用戶金鑰對之產製

Subscriber Key Pair Generation

The CA SHALL reject a certificate request if one or more of the following conditions are met:

若符合下列一項或多項條件，憑證機構（Certification Authority，CA）應（SHALL）拒絕憑證申請：

1. The Key Pair does not meet the requirements set forth in Section 6.1.5 and/or Section 6.1.6;

1. 金鑰對不符合第 6.1.5 節及／或第 6.1.6 節所定之要求；

2. There is clear evidence that the specific method used to generate the Private Key was flawed;

2. 有明確證據顯示，用於產製該私密金鑰之特定方法存在缺陷；

3. The CA is aware of a demonstrated or proven method that exposes the Applicant’s Private Key to compromise;

3. CA 獲悉已有經展示或證實之方法，足以使申請者之私密金鑰遭受破解（compromise）；

4. The CA has previously been notified that the Applicant’s Private Key has suffered a Key Compromise using the CA’s procedure for revocation request as described in Section 4.9.3 and Section 4.9.12;

4. CA 先前已接獲依據第 4.9.3 節及第 4.9.12 節所述之 CA 憑證廢止請求程序所提出之通知，指出申請者之私密金鑰已發生金鑰遭破解（Key Compromise）；

5. The Public Key corresponds to an industry-demonstrated weak Private Key. At least the following precautions SHALL be implemented:
   1. In the case of Debian weak keys vulnerability (https://wiki.debian.org/SSLkeys), the CA SHALL reject all keys found at https://github.com/cabforum/Debian-weak-keys/ for each key type (e.g. RSA, ECDSA) and size listed in the repository. For all other keys meeting the requirements of Section 6.1.5, with the exception of RSA key sizes greater than 8192 bits, the CA SHALL reject Debian weak keys.
   2. In the case of ROCA vulnerability, the CA SHALL reject keys identified by the tools available at https://github.com/crocs-muni/roca or equivalent.
   3. In the case of Close Primes vulnerability (https://fermatattack.secvuln.info/), the CA SHALL reject weak keys which can be factored within 100 rounds using Fermat’s factorization method.
   Suggested tools for checking for weak keys can be found here: https://cabforum.org/resources/tools/

5. 公開金鑰（Public Key）所對應之私密金鑰（Private Key），經業界證實屬弱金鑰。至少應（SHALL）實施下列預防措施：

   1. 針對 Debian 弱金鑰（Debian weak keys）漏洞（https://wiki.debian.org/SSLkeys），CA 應（SHALL）拒絕 https://github.com/cabforum/Debian-weak-keys/ 儲存庫中針對各金鑰類型（例如 RSA、ECDSA）及金鑰長度所列之所有弱金鑰。對於其他符合第 6.1.5 節要求之所有金鑰（RSA 金鑰長度超過 8192 位元者除外），CA 應（SHALL）拒絕符合 Debian 弱金鑰漏洞之金鑰。
   2. 針對 ROCA 漏洞，CA 應（SHALL）拒絕經 https://github.com/crocs-muni/roca 所提供之工具或其他具同等功能工具檢測，識別為受 ROCA 漏洞影響之金鑰。
   3. 針對接近質數漏洞（Close Primes vulnerability）（https://fermatattack.secvuln.info/），CA 應（SHALL）拒絕可於費馬因式分解法（Fermat’s factorization method）重複 100 次步驟內完成因式分解之弱金鑰。

   可用於檢查弱金鑰之建議工具請參閱：https://cabforum.org/resources/tools/

If the Subscriber Certificate will contain an extKeyUsage extension containing either the values id-kp-serverAuth RFC 5280 or anyExtendedKeyUsage RFC 5280, the CA SHALL NOT generate a Key Pair on behalf of a Subscriber, and SHALL NOT accept a certificate request using a Key Pair previously generated by the CA.

若用戶憑證（Subscriber Certificate）將包含 extKeyUsage 擴充欄位，且其中包含 id-kp-serverAuth（RFC 5280）或 anyExtendedKeyUsage（RFC 5280）值，CA 不得（SHALL NOT）代表用戶產製金鑰對，亦不得（SHALL NOT）接受以 CA 先前產製之金鑰對所提出的憑證申請。