				detection device and the alarm system
   B. Monitoring and controlling the accredited system room and collecting related audit records
    (1) Intrusion monitoring
     (A) Installing CCTV
     (B) The monitoring device must be running 24 hours a day on 			a real-time basis. 
     (C) The CCTV system records all entries and exits.
     (D) Controlling access to the CCTV system
     (E) Protecting the password for managing the CCTV system
    (2) Using the multiple access control devices to check the access status information
     (A) Only authorized managers can query audit records.
     (B) Query audit records by various conditions such as time, person who did it, type of incident
     (C) Countermeasures against the depletion of the storage 
					space for access control system audit records
     (D) Controlling access to the access control system
     (E) Encrypting and saving the password for managing the access control system
     (E) Backing up audit records
  8.2.4 Physical Lock
   A. A security cabinet that physically controls access to the accredited system in the physical security equipment.
   B. A safe or cabinet with a locking mechanism that can physically control access to important information such as private keys and subscribers' certificates 
   C. The key to the locking mechanism must be kept in a box or cabinet with a lock.
  8.2.5 Disaster Prevention Equipment
   A. Equipment for early detection and extinction of a fire
    (1) Fire alarms
     (A) Installing fire alarms including smoke detectors and temperature sensors
    (2) Fire extinguishers
     (A) Must be able to handle both small and big fires
     (B) Must be able to cope with malfunctions.
     (C) Using fire extinguishing agents that will not affect other systems when fire extinguishers are working.
   B. Flood disaster prevention equipment
    (1) The accredited system, and the firewall and network equipment must be installed some distance from the floor to prevent exposure to water.
    (2) Power connection devices such as wall outlets must be installed some distance from the floor.
   C. Power supplies that supply power fir a certain period of time so that continuous certification services are possible during blackouts.
    (1) Independent power generators and uninterruptible power supplies
     (A) Supplying power for more than 30 minutes so that continuous certification services are possible during blackouts.
     (B) In the case of independent power generators, supplying power for more than 30 minutes by generating power without additional supply of fuel
   D. Installation of constant temperature and humidity conditioners to keep the temperature and humidity at a constant level. 
   E. Miscellany
    (1) Grounding facilities for the various power supplies in the physical security equipment
    (2) Installation of guiding lights and guiding signs in preparation for emergency in the physical security equipment
9. Subscriber Equipment
 9.1 Key Pair Management
  9.1.1 Using the electronic signature algorithm specified in 5.1.1 to generate key pairs
  9.1.2 Encrypting private keys and saving them in the storage device for private keys
   A. Encrypting private keys by means of PKCS#5
   B. Using the cryptographic algorithm specified in 5.1.3 to encrypt private keys
   C. Saving the private keys encrypted with PKCS#5 in PKCS#8
   D. Saving private keys in accordance with certification system technical specifications 6.1
  9.1.3 Deleting private keys from memory or temporary files immediately after generating the private key and saving them in a separate storage device.
 9.2 Managing Certificates
  9.2.1 Certificate Management Protocol
   A. Generating certificate request formats in accordance with certification system technical specifications 3.1
   B. Requesting issuance, reissuance, update, suspension and revocation of certificates through an information and communication network in accordance with certification system technical specifications 3.2
  9.2.2 Saving Certificates
   A. Saving subscriber certificates in accordance with certification system technical specifications 6.1 
  9.2.3 Querying Certificates
   A. Querying Certificates
   B. Indicating certificates in accordance with certification system technical specifications 1.4
  9.2.4 Delivering Key Pairs and Certificates
   A. Delivering key pairs and certificates in accordance with certification system technical specifications 6.1
  9.2.5 Checking Reliability of Root CA Certificates
   A. Checking the reliability of root CA certificates in accordance with certification system technical specifications 5.2 or 6.1
 9.3 Verifying Electronic Signatures and Certificates
  9.3.1. Verifying Certificates
   A. Building the paths for certificates
   B. Checking the status of certificates
    (1) Verifying certificate suspension and revocation lists
    (2) Using the real-time certificate status check service in accordance with certification system technical specifications 5.3
   C. Verifying certificate paths in accordance with certification system technical specifications 5.4 
  9.3.2 Generating and Verifying Electronic Signatures
 9.4 Identification by means of Identification Numbers
  9.4.1 Using identification numbers for identification in accordance with certification system technical specifications 1.5
 9.5 Time Stamping
  9.5.1 Requesting time stamper services, and saving and querying responses
   A. Requesting time stamper services
    (1) Generating hash values for the documents subject to time stamping
    (2) Generating time stamping request formats in accordance with certification system technical specifications 4.2
   B. Receiving time stamping tokens corresponding to requests
   C. Verifying time stamping tokens
   D. Storing and querying original files and time stamping tokens
    (1) Querying original files by linking time stamping tokens to them
 9.6 Configuration Management of the Subscriber Software
  9.6.1 The subscriber can verify the software version number when using the subscriber software provided by certification authorities
  9.6.2 Distributing the changed software to subscribers when changing the subscriber software
  9.6.3 Coping with the forgery, alteration and deletion of the subscriber software

Chapter 3  Internal Regulations
10. Matters concerning Management of Certification Authority Key Pairs
 10.1 Matters concerning Certification Authorities' Generation, Backup and Revocation of Key Pairs
 10.2 Matters concerning measures against certification authorities' loss or destruction of private keys
 10.3 Matters concerning certification authorities' key pair management logs
11. Matters concerning Certificate Management
 11.1 Matters concerning the subscriber registration procedure for certificate issuance and the documents to be submitted
 11.2 Matters concerning subscriber registration information and submitted documents
 11.3 Matters concerning issuance, reissuance, revocation, expiration date update and notification of certificates
 11.4 Matters concerning generation and notification of certificate suspension and revocation information
12. Matters concerning Management of Facilities and Equipment
 12.1 Matters concerning access control for software, systems, networks, and physical equipment
 12.2 Matters concerning change and maintenance of software·system·network·physical equipment
 12.3 Matters concerning audit logging, and backup and management of backup logs
 12.4 Matters concerning Preparation of Management Logs
  A. Management logs for hardware tokens like smart cards
  B. Password management log
  C. Key management log
  D. Media management log
  E. (Outsider) Access control management log
13. Matters concerning Recovery from Disasters
 13.1 Emergency Plan for Failure and Disasters
  A. Emergency contact information
  B. Emergency procedure
  C. Emergency manual
 13.2 Backup Plan for Operational Data, Software, System, Equipment
  A. Backup cycle, procedure and location
  B. Defining resources in need of backup
  C. Backup priority for different types of resources and persons in charge
  D. Remote backup
 13.3 Recovery Plan for Operational Sata, Software, System and Equipment
  A. Recovery priority for different types of resources, recovery procedure and persons in charge

Supplementary Provisions

 ① (Effective Date) These regulations will go into effect as of the date of notification.
 ② (Interim Measures) Provision of 5.2.2 (key pair protection) will go into effect as of November 15, 2004 despite the previous provision.
 ③ (Interim Measures concerning Technical Specifications) Specifications that the head of KISA established and posted in the home page of the root CA (www.rootca.or.kr) prior to this notification will be regarded as having been posted in accordance with this notification.

[Appendix] Electronic Signature Certification System Technical 		
							Specifications

 Detailed information on the following will be determined by the head of KISA and posted in the root CA homepage of KISA (http://www.rootca.or.kr).

1. Profile
 1.1 Certificate Profile
Wired	·KCAC.TS.CERTPROF, "Electronic Signature Certificate Profile Specifications"	
Wireless	·KCAC.TS.WCERTPROF, "wireless Electronic Signature Certificate Profile Specifications"	

 1.2 Certificate Suspension and Revocation List Profile
Wired	·KCAC.TS.CRLPROF, "Electronic Signature Certificate Suspension and Revocation List Profile Specifications"	
Wireless	·KCAC.TS.WCRLPROF, "Wireless DElectronic Signature Certificate Suspension and Revocation List Profile Specifications"	

 1.3 Electronic Signature Certification System DN Specifications
Common	·KCAC.TS.DN, "Electronic Signature Certification System DN Specifications“	

1.4 Technical Specifications for Indicating Certificates
Common	·KCAC.TS.NSACA, "Technical Specifications for Indicating Certificates"	

 1.5 Identification Technical Specifications using Identification Numbers
Common	·KCAC.TS.SIVID, "Identification Technical Specifications using Identification Numbers“	

2. Algorithm
 2.1 Electronic Signature Algorithm 
Wired	RSA	·RSA Laboratories PKCS#1, "RSA Encryption Specifications"
·ANSI X9.31, "Electronic Signatures using Reversible Public Key Encryption for Financial Services Industry (rDSA)"	
	KCDSA	·TTAS.KO-12.0001/R1, "Electronic Signature Mechanism with Appendix - Part 2: Certificate-based Electronic Signature Algorithm"	
Wireless	RSA	·RSA Laboratories PKCS#1, "RSA Encryption Specifications"
·ANSI X9.31, "Electronic Signatures using Reversible Public Key Encryption for Financial Services Industry (rDSA)"	
	ECDSA	·ANSI X9.62, "Public Key Encryption for Financial Services Industry : The Elliptic Curve Electronic Signature Algorithm(ECDSA)"	
Common	        ·KCAC.TS.DSIG, "Electronic Signature Algorithm Specifications"	

2.2 Hash Algorithm
Wired	SHA-1	·FIPS PUB 180-1, "SECURE HASH STANDARD"	
	HAS-160	·TTAS.KO-12.0011/R1, "Hash Function Standard - Part 2: Hash Function Algorithm Standard(HAS-160)"	
Wireless	SHA-1	·FIPS PUB 180-1, "SECURE HASH STANDARD"	

 2.3 Cryptographic Algorithm
Common	3-DES	·FIPS PUB 46-3, "Data Encryption Standard(DES)"	
	SEED	·TTAS.KO-12.0004, "128bit Block Password Algorithm Standard"	

3. Management Protocol
 3.1 Certificate Request format
Wired	online	·KCAC.TS.CRMF, "Certificate Request Format Protocol Specifications“	
	offline	·RSA Laboratories PKCS#10, "Certification Request Syntax Standard"	
Wireless	online	·KCAC.TS.WCRMF, "Wireless Certificate Request Format Protocol Specifications“
·KCAC.TS.CRMF, "Certificate Request Format Protocol Specifications“	
	offline	·RSA Laboratories PKCS#10, "Certification Request Syntax Standard"	
Common	·KCAC.TS.RS, "Reference Number/Aauthorization Code Technical Specifications for Issuance of Certificates“	

 3.2 Certificate Management Protocol
Wired	·KCAC.TS.CMP, "Certificate Management Protocol Specifications“	
Wireless	·KCAC.TS.WCMP, "Wireless Certificate Management Protocol Specifications“
·KCAC.TS.CMP, "Certificate Management Protocol Specifications“	

4. Operating Protocol
 4.1 Directory Operating Protocol
Common	·KCAC.TS.LDAP “Electronic Signature Certification System Directory Protocol Specifications"	

 4.2 Time Stamping Protocol
Common	·IETF RFC 3161, "Internet X.509 Public Key Infrastructure Time- Stamp Protocol (TSP)"	

 4.3 Time Stamping Protocol
Common	·IEFT RFC 1305, "Network Time Protocol(v3) Specification, Implementation and Analysis"	

5. Path Building and Verification Protocol
 5.1 Civilian-government Interoperation Technical Specifications
Wired	·KCAC.TS.CTL, “CTL Technical Specifications for Interoperations between Certification Authorities”	

 5.2 Root CA Reliability Specifications
Wireless	·KCAC.TS.TCI, “Root CA Certificate Reliability Specifications for the Wireless Environment” 	

 5.3 Certificate Validation Technical Specifications
Common	·KCAC.TS.OCSP, "Technical Specifications for checking the Status of Real-time Certificates"	

 5.4 Certificate Verification Technical Specifications
Common	·KCAC.TS.CERTVAL, "Technical Specifications for Verifying the Paths of Ccertificates"	

6. Miscellany
 6.1 User Interface Technical Specifications
Wired	·KCAC.TS.UI, "User Interface Technical Specifications for Interoperations between Certification Authorities"	

 6.2 Technical Specifications for saving PKI information in Password Tokens
Wired	·KCAC.TS.PKCS#15, "PKCS#15 Technical Specifications for Password Tokens“	

 
 6.3 Application Program Interface Technical Specifications for Password Tokens
Wired	·KCAC.TS.PKCS#11, “PKCS#11 Profile Specifications for Password Tokens”	

6.4 Key Pair Protection Technical Specifications
Common	·KCAC.TS.KP, “Key Pair Protection Technical Specifications”