RFC 3854

Securing X.400 Content with Secure/Multipurpose Internet Mail Extensions (S/MIME)

📅 published July 2004, from ietf

Securing X.400 Content with Secure/Multipurpose Internet Mail Extensions (S/MIME) 🎀

Okay bestie, the title block is giving very important paperwork energy 💅. It's RFC 3854, filed as a Standards Track doc in July 2004. The authors are P. Hoffman (IMC), C. Bonatti (IECA), and A. Eggen (FFI). The title block doesn't list anything this RFC obsoletes or updates, so it's standing on its own 👑.

Status of This Memo ✨

This document is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions to make it better 🫶. For the current standardization state and status of this protocol, check the current edition of "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈.

Copyright Notice 🦋

Abstract 💜

This doc is about adding cryptographic signature and encryption services to X.400 content, using Secure/Multipurpose Internet Mail Extensions (S/MIME) 🔐.

1. Introduction 🧚

So the Cryptographic Message Syntax [CMS] spec is general enough to cover a LOT of different content types, which means it gives you a whole buffet of options for security mechanisms 🍓. To keep everybody in the X.400 community interoperable, we need to pin down exactly which CMS features are used to protect X.400 content. This doc calls that "CMS-X.400" ✨.

1.1. Specification Overview 🌸

This doc is basically a sibling of the S/MIME Version 3.1 Message Specification [MSG], except it's tailored for X.400 content instead of Multipurpose Internet Mail Extensions (MIME) 💅.

Here's the deal: this doc defines how to make an X.400 content type that's been cryptographically enhanced according to [CMS]. To create S/MIME messages carrying X.400 content, an S/MIME agent has to follow this document AND the specs listed in [CMS] 🔥. The memo also defines new parameter values for the application/pkcs7-mime MIME type, which can be used to carry those body parts.

Throughout this doc, there are requirements and recommendations for how receiving agents handle incoming messages, and separate ones for how sending agents create outgoing messages. The overall strategy is to "be liberal in what you receive and conservative in what you send" 🫶. Most of the requirements land on handling incoming messages, and the recommendations are mostly about creating outgoing messages.

This doc does NOT cover transport of CMS-X.400 content 🙈. It's assumed that CMS-X.400 content would travel over Internet mail systems, X.400, or some other suitable transport.

This doc describes applying security services to the content of entire X.400 messages, which may or may not be IPMS messages. These objects can be carried by several means, including SMTP-based mail and X.400 mail 💖. Also, cooperating S/MIME agents need to support common forms of message content if they want to achieve interoperability.

If the CMS objects are sent as parts of an RFC 822 message, a standard MIXER gateway [MIXER] will most likely choose to encapsulate the message. That's probably not going to be usable by an X.400 recipient 😭. MIXER is specifically focused on translating between X.420 Interpersonal Messages and non-secure RFC822/MIME messages. The discussion of security-related body parts in sections 7.3 and 7.4 of [BODYMAP] is relevant to CMS messages 🌈.

Defining gateway services to relay CMS objects between X.400 and SMTP environments is out of scope for this doc 🙅‍♀️.

1.2. Terminology 🎀

The key words "MUST", "SHALL", "REQUIRED", "SHOULD", "RECOMMENDED", and "MAY" in this document are to be interpreted as described in BCP 14, RFC 2119 [MUSTSHOULD] 💅.

1.3. Definitions 📖

For the purposes of this document, these definitions apply 🫶:

ASN.1:             Abstract Syntax Notation One, as defined in
                   ISO/IEC 8824.

BER:               Basic Encoding Rules for ASN.1, as defined in
                   ISO/IEC 8825-1.

Certificate:       A type that binds an entity's distinguished name
                   to a public key with a digital signature.

DER:               Distinguished Encoding Rules for ASN.1, as defined
                   in ISO/IEC 8825-1.

7-bit data:        Text data with lines less than 998 characters
                   long, where none of the characters have the 8th
                   bit set, and there are no NULL characters.  <CR>
                   and <LF> occur only as part of a <CR><LF> end of
                   line delimiter.

8-bit data:        Text data with lines less than 998 characters, and
                   where none of the characters are NULL characters.
                   <CR> and <LF> occur only as part of a <CR><LF> end
                   of line delimiter.

Binary data:       Arbitrary data.

Transfer Encoding: A reversible transformation made on data so 8-bit
                   or binary data may be sent via a channel that only
                   transmits 7-bit data.

Receiving agent:   Software that interprets and processes S/MIME CMS
                   objects.

Sending agent:     Software that creates S/MIME CMS objects.

S/MIME agent:      User software that is a receiving agent, a sending
                   agent, or both.

1.4. Compatibility with Prior Practice of S/MIME 🦄

As far as anyone knows, there are no existing X.400 implementations that support S/MIME version 2 😬. Also, signed interoperability between X.400 and MIME systems that support S/MIME version 2 isn't believed to be easily achievable. So backward compatibility with S/MIME version 2 is NOT considered a requirement for this document 🙅‍♀️.

That said, a goal of this document is to, if possible, keep backward compatibility with existing X.400 implementations that use S/MIME v3.1 wrappers ✨.

2. CMS Options 🌷

CMS allows a wild variety of options for content and algorithm support 🤯. This section lays out a bunch of support requirements and recommendations so every CMS-X.400 implementation gets a base level of interoperability. [CMS] has the extra details on using the cryptographic algorithms 📚.

2.1. DigestAlgorithmIdentifier 🔑

Sending and receiving agents MUST support SHA-1 [CMSALG] 💖.

2.2. SignatureAlgorithmIdentifier ✍️

Receiving agents MUST support id-dsa-with-sha1, defined in [CMSALG]. The algorithm parameters MUST be absent (not encoded as NULL). Receiving agents MUST support rsaEncryption, defined in [CMSALG] 🫶.

Sending agents MUST support either id-dsa-with-sha1 or rsaEncryption 💅.

2.3. KeyEncryptionAlgorithmIdentifier 🗝️

Sending and receiving agents MUST support rsaEncryption, defined in [CMSALG] 🔥.

Sending and receiving agents SHOULD support Diffie-Hellman, defined in [CMSALG] 🌈.

2.4. General Syntax 🧩

The general syntax of CMS objects is an instance of the ContentInfo structure containing one of several defined CMS content types. CMS defines multiple content types, but only the SignedData and EnvelopedData content types get used for CMS-X.400 🎀.

2.4.1. SignedData Content Type ✍️

Sending agents MUST use the signedData content type to apply a digital signature to a message. In the degenerate case where there's no signature information, they MUST use it to convey certificates instead 🦋.

2.4.2. EnvelopedData Content Type 🤫

Senders MUST use the envelopedData content type to apply privacy protection to a message. A sender needs access to a public key for each intended message recipient to use this service 🔐. This content type does NOT provide authentication 🙈.

2.5. Attribute SignerInfo Type 🏷️

The SignerInfo type lets you include unsigned and signed attributes along with a signature ✨.

Receiving agents MUST be able to handle zero or one instance of each of the signed attributes listed here. Sending agents SHOULD generate one instance of each of the following signed attributes in each CMS-X400 message 💖:

signingTime
sMIMECapabilities
sMIMEEncryptionKeyPreference

Processing these attributes MUST be in accordance with the S/MIME Message Specification [MSG]. Handling of the signingTime attribute MUST comply with clause 2.5.1 of [MSG]. Handling of the sMIMECapabilities attribute MUST comply with clause 2.5.2 of [MSG]. Handling of the sMIMEEncryptionKeyPreference attribute MUST comply with clause 2.5.3 of [MSG] 📚.

Further, receiving agents SHOULD be able to handle zero or one instance of the signingCertificate attribute in the signed attributes [ESS] 🫶.

Sending agents SHOULD generate one instance of the signingCertificate signed attribute in each CMS-X400 message 🌸.

More attributes and values for them may be defined in the future. Receiving agents SHOULD handle attributes or values they don't recognize in a graceful manner 🦢.

Sending agents that include signed attributes NOT listed here SHOULD display those attributes to the user, so the user knows about ALL of the data being signed 👀.

2.6. ContentEncryptionAlgorithmIdentifier 🔒

Sending and receiving agents MUST support encryption and decryption with DES EDE3 CBC, hereinafter called "tripleDES" [CMSALG] 💅. Sending and receiving agents SHOULD support encryption and decryption with AES [CMSAES] at key sizes of 128, 192 and 256 bits 🌟.

3. Creating S/MIME Messages 💌

This section describes the S/MIME message formats and how they can be used to secure X.400 contents 💖. S/MIME messages combine X.400 contents with CMS objects, meaning a ContentInfo structure containing one of the CMS-defined content types. The X.400 content and other data, such as certificates and algorithm identifiers, go to CMS processing facilities, which produce a CMS object 🧁. This document also explains how nested, secured S/MIME messages should be formatted when they encapsulate X.400 content. It gives an example of how a triple-wrapped S/MIME message over X.400 content should be created, if backwards compatibility with S/MIME version 2 is of no concern 🔁.

S/MIME provides one format for enveloped-only data, several formats for signed-only data, and several formats for signed and enveloped data 🎁. Those different formats are needed to cover several environments, especially for signed messages. Only one of the signed formats applies to X.400 🎯.

Canonicalization is NOT required for X.400 content, because it's a binary rather than a text encoding, and only the "embedded" content version is used. That makes the description of S/MIME productions a whole lot simpler 🙌.

The reader of this section is expected to understand X.400 as described in [X.400], and S/MIME as described in [CMS] and [ESS] 🤓.

3.1. The X.400 Message Structure ✨

okay so first, the X.400 message format, bestie 💌 An X.400 message has two parts: the envelope and the content, as described in X.402 [X.400]:

Envelope -- An information object whose composition varies from one transmittal step to another and that variously identifies the message's originator and potential recipients, documents its previous conveyance and directs its subsequent conveyance by the Message Transfer System (MTS), and characterizes its content.

Content -- The content is the piece of information that the originating User Agent wants to be delivered to one or more recipients. The MTS neither examines nor modifies the content, except for conversion, during its conveyance of the message. MTS conversion is not applicable to the scenario of this document because such conversion is incompatible with CMS protection mechanisms. 🙅‍♀️

One piece of information borne by the envelope identifies the type of the content. The content type is an identifier (an ASN.1 OID or Integer) that denotes the syntax and semantics of the content overall. This identifier enables the MTS to determine the message's deliverability to particular users, and enables User Agents and Message Stores to interpret and process the content. 🧠

Another piece of information borne by the envelope identifies the types of encoded information represented in the content. An encoded information type (EIT) is an identifier (an ASN.1 Object Identifier or Integer) that denotes the medium and format (e.g., IA5 text or Group 3 facsimile) of individual portions of the content. It further enables the MTS to determine the message's deliverability to particular users, and to identify opportunities for it to make the message deliverable by converting a portion of the content from one EIT to another. 🦋

This document describes how S/MIME CMS is used to secure the content part of X.400 messages. 🔐

3.2. Creating a Signed-only Message with X.400 Content

The SignedData format as described in the Cryptographic Message Syntax [CMS] MUST be used for signing of X.400 contents. 🖊️

The X.400 content to be protected MUST be placed in the SignedData encapContentInfo eContent field. Note that this X.400 content SHOULD maintain the encoding defined by the content type, but SHOULD NOT be MIME wrapped. The object identifier for the content type of the protected X.400 content MUST be placed in the SignedData encapContentInfo eContentType field. 🎀

The signedData object is encapsulated by a ContentInfo SEQUENCE with a contentType of id-signedData.

Note that if SMTP [SMTP] is used to transport the resulting signed-only message then the optional MIME encoding SHOULD be used. If binary transports such as X.400 are used then the optional MIME encoding SHOULD NOT be used. 🚛

There are many reasons for this requirement. An outer MIME wrapper should not be used in X.400. Further, there are places where X.400 systems will interact with SMTP/MIME systems where the outer MIME wrapper might be necessary. Because this wrapping is outside the security wrappers, any gateway system that might bridge the gap between the two systems will be smart enough to apply or remove the outer MIME wrapper as appropriate. 🌉✨

3.2.1. MIME Wrapping to Dynamically Support 7-bit Transport

The signedData object MAY optionally be wrapped in MIME. This allows the system to support 7-bit transport when required. This outer MIME wrapper MAY be dynamically added or removed throughout the delivery path since it is outside the signature and encryption wrappers. In this case the application/pkcs7-mime type as defined in S/MIME Version 3.1 Message Specification [MSG] SHOULD be used with the following parameters:

Content-Type: application/pkcs7-mime; smime-type=signed-x400
Content-Transfer-Encoding: base64

If the application/pkcs7-mime MIME type is used to support 7-bit transport, the steps to create this format are:

Step 1. The X.400 content to be signed is ASN.1 encoded. 📝

Step 2. The ASN.1 encoded X.400 content and other required data is processed into a CMS object of type SignedData. The SignedData structure is encapsulated by a ContentInfo SEQUENCE with a contentType of id-signedData.

Step 3. The CMS object is inserted into an application/pkcs7-mime MIME entity. 💅

The smime-type parameter for messages using application/pkcs7-mime with SignedData is signed-x400 as defined in [TRANSPORT]. 🌸

3.3. Creating an Enveloped-only Message with X.400 Content

This section describes the format for enveloping an X.400 content without signing it. It is important to note that sending enveloped but not signed messages does not provide for data integrity. It is possible to replace ciphertext in such a way that the processed message will still be valid, but the meaning is altered. 😱 bestie, this is the one to remember.

The EnvelopedData format as described in [CMS] is used for confidentiality of the X.400 contents. 🤫

The X.400 content to be protected MUST be placed in the EnvelopedData encryptedContentInfo encryptedContent field. Note that this X.400 content SHOULD maintain the encoding defined by the content type, but SHOULD NOT be MIME wrapped. The object identifier for content type of the protected X.400 content MUST be placed in the EnvelopedData encryptedContentInfo contentType field.

The envelopedData object is encapsulated by a ContentInfo SEQUENCE with a contentType of id-envelopedData.

Note that if SMTP is used to transport the resulting enveloped-only message then the optional MIME encoding SHOULD be used. If other transport (e.g., X.400) that is optimized for binary content is used then the optional MIME encoding SHOULD NOT be used.

3.3.1. MIME Wrapping to Dynamically Support 7-bits Transport

The envelopedData object MAY optionally be wrapped in MIME. This allows the system to support 7-bit transport when required. This outer MIME wrapper MAY be dynamically added or removed throughout the delivery path since it is outside the signature and encryption wrappers. In this case, the application/pkcs7-mime type as defined in S/MIME Version 3.1 Message Specification [MSG] SHOULD be used with the following parameters:

Content-Type: application/pkcs7-mime; smime-type=enveloped-x400
Content-Transfer-Encoding: base64

If the application/pkcs7-mime MIME type is used to support 7-bit transport, the steps to create this format are:

Step 1. The X.400 content to be enveloped is ASN.1 encoded. 🎁

Step 2. The ASN.1 encoded X.400 content and other required data is processed into a CMS object of type EnvelopedData. In addition to encrypting a copy of the content-encryption key for each recipient, a copy of the content encryption key SHOULD be encrypted for the originator and included in the EnvelopedData (see [CMS] Section 6). The EnvelopedData structure is encapsulated by a ContentInfo SEQUENCE with a contentType of id-envelopedData.

Step 3. The CMS object is inserted into an application/pkcs7-mime MIME entity to allow for 7-bit transport. 🧚

If the application/pkcs7-mime MIME entity is used, the smime-type parameter for enveloped-only messages is enveloped-x400 as defined in [TRANSPORT]. 💜

3.4. Nested CMS Structures

okay, so to get signing AND enveloping, you can nest any of the signed-only and encrypted-only CMS objects inside each other. 🪆

When nesting is used, backwards compatibility with S/MIME version 2 requires that each layer of the nested message are identified with the OID id-data, and when id-data is used a MIME wrapper is required. This can potentially lead to an enormous amount of overhead and should be avoided. Because S/MIME version 2 compatibility is of no concern, implementations SHOULD directly encode the encapsulated object as the eContent of the current structure. 🙄 the overhead is giving too much.

MIME wrapping to support 7-bit transport is optional and need only be used around the outermost CMS structure. In this case, the application/pkcs7 content type MUST be used.

An S/MIME implementation MUST be able to receive and process arbitrarily nested CMS structures within reasonable resource limits of the recipient computer. 📦

3.4.1. Creating a Triple Wrapped Message With an X.400 Content

The Enhanced Security Services for S/MIME [ESS] document provides examples of how nested, secured S/MIME messages are formatted. ESS provides an example of how a triple-wrapped S/MIME message is formatted using application/pkcs7-mime for the signatures. 📚

This section explains how an X.400 content may be conveyed within a Triple Wrapped Message because S/MIME version 2 compatibility is of no concern: 🌷

Step 1. Start with the X.400 content (called the "original content"). The X.400 content MUST be ASN.1 encoded, but SHOULD NOT be MIME wrapped.

Step 2. Place the ASN.1 encoded X.400 content to be protected in the SignedData encapContentInfo eContent field. Add any attributes that are to be signed.

Step 3. Sign the result of step 2 (the original content). The SignedData encapContentInfo eContentType MUST contain the object identifier of the X.400 content.

Step 4. Encrypt the result of step 3 as a single block. The EnvelopedData encryptedContentInfo contentType MUST be set to id-signedData. This is called the "encrypted body".

Step 5. Using the same logic as in step 2 and 3 above, sign the result of step 4 (the encrypted body) as a single block. The SignedData encapContentInfo eContentType MUST be set to id-envelopedData. The outer SignedData structure is encapsulated by a ContentInfo SEQUENCE with a contentType of id-signedData.

Step 6. The resulting message is called the "outer signature", and is also the triple wrapped message. 🎉

MIME wrapping to support 7-bit transport is optional and MUST only be used around the outermost CMS structure. In this case, the application/pkcs7-mime content type MUST be used. The smime-type in the case of adding a MIME wrapper MUST be consistent with that appropriate to the innermost protection layer.

In some instances, an smime-type will be created that only reflects one security service (such as certs-only, which applies only to signed-only messages). However, as new layers are wrapped, this smime-type SHOULD be propagated upwards. Thus if a certs-only message were to be encrypted, or wrapped in a new SignedData structure, the smime-type of certs-only should be propagated up to the next MIME wrapper. In other words, the innermost type is reflected outwards. 🪞

3.5. Carrying Plaintext X.400 Content in SMTP

While the objectives of this document focus on protecting X.400 content with CMS wrappers, it is a reality that users do not generally send all message using security. It therefore stands to reason that a means to carry non-secured X.400 content over the chosen transport system must be seamlessly provided. While transporting X.400 content in an X.400 system is trivial, carrying X.400 content in SMTP requires additional definition. 📬

Content-Type: application/x400-content; content-type = 1*DIGIT *( "."
1*DIGIT)

where the content-type parameter value is either a single integer (for a built-in content-type) or an OID in dotted notation (for an extended content-type). 🔢

4. Use of Certificates ✨

4.1. Certificate Enrollment 🎀

okay so S/MIME v3.1 does NOT tell you how to get a certificate from a certificate authority 🙃 it just assumes every sending agent already has one. (the vibe is "you already have your cert, bestie, we're not going there.") at the time of writing, the PKIX Working Group had made two separate standards for certificate enrollment: CMP (RFC 2510) and CMC (RFC 2792). 📜✨

4.2. Certificate Processing 🔐

receiving agents MUST provide some certificate retrieval mechanism so they can actually get the certs for recipients of digital envelopes. this doc doesn't cover how S/MIME agents handle certificates in general, only what they do after a cert has been validated or rejected. the cert stuff is covered in [CERT31] 💅

for initial S/MIME deployment, a user agent could, at a minimum, automatically send a message to an intended recipient asking for that person's certificate in a signed return message. 💌 receiving and sending agents SHOULD also give users a way to "store and protect" certificates for their correspondents, in a way that guarantees they can be retrieved later. main character save-file energy 🧚✨

4.3. Certificate Name Use for X.400 Content 📬

end-entity certificates used in this context MAY contain an X.400 address, as described in [X.400]. the address has to be in the form of an "ORAddress". the X.400 address SHOULD go in the subjectAltName extension, and SHOULD NOT go in the subject distinguished name. (put it in the right spot, iykyk 🙈)

sending agents SHOULD make the originator address in the X.400 content (like the originator field in P22) match an X.400 address in the signer's certificate. 🫶

receiving agents MUST recognize X.400 addresses in the subjectAltName field. 💜

receiving agents SHOULD check that the originator address in the X.400 content matches an X.400 address in the signer's certificate, but only if X.400 addresses are actually present in the certificate AND an originator address is available in the content. if that comparison fails, a receiving agent SHOULD provide some explicit alternate processing of the message, which may be to show the recipient the addresses in the certificate or other certificate details. 🔍 no cap, this is the "wait, something's off" moment and it deserves a proper response 😭

the subject alternative name extension is the preferred way in S/MIME to convey the X.400 address(es) that match the entity for this certificate, so it's basically the main character spot 👑 any X.400 addresses present MUST be encoded using the x400Address CHOICE of the GeneralName type. since SubjectAltName is a SEQUENCE OF GeneralName, multiple X.400 addresses MAY be present. 🌈

5. Security Considerations 🚨

this specification introduces no new security concerns to the CMS or S/MIME models. (phew, we're good 😮‍💨) security issues are identified in section 5 of [MSG], section 6 of [ESS] and the Security Considerations section of [CMS]. go read those, they're where the real drama lives 💀

6. References 📚

6.1. Normative References

[CERT31]     Ramsdell, B., Ed., "Secure/Multipurpose Internet Mail
             Extensions (S/MIME) Version 3.1 Certificate Handling",
             RFC 3850, July 2004.

[CMS]        Housley, R., "Cryptographic Message Syntax (CMS)", RFC
             3852, July 2004.

[CMSAES]     Schaad, J., "Use of the AES Encryption Algorithm in
             CMS", RFC 3565, July 2003.

[CMSALG]     Housley, R., "Cryptographic Message Syntax (CMS)
             Algorithms", RFC 3370, August 2002.

[ESS]        Hoffman, P., Editor "Enhanced Security Services for
             S/MIME", RFC 2634, June 1999.

[MSG]        Ramsdell, B., Ed., "Secure/Multipurpose Internet Mail
             Extensions (S/MIME) Version 3.1 Message Specification",
             RFC 3851, July 2004.

[MUSTSHOULD] Bradner, S., "Key words for use in RFCs to Indicate
             Requirement Levels", BCP 14, RFC 2119, March 1997.

[TRANSPORT]  Hoffman, P. and C. Bonatti, "Transporting
             Secure/Multipurpose Internet Mail Extensions (S/MIME)
             Objects in X.400", RFC 3855, July 2004.

[X.400]      ITU-T X.400 Series of Recommendations, Information
             technology - Message Handling Systems (MHS).  X.400:
             System and Service Overview; X.402: Overall
             Architecture; X.411: Message Transfer System: Abstract
             Service Definition and Procedures; X.420: Interpersonal
             Messaging System; 1996.

6.2. Informative References 🦋

[BODYMAP]    Alvestrand, H., Ed., "Mapping between X.400 and RFC-
             822/MIME Message Bodies", RFC 2157, January 1998.

[MIXER]      Kille, S., Ed., "MIXER (Mime Internet X.400 Enhanced
             Relay): Mapping between X.400 and RFC 822/MIME", RFC
             2156, January 1998.

[SMTP]       Klensin, J., "Simple Mail Transfer Protocol", RFC 2821,
             April, 2001.

7. Editors' Addresses 🖊️

Paul Hoffman
Internet Mail Consortium
127 Segre Place
Santa Cruz, CA  95060  USA

EMail: phoffman@imc.org


Chris Bonatti
IECA, Inc.
15309 Turkey Foot Road
Darnestown, MD  20878-3640  USA

EMail: bonattic@ieca.com


Anders Eggen
Forsvarets Forskningsinstitutt
Postboks 25
2027 Kjeller, Norway

EMail: anders.eggen@ffi.no

Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.

Acknowledgement 🫶

Funding for the RFC Editor function is currently provided by the Internet Society. 💖

📦 where this page comes from

ietf: rfc3854 2004-07
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms