T1 – Public Key Infrastructure (PKI)

Version: 0.9.0
Status: Release Candidate
Type: Normative Conformance Test Specification

Copyright © 2026 inside workspace GmbH
This work is licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) License.

1 Introduction

1.1 Purpose

This specification defines the reference Public Key Infrastructure (PKI) used by the KAPRI Reference Implementation.

The reference PKI provides the certificates required to generate, sign and validate Knowledge Asset Packages and KAP Key Delivery Messages.

It establishes a reproducible certification hierarchy that enables independent implementations to generate, sign and validate Knowledge Asset Packages in an interoperable manner.

1.2 Scope

This specification defines:

• the reference certification hierarchy,
• certificate roles,
• certificate generation,
• certificate validation,
• the execution order of PKI conformance tests.

This specification does not define:

• production PKIs,
• trust management,
• certificate revocation,
• timestamp authorities,
• hardware security modules,
• operational security policies.

1.3 Relationship to Other Specifications

This specification forms part of the KAPRI Conformance Test Suite.

It validates requirements defined by:

• SC1 – Common Data Types
• S1 – Package Manifest Schema
• S4 – KAP Key Delivery Message Schema

The generated certificates are used by the KAPRI Reference Package and all cryptographic validation tests.

2 Reference PKI

2.1 Purpose

The reference PKI provides a deterministic certification hierarchy for the KAPRI Reference Implementation.

Its purpose is to ensure reproducible generation and validation of digital signatures.

The reference PKI is intended exclusively for the Reference Implementation and interoperability testing. It is not intended for production use.

2.2 Reference Certification Hierarchy

The reference certification hierarchy SHALL consist of:

Root Certification Authority
        │
        ▼
Intermediate Certification Authority
        │
        ├──────────────┐
        ▼              ▼
Producer         Recipient
Certificate      Certificate

2.3 Certificate Responsibilities

Root Certification Authority

The Root Certification Authority issues the Intermediate Certification Authority certificate.

Intermediate Certification Authority

The Intermediate Certification Authority issues:

• Producer Certificates
• Recipient Certificates

Producer Certificate

A Producer Certificate is used to digitally sign:

• Package Manifests
• KAP Key Delivery Messages

Recipient Certificate

A Recipient Certificate identifies the intended recipient of encrypted File Keys contained in a KAP Key Delivery Message.

2.4 Cryptographic Profile

The KAPRI Reference Implementation uses the following cryptographic profile:

• Hash Algorithm: SHA-256
• Signature Algorithm: ECDSA using the NIST P-256 curve (secp256r1)
• Key Algorithm by certificate role:
  • Root Certification Authority: ECDSA P-256 (signing only)
  • Intermediate Certification Authority: ECDSA P-256 (signing only)
  • Producer Certificate: ECDSA P-256 (signs Package Manifests and KAP Key Delivery Messages)
  • Recipient Certificate: RSA-2048 (encrypts File Keys via RSA-OAEP; ECDSA/EC keys have no direct encryption primitive, so this role deliberately stays RSA rather than requiring an ECDH-based key-wrapping scheme)

This profile is a reference-implementation choice, not a normative requirement of the KAPRI Specification Suite. SC1 – Common Data Types defines Hash Algorithm and Signature as extensible data types; conforming implementations MAY use a different supported Cryptographic Profile, provided all participants in a given exchange agree on one they mutually support.

3 Conformance Tests

The reference PKI SHALL provide the following executable conformance tests.

TestPurposeT1.1 | Generate Root Certification Authority
T1.2 | Generate Intermediate Certification Authority
T1.3 | Generate Producer Certificate
T1.4 | Generate Recipient Certificate
T1.5 | Validate Certification Chain

4 Test Execution Order

The executable PKI tests SHALL be executed in the following order:

T1.1 Generate Root Certification Authority
        ↓
T1.2 Generate Intermediate Certification Authority
        ↓
T1.3 Generate Producer Certificate
        ↓
T1.4 Generate Recipient Certificate
        ↓
T1.5 Validate Certification Chain

Each test depends on the successful completion of all preceding tests.

5 Expected Results

The generated certificates SHALL:

• conform to the configured certificate hierarchy,
• contain the expected issuer and subject,
• satisfy the configured validity period,
• contain the required key usage extensions,
• successfully validate the complete certification chain,
• be suitable for interoperable signature generation and validation.

6 Conformance

An implementation claiming conformance with this specification SHALL:

• generate certificates equivalent to the reference PKI,
• preserve the defined certification hierarchy,
• successfully validate all generated certificate chains,
• produce interoperable certificates suitable for signing and validating Knowledge Asset Packages and KAP Key Delivery Messages.