RFC 2528

Internet X.509 Public Key Infrastructure: Representation of KEA Keys in Certificates 🎀

Okay bestie, this one is RFC 2528 and it's all about how to put Key Exchange Algorithm (KEA) keys into Internet X.509 PKI certificates 🔐✨. It was written by R. Housley (SPYRUS) and W. Polk (NIST) and it's dated March 1999. The category is Informational 🌸, so it's sharing information, not setting an Internet standard. The header doesn't list anything it obsoletes or updates, so it's just vibing on its own 🦋.

Status of this Memo ✨

This memo gives information to the Internet community. It isn't an Internet standard of any kind, and it can be shared freely with no limits on distribution 💅.

Copyright Notice 🌈

Copyright (C) The Internet Society (1999). All Rights Reserved. 🫶

Table of Contents 📑

   Abstract ........................................................ 2
   1.  Executive Summary ........................................... 2
   2.  Requirements and Assumptions ................................ 2
   2.1.  Communication and Topology ................................ 2
   2.2.  Acceptability Criteria .................................... 2
   2.3.  User Expectations ......................................... 3
   2.4.  Administrator Expectations ................................ 3
   3.  KEA Algorithm Support ....................................... 3
   3.1.  Subject Public Key Info ................................... 3
   3.1.1.  Algorithm Identifier and Parameters ..................... 4
   3.1.2.  Encoding of KEA Public Keys ............................. 5
   3.2.  Key Usage Extension in KEA certificates ................... 5
   4. ASN.1 Modules ................................................ 5
   4.1 1988 Syntax ................................................. 5
   4.2 1993 Syntax ................................................. 6
   5. References ................................................... 6
   6. Security Considerations ...................................... 7
   7. Authors' Addresses ........................................... 8
   8. Full Copyright Statement ..................................... 9

Abstract 🔥

Okay so the Key Exchange Algorithm (KEA) is a classified algorithm for swapping keys 🤫. This spec sets the rules for the format and meaning of the fields in X.509 V3 certificates that hold KEA keys. It covers the subjectPublicKeyInfo field and the keyUsage extension, and that's the whole tea ☕.

1. Executive Summary 💖

This spec is the guidance for using Internet Public Key Infrastructure certificates to carry KEA keys. It's an addendum to RFC 2459, "Internet X.509 Public Key Infrastructure: Certificate and CRL Profile", so implementations of this spec must also conform to RFC 2459 🧚. You don't have to conform to other parts of that series though, which is very chill 😌.

2. Requirements and Assumptions 🦋

The goal is to extend the X.509 certificate profile from Part 1 so that managing KEA keys is easier for the communities that actually use this algorithm 💜.

2.1. Communication and Topology 🌸

This profile, as laid out in [RFC 2459] and extended by this spec, works for users who don't have high bandwidth, real-time IP connectivity, or high connection availability 📶. It also allows for firewalls or other filtered communication, which is giving very real-world energy 🔥.

The profile doesn't assume you've got an X.500 Directory system set up. It doesn't ban X.500 Directories either, but other ways of distributing certificates and certificate revocation lists (CRLs) are supported too 🍓.

2.2. Acceptability Criteria 💅

The Internet Public Key Infrastructure (PKI) exists to meet the needs of deterministic, automated identification, authentication, access control, and authorization functions 🔐. The services it supports decide what goes in the certificate, plus the extra control info like policy data and certification path constraints 👑.

This document's goal is to profile KEA certificates by specifying the contents and semantics of attributes that [RFC 2459] didn't fully pin down ✨. If this document doesn't specifically address something, then the contents and semantics of the fields and extensions must be as described in [RFC 2459] 🙈.

2.3. User Expectations 🎀

Users of the Internet PKI are people and processes that use client software and are named as subjects in certificates 🫶. That includes readers and writers of electronic mail, WWW browser clients, WWW servers, and the key manager for IPSEC inside a router 🌈. This profile takes into account the limits of the platforms users run on, plus how sophisticated and attentive the users themselves are 🧠. So users get minimal configuration responsibility (like root keys and rules), explicit platform usage constraints inside the certificate, certification path constraints that shield users from a lot of malicious actions, and applications that sensibly automate validation 🛡️.

2.4. Administrator Expectations 👑

Same vibe as users: the Internet PKI profile is built to support the people who usually run Certification Authorities (CAs) 🏛️. Giving administrators unlimited choices just raises the odds that one subtle CA mistake leads to a broad compromise, or makes interoperability worse for no reason 😭. This profile defines the object identifiers and data formats that must be supported in order to interpret KEA public keys 💜.

3. KEA Algorithm Support 🧚

This section describes the object identifiers and data formats that may be used with [RFC 2459] to describe X.509 certificates holding a KEA public key 🦋. Conforming CAs are required to use these object identifiers and data formats when issuing KEA certificates. Conforming applications shall recognize the object identifiers and process the data formats when they process those certificates 🫶.

3.1. Subject Public Key Info 🔑

The certificate identifies the KEA algorithm, carries optional parameters, and specifies the KEA public key in the subjectPublicKeyInfo field ✨. The subjectPublicKeyInfo field is a SEQUENCE of an algorithm identifier and the subjectPublicKey field 💖.

The certificate points to the algorithm through an algorithm identifier. That identifier is made of an object identifier (OID) and optional associated parameters 🌸. Section 3.1.1 names the preferred OID and parameters for the KEA algorithm 💅. Conforming CAs shall use the named OID when issuing certificates with public keys for the KEA algorithm. Conforming applications that support the KEA algorithm shall, at a minimum, recognize the OID named in section 3.1.1 🔥.

The certificate carries the KEA public key through the subjectPublicKey field, which is a BIT STRING 🍓. Section 3.1.2 explains how to encode a KEA public key as a BIT STRING. Conforming CAs shall encode the KEA public key as described in Section 3.1.2 when issuing certificates with public keys for the KEA algorithm. Conforming applications that support the KEA algorithm shall decode the subjectPublicKey as described in section 3.1.2 when the algorithm identifier is the one given in 3.1.1 💜.

3.1.1. Algorithm Identifier and Parameters 🧁

The Key Exchange Algorithm (KEA) is an algorithm for exchanging keys 🗝️. Two users can generate a KEA "pairwise key" if their KEA public keys were generated with the same KEA parameters 👯. The KEA parameters aren't included in a certificate. Instead, a "domain identifier" goes in the parameters field 🎀.

When the subjectPublicKeyInfo field holds a KEA key, the algorithm identifier and parameters shall be as defined in [sdn.701r]:

   id-keyExchangeAlgorithm  OBJECT IDENTIFIER   ::=
          { 2 16 840 1 101 2 1 1 22 }

   KEA-Parms-Id     ::= OCTET STRING

CAs shall fill the parameters field of the AlgorithmIdentifier inside the subjectPublicKeyInfo field of each certificate that has a KEA public key with an 80-bit parameter identifier (OCTET STRING), which is also called the domain identifier 🌈. The domain identifier is computed in three steps 🧮. Step one: DER encode the KEA parameters using the Dss-Parms structure. Step two: generate a 160-bit SHA-1 hash from the parameters. Step three: reduce the 160-bit hash to 80 bits by doing an "exclusive or" of the 80 high order bits with the 80 low order bits 💥. The result is encoded so that the most significant byte of the 80-bit value is the first octet in the octet string 🦋.

The Dss-Parms structure is from [RFC 2459], and it's copied below so you don't have to go hunting 🫶.

    Dss-Parms  ::=  SEQUENCE  {
        p             INTEGER,
        q             INTEGER,
        g             INTEGER  }

3.1.2. Encoding of KEA Public Keys 🌸

A KEA public key, y, goes into the subjectPublicKey BIT STRING so that the most significant bit (MSB) of y becomes the MSB of the BIT STRING value field, and the least significant bit (LSB) of y becomes the LSB of the BIT STRING value field 💖. That gives this encoding: the BIT STRING tag, the BIT STRING length, a 0 (meaning zero unused bits in the final octet of y), and then the BIT STRING value field that includes y ✨.

3.2. Key Usage Extension in KEA certificates 🔐

The key usage extension may optionally appear in a KEA certificate 💜. If a KEA certificate includes the keyUsage extension, only the following values may be asserted:

   keyAgreement;
   encipherOnly; and
   decipherOnly.

The encipherOnly and decipherOnly values may only be asserted if the keyAgreement value is asserted too 🙌. At most one of encipherOnly and decipherOnly shall be asserted in the keyUsage extension 🚫. Generally, the keyAgreement value is asserted without either encipherOnly or decipherOnly being asserted 🍓.

6. Security Considerations ✨

Okay bestie, this spec is all about how KEA keys get formatted and encoded inside X.509 certificates 🎀 Since certificates are digitally signed, no extra integrity service is needed. Certs don't have to be kept secret either, and unrestricted, anonymous access to certificates and CRLs has no security implications 🦋

However, security factors outside the scope of this spec will affect how much assurance cert users actually get 😭 This section highlights the critical issues that implementors, administrators, and users should keep in mind 💅

The procedures that CAs and RAs use to validate the binding between the subject's identity and their public key hugely affect how much assurance a certificate deserves 🫶 Relying parties may want to review the CA's certificate practice statement, no cap 📜

Protecting private keys is a critical factor in staying secure 🔐 If users fail to protect their KEA private keys, an attacker can masquerade as them or decrypt their personal information 💀

The availability and freshness of revocation information also affects how much assurance a certificate should get 🌸

Certificates expire naturally, but events can happen during their lifetime that break the binding between the subject and the public key 😱 If revocation information is untimely or unavailable, the assurance tied to that binding is clearly reduced. In the same way, implementations of the Path Validation mechanism described in section 6 that skip revocation checking give less assurance than the ones that support it 🙈

The path validation algorithm specified in [RFC 2459] depends on having certain knowledge of the public keys (and other information) for one or more trusted CAs 👑 Deciding to trust a CA is a big deal, because it ultimately determines how much trust a certificate gets ✨ Distributing trusted CA public keys in an authenticated way (usually as a "self-signed" certificate) is a security-critical out-of-band process 🧚 It's beyond the scope of this spec, so it's not on us, iykyk 🌈

Also, if a key compromise or CA failure happens for a trusted CA, the user will need to update the information given to the path validation routine 🥀 Picking too many trusted CAs makes that trusted CA info really hard to maintain 😩 But picking only one trusted CA might trap users in a closed community until a global PKI shows up 🌍

The quality of the implementations that process certificates also affects how much assurance you get 💅 The path validation algorithm described in section 6 relies on the integrity of the trusted CA info, especially the integrity of the public keys tied to those trusted CAs 🔥 If an attacker swaps in public keys they hold the private key for, they could trick the user into accepting false certificates 😭🚨

The binding between a key and certificate subject cannot be stronger than the cryptographic module implementation and the algorithms used to generate the signature. Protect that module like it's your whole personality 👑

7. Authors' Addresses 🎀

Here are the authors, bestie, with their contact info 💖

Russell Housley
SPYRUS
381 Elden Street
Suite 1120
Herndon, VA 20170
USA

EMail: housley@spyrus.com


Tim Polk
NIST
Building 820, Room 426
Gaithersburg, MD 20899
USA

EMail: wpolk@nist.gov

8. Full Copyright Statement 🦋

The legal bits have to stay exactly as written, so here's the whole copyright statement, word for word 📜

Copyright (C) The Internet Society (1999).  All Rights Reserved.

This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works.  However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.

The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.