scope:

This document sets forth guidance for life-cycle management of public/private (i.e., asymmetric) keys that are used to secure interactions among systems. The devices included within the scope of this guidance.

The scope of this guidance is not intended to include:

• Any off-board, ground-based systems, including those with which aircraft systems and operator-controlled PEDs may communicate. Ground-based systems do not have the unique constraints and challenges associated with global, mobile aircraft systems; therefore, they are expected to reference guidance in ATA Spec 42 as applicable to typical IT environments.
• Passenger-owned devices, which are beyond the control of the aircraft operator.
• Operator-controlled PEDs that are treated like passenger-owned devices.

This document is meant to be a companion to Air Transport Association (ATA) Spec 42, which is the work product of the ATA Digital Security Working Group (DSWG). ATA Spec 42 specifies a digital identity management framework and standard digital certificate profiles recommended for use across the air transport industry, as well as standard policies governing the issuance and use of these certificates and the levels of assurance that may be conveyed in a digital identity. This document specifically addresses ATA Spec 42 in the context of actual aircraft deployment by providing guidance to aircraft manufacturers, equipment suppliers, and operators on topics including:

Purpose and Objectives

Newer generations of aircraft in production and use today are equipped with security applications that rely on digital certificates. It is expected that future aircraft will use certificates for increasing numbers of applications. The purpose of this document is to provide guidance for key life-cycle management, which refers to the phases through which digital certificates and associated cryptographic keys progress, from creation through usage to retirement.

The guidance is based on open international standards that are adapted to the aviation environment, recognizing that a typical commercial airplane has a long lifespan, its operational environment is highly complex and regulated, and multiple stakeholders operate ground-based systems that communicate with airplanes. Using a standardized and consistent key management approach, as proposed in this document, helps to reduce cost of design, implementation, and operation even across a heterogeneous fleet.