RFC 3770

Certificate Extensions and Attributes Supporting Authentication in Point-to-Point Protocol (PPP) and Wireless Local Area Networks (WLAN)

📅 published May 2004, from ietf

RFC 3770 🎀 Certificate Extensions and Attributes Supporting Authentication in Point-to-Point Protocol (PPP) and Wireless Local Area Networks (WLAN)

okay bestie, here's the header tea ☕

Request for Comments: 3770 📜
Network Working Group 🧚
Authors: R. Housley (Vigil Security) and T. Moore (Microsoft) 💖
Category: Standards Track ✨ (an official, real-deal standards track doc)
Date: May 2004 🌸
Obsoletes / Updates: neither is listed in the title block 🙈

Status of This Memo ✨

this doc is an Internet standards track protocol spec for the Internet community 🦋 it wants your discussion and suggestions for improvements 💬 for the standardization state and status of this protocol, check the current edition of "Internet Official Protocol Standards" (STD 1) 📚 distribution of this memo is unlimited 🌈

Copyright Notice

Abstract 🧚

this document defines two EAP extended key usage values 🔑 and a public key certificate extension for carrying Wireless LAN (WLAN) System Service identifiers (SSIDs) 📶

1. Introduction 🌸

okay so a bunch of Extensible Authentication Protocol (EAP) [EAP] methods use X.509 public key certificates 🔐 for example, EAP-TLS [EAP-TLS] can run over PPP [PPP] and also over IEEE 802.1X [802.1X] 🫶 PPP is the one used for dial-up and VPN setups 📞 meanwhile IEEE 802.1X is all about port-based network access control 🚪 and it's what gives you authenticated network access on Ethernet, Token Ring, and Wireless LANs (WLANs) [802.11] 📡 iconic duo

picking the right certificate automatically for PPP and IEEE 802.1X clients is highkey the dream 😭 if certificate extensions say which environment a certificate is meant for, the user doesn't have to type stuff in every time 🙌 and the extensions also keep the admin stuff for different environments separated 🗂️ very organized, very slay

IEEE 802.1X can work with more than one network, too 🌐 for example, the same wireless station might use 802.1X to get onto a corporate IEEE 802.11 WLAN and also a public IEEE 802.11 "hotspot" ☕ each of those WLANs has its own network name, called a Service Set Identifier (SSID) 🏷️ if the network operators have a roaming agreement, cross realm authentication lets the same certificate work on both networks 🤝 but if they don't have one, the 802.1X client has to pick a certificate for whatever network it's currently on 🫠 so putting a list of SSIDs in a certificate extension lets the client auto-select the right X.509 public key certificate without bugging the user 💅 alternatively, a companion attribute certificate could hold that SSID list instead 🎀

1.1. Conventions Used In This Document

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119 [STDWORDS] 📖 these are the requirement words, so read them carefully bestie 🧐

1.2. Abstract Syntax Notation

all X.509 certificate [X.509] extensions are defined using ASN.1 [X.208, X.209] 🧩

2. EAP Extended Key Usage Values 💜

RFC 3280 [PROFILE] is where the extended key usage X.509 certificate extension gets specified 🔍 this extension says what purpose or purposes the certified public key can be used for, one or more of them 🎯 it can team up with the key usage extension, which tells you the intended purpose of the certified public key too 👯 like, the key usage extension might say the key is only for validating digital signatures ✍️ main character energy for that one

the extended key usage extension definition is repeated here for convenience 💖

id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}

ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId

KeyPurposeId ::= OBJECT IDENTIFIER

this spec defines two KeyPurposeId values 👀 one is for EAP over PPP, and one is for EAP over LAN (EAPOL) 💫 if you include the EAP over PPP value, the certified public key is good to use with EAP in the PPP environment 📞 including the EAPOL value means it's good for EAP in the LAN environment 🌐 include both and it's good for either environment 🦋

id-kp  OBJECT IDENTIFIER  ::=  { iso(1) identified-organization(3)
         dod(6) internet(1) security(5) mechanisms(5) pkix(7) 3 }

id-kp-eapOverPPP  OBJECT IDENTIFIER  ::=  { id-kp 13 }

id-kp-eapOverLAN  OBJECT IDENTIFIER  ::=  { id-kp 14 }

the cert issuer gets to pick whether the extended key usage extension is critical or non-critical 🧑‍⚖️ if it's marked critical, the certified public key MUST be used only for the purposes it lists 🚫 but if it's marked non-critical, the extended key usage extension MAY be used to help find an appropriate certified public key 🔎

okay, the critical vs non-critical thing is a big deal, so pay attention 🙈

if a certificate has both a critical key usage extension and a critical extended key usage extension, then BOTH extensions MUST be processed independently 🧠 and the certificate MUST only be used for a purpose that's consistent with both extensions 🎀 if there's no purpose consistent with both critical extensions, then the certificate MUST NOT be used for any purpose at all 💀

3. WLAN SSID Public Key Certificate Extension 📶

the WLAN System Service identifiers (SSIDs) public key certificate extension is always non-critical 💅 it carries a list of SSIDs 📋 when more than one certificate has an extended key usage extension saying the certified public key is good for EAP in the LAN environment, the list of SSIDs MAY be used to pick the correct certificate for authenticating on a particular WLAN 🎯

here's the tricky part 🫣 SSID values are unmanaged, so the same SSID can show up in different certificates that are meant for different WLANs 😬 when that happens, automatic selection of the certificate will fail, and the implementation SHOULD get help from the user to choose the correct one 🙋 if a human user isn't around, each potential certificate MAY be tried until one succeeds 🔁 but! if you keep a cache of Access Point (AP) MAC addresses or the authentication server identity that a certificate has successfully authenticated with, user involvement can be minimized ✨ RADIUS [RADIUS1, RADIUS2] is usually the authentication service in WLAN deployments 🛰️ and the cache can be used to skip future human interaction or the trial-and-error certificate selection 🙌

the WLAN SSID extension is identified by id-pe-wlanSSID 🏷️

id-pe  OBJECT IDENTIFIER  ::=  { iso(1) identified-organization(3)
         dod(6) internet(1) security(5) mechanisms(5) pkix(7) 1 }

id-pe-wlanSSID  OBJECT IDENTIFIER  ::=  { id-pe 13 }

the syntax for the WLAN SSID extension is 🧩

SSIDList  ::=  SEQUENCE SIZE (1..MAX) OF SSID

SSID  ::=  OCTET STRING (SIZE (1..32))

7.1. Normative References ✨

okay so these are the docs the spec needs you to have read first, bestie 📚

[ACPROFILE] Farrell, S. and R. Housley, "An Internet Attribute Certificate Profile for Authorization", RFC 3281, April 2002.
[PROFILE] Housley, R., Polk, W., Ford, W. and D. Solo, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 3280, April 2002.
[STDWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[X.208] CCITT. Recommendation X.208: Specification of Abstract Syntax Notation One (ASN.1), 1988.
[X.209] CCITT. Recommendation X.209: Specification of Basic Encoding Rules for Abstract Syntax Notation One (ASN.1), 1988.
[X.509] ITU-T. Recommendation X.509: The Directory - Authentication Framework, 2000.

7.2. Informative References 🦋

these ones are more like the "ooh, go read this if you're curious" list, no pressure 🫶

[802.11] IEEE Std 802.11, "Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications", 1999.
[802.1X] IEEE Std 802.1X, "Port-based Network Access Control", 2001.
[EAP] Blunk, L. and J. Vollbrecht, "PPP Extensible Authentication Protocol (EAP)", RFC 2284, March 1998.
[EAP-TLS] Aboba, B. and D. Simon, "PPP EAP TLS Authentication Protocol", RFC 2716, October 1999.
[PPP] Simpson, W., Ed., "The Point-to-Point Protocol (PPP)", STD 51, RFC 1661, July 1994.
[RADIUS1] Rigney, C., Willens, S., Rubens, A. and W. Simpson, "Remote Authentication Dial In User Service (RADIUS)", RFC 2865, June 2000.
[RADIUS2] Congdon, P., Aboba, B., Smith, A., Zorn, G. and J. Roese, "IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines", RFC 3580, September 2003.

8. ASN.1 Module 🧩

this is the actual ASN.1 module, so it's the part your parser is gonna care about most 💅

WLANCertExtn
  { iso(1) identified-organization(3) dod(6) internet(1)
    security(5) mechanisms(5) pkix(7) id-mod(0)
    id-mod-wlan-extns(24) }

DEFINITIONS IMPLICIT TAGS ::=
BEGIN

-- OID Arcs

id-pe  OBJECT IDENTIFIER  ::=
   { iso(1) identified-organization(3) dod(6) internet(1)
     security(5) mechanisms(5) pkix(7) 1 }

id-kp  OBJECT IDENTIFIER  ::=
   { iso(1) identified-organization(3) dod(6) internet(1)
     security(5) mechanisms(5) pkix(7) 3 }

id-aca  OBJECT IDENTIFIER  ::=
   { iso(1) identified-organization(3) dod(6) internet(1)
     security(5) mechanisms(5) pkix(7) 10 }

-- Extended Key Usage Values

id-kp-eapOverPPP  OBJECT IDENTIFIER  ::=  { id-kp 13 }

id-kp-eapOverLAN  OBJECT IDENTIFIER  ::=  { id-kp 14 }
-- Wireless LAN SSID Extension

id-pe-wlanSSID  OBJECT IDENTIFIER  ::=  { id-pe 13 }

SSIDList  ::=  SEQUENCE SIZE (1..MAX) OF SSID

SSID  ::=  OCTET STRING (SIZE (1..32))

-- Wireless LAN SSID Attribute Certificate Attribute
-- Uses same syntax as the certificate extension: SSIDList

id-aca-wlanSSID  OBJECT IDENTIFIER ::= { id-aca 6 }

END

9. Author's Address 💌

meet the people behind it! 🌸

Russell Housley
Vigil Security, LLC
918 Spring Knoll Drive
Herndon, VA 20170
USA

EMail: housley@vigilsec.com

Tim Moore
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052
USA

EMail: timmoore@microsoft.com

10. Full Copyright Statement ⚖️

okay the legal bit, but make it cute 🎀

Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🔐

the IETF is not taking a side on whether any IP rights might apply to the tech in this doc, or whether you could get a license for them. it also hasn't done its own independent search for those rights. if you want the details on how RFC rights work, check out BCP 78 and BCP 79 ✨

copies of IPR disclosures sent to the IETF Secretariat, plus any promised licenses, or the results of any attempt to get a general license or permission for implementers or users of this spec to use those proprietary rights, can be found in the IETF online IPR repository at http://www.ietf.org/ipr.

the IETF also invites anyone to flag any copyrights, patents, patent applications or other proprietary rights that might cover tech needed to implement this standard. send that info to the IETF at ietf-ipr@ietf.org 📬

Acknowledgement 🫶

funding for the RFC Editor function is currently provided by the Internet Society. thank you, Internet Society! 💜

📦 where this page comes from

ietf: rfc3770 2004-05
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms