T/ZISIA 0103-2026 Specification for commercial cipher digital certificate system of general-purpose operating systems

Scope

The main chapters of this standard are: Part 6: OS Certificate System and Part 8: OS Application Certificate Specification. 1. Part 6: OS Certificate System The OS certificate system consists of OS startup certificates, kernel-state certificates, and user-state certificates. — OS startup certificates: Certificates used to verify the signed OS code during the OS startup phase, including startup shim certificates and kernel code certificates. — Kernel-state certificates: Certificates used to verify the signed OS code or files during the OS kernel state, including driver module certificates and file integrity certificates. Driver module certificates are used to sign device startup code and kernel modules (.ko); file integrity certificates are used to verify various OS files, such as user-state executable files (ELF), shared object libraries (.so), kernel modules (.ko), and scripts (.sh). — User-state certificates: Certificates used to verify the signed applications during the OS user state, including application package certificates, executable program (such as binary tools and scripts) signing certificates, and SSH certificates used during OS communication. 2. Part 8: OS Application Certificate Specification It clearly defines startup shim certificates, kernel code certificates, driver module certificates, file integrity certificates, application package certificates, executable program certificates, and SSH certificates; the roles of various certificates, the entities responsible for using and managing certificates, the certificate issuance entities, responsibilities and authorizations, how to verify certificate chains, and the requirements for certificate use and management during OS runtime.

Development Information

Related Standards