RFC 4043
Internet X.509 Public Key Infrastructure Permanent Identifier
RFC 4043: Internet X.509 Public Key Infrastructure Permanent Identifier ✨
okay bestie, this is RFC 4043 💖 It's a Standards Track doc from May 2005, from the Network Working Group. D. Pinkas (Bull) and T. Gindin (IBM) wrote it. It's all about giving certificates a permanent identifier, which is basically a name that sticks with someone even when their other details change 🦋 The header doesn't list anything it obsoletes or updates, so it's standing on its own.
Status of This Memo 📜
This doc specifies an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🫶 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌸
Copyright Notice 🌈
Copyright (C) The Internet Society (2005).
Abstract 🔥
This doc creates a new kind of name called a permanent identifier. It can go inside the subjectAltName extension of a public key certificate issued to an entity ✨
The permanent identifier is totally optional 💅 A CA can use it to show that two or more certificates belong to the same entity. That works even when the certificates have different subject names (DNs) or different names in subjectAltName, or when the entity's name or affiliation has changed in the subject or another name form in subjectAltName 🙈
The subject name lives in the subject field and is only unique for each subject entity certified by one CA, as defined by the issuer name field. The new name form can carry a name that's unique for each subject entity certified by a CA, which is honestly iconic 👑
Table of Contents 🗂️
1. Introduction.................................................. 2
2. Definition of a Permanent Identifier.......................... 3
3. IANA Considerations........................................... 6
4. Security Considerations....................................... 6
5. References.................................................... 7
5.1. Normative References.................................... 7
5.2. Informative References.................................. 8
Appendix A. ASN.1 Syntax.......................................... 9
A.1. 1988 ASN.1 Module....................................... 9
A.2. 1993 ASN.1 Module....................................... 10
Appendix B. OID's for organizations............................... 11
B.1. Using IANA (Internet Assigned Numbers Authority)........ 11
B.2. Using an ISO Member Body................................ 12
B.3. Using an ICD (International Code Designator) From
British Standards Institution to Specify a New or
an Existing Identification Scheme....................... 12
Authors' Addresses................................................ 14
Full Copyright Statement.......................................... 151. Introduction 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. These words are serious business, so read them carefully 🙈
This spec is based on [RFC3280], which defines the underlying certificate formats and semantics you need for a full implementation of this standard 💜
The subject field of a public key certificate tells you which entity is linked to the public key in the subject public key field 🧚 A subject's names and identities can be carried in the subject field, the subjectAltName extension, or both. When the subject field is non-empty, it MUST contain an X.500 distinguished name (DN). That DN MUST be unique for each subject entity certified by a single CA, as defined by the issuer name field. Main character energy for sure 👑
The subject name changes whenever any part of that name gets changed. There are a few reasons this happens, and they're all very relatable 😭
- For employees of a company or organization, a person might get a different position in the same company and move from one organization unit to another. Including the organization unit in the name can still be super useful, though, because it helps relying parties (RP's) using that certificate figure out the right individual 💅
- For citizens, a person might change their name through legal processes, especially after marriage 💍
- Any certificate subject identified by geographical location might relocate and change at least some of the location attributes (e.g., country name, state or province, locality, or street) 🗺️
A permanent identifier is an identifier value assigned within a given naming space by the organization that's authoritative for that naming space. The organization doing the assigning could be the CA that issued the certificate, or a different organization called an Assigner Authority 🦋
An Assigner Authority can be a government, a government agency, a corporation, or any other sort of organization ✨ It MUST have a unique identifier so it can be told apart from any other such authority. In this standard, that identifier MUST be an object identifier 🫶
A permanent identifier can be useful in three contexts: access control, non-repudiation, and audit records 🔥
- For access control, the permanent identifier can go in an ACL (Access Control List) instead of the DN or any other form of name. It doesn't need to change even if the entity's subject name changes 🔐
- For non-repudiation, the permanent identifier can link different transactions to the same entity, even when the subject name of the entity changes 🧾
- For audit records, the permanent identifier can link different audit records to the same entity, even when the subject name of the entity changes 📝
For two certificates that have both been verified as valid under a given validation policy and that contain a permanent identifier, those certificates relate to the same entity if their permanent identifiers match. That's true whatever the content of the DN or other subjectAltName components may be 🌸
Since permanent identifiers may conflict with privacy, CAs SHOULD advertise to purchasers of certificates the use of permanent identifiers in certificates 🙈 Transparency is the vibe here 🫶
2. Definition of a Permanent Identifier 💖
This Permanent Identifier is a name defined as a form of otherName from the GeneralName structure in SubjectAltName, as defined in [X.509] and [RFC3280] ✨
A CA that includes a permanent identifier in a certificate is certifying that any public key certificate containing the same values for that identifier refers to the same entity. That's a big promise, so the CA better mean it 💅
The use of a permanent identifier is OPTIONAL. The permanent identifier is defined as follows 🍓
id-on-permanentIdentifier OBJECT IDENTIFIER ::= { id-on 3 }
PermanentIdentifier ::= SEQUENCE {
identifierValue UTF8String OPTIONAL,
-- if absent, use a serialNumber attribute,
-- if there is such an attribute present
-- in the subject DN
assigner OBJECT IDENTIFIER OPTIONAL
-- if absent, the assigner is
-- the certificate issuer
}The identifierValue field is optional 🧚
When the identifierValue field is present, the identifierValue supports one syntax: UTF8String 🎀
When the identifierValue field is absent, the value of the serialNumber attribute (as defined in section 5.2.9 of [X.520]) from the deepest RDN of the subject DN is the value taken for the identifierValue. In that case, there MUST be at least one serialNumber attribute in the subject DN. Otherwise the PermanentIdentifier SHALL NOT be used 😭
The assigner field is optional too 💜
When the assigner field is present, it's an OID that identifies a naming space, meaning both an Assigner Authority and the type of that field. Usually, the prefix of the OID identifies the Assigner Authority, and a suffix identifies the type of permanent identifier 🦋
When the assigner field is absent, the permanent identifier is locally unique to the CA 🌈
The various combinations are detailed below 👑
- Both the assigner and the identifierValue fields are present:
The identifierValue is the value for that type of identifier. The assigner field identifies the Assigner Authority and the type of permanent identifier being identified.
The permanent identifier is globally unique among all CAs. In that case, two permanent identifiers of this type match if and only if their assigner fields match and the contents of the identifierValue field in both permanent identifiers consist of the same Unicode code points, presented in the same order 🔥
- The assigner field is absent and the identifierValue field is present:
The Assigner Authority is the CA that issued the certificate. The identifierValue is given by the CA, and the permanent identifier is only local to the CA that issued the certificate.
In that case, two permanent identifiers of this type match if and only if the issuer DN's in the certificates that contain them match using the distinguishedNameMatch rule, as defined in X.501, and the two values of the identifierValue field consist of the same Unicode code points, presented in the same order 🧾
- Both the assigner and the identifierValue fields are absent:
If there are one or more RDNs containing a serialNumber attribute (alone or accompanied by other attributes), then the value contained in the serialNumber of the deepest such RDN SHALL be used as the identifierValue. Otherwise, the Permanent Identifier definition is invalid and the Permanent Identifier SHALL NOT be used 💀
The permanent identifier is only local to the CA that issued the certificate. In that case, two permanent identifiers of this type match if and only if the issuer DN's in the certificates that contain them match, and the serialNumber attributes within the subject DN's of those same certificates also match using the caseIgnoreMatch rule 🌸
- The assigner field is present and the identifierValue field is absent:
If there are one or more RDNs containing a serialNumber attribute (alone or accompanied by other attributes), then the value contained in the serialNumber of the deepest such RDN SHALL be used as the identifierValue. Otherwise, the Permanent Identifier definition is invalid and the Permanent Identifier SHALL NOT be used 🙈
The assigner field identifies the Assigner Authority and the type of permanent identifier being identified.
The permanent identifier is globally unique among all CAs. In that case, two permanent identifiers of this type match if and only if their assigner fields match and the contents of the serialNumber attributes within the subject DN's of those same certificates match using the caseIgnoreMatch rule ✨
Note: The full arc of the object identifier used to identify the permanent identifier name form is derived using the arcs below. Bestie, pay attention to this part 🧚
id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
id-on OBJECT IDENTIFIER ::= { id-pkix 8 } -- other name forms3. IANA Considerations 📋
okay bestie, good news first: no IANA actions are necessary 🎉 nobody has to file paperwork with IANA for this one. 💅 The only tiny wrinkle is that a Private Enterprise Number may be used to build an OID for the assigner field, which is explained in Annex B.1. 🦋
4. Security Considerations 🔐
okay this section is SO important, so pay attention 👀 it's giving "read the fine print or get burned" energy 😭
A given entity can have multiple forms of identity, either all at once or at different points in time 🫶 so you can't just assume two identities are the same person.
If the permanent identifier is locally unique to the CA (aka the assigner field is not present), then two certificates from the same CA can be compared. 🎀
When two certificates contain identical permanent identifiers, a relying party may conclude that they refer to the same entity. 💜
If the permanent identifier is globally unique among all CAs (aka the assigner field is present), then two certificates from different CAs can be compared 🌍 and if they contain two identical permanent identifiers, a relying party may conclude that they refer to the same entity. ✨ But here's the catch: it is the responsibility of the CA to verify that the permanent identifier it puts in the certificate actually refers to the subject being certified. 🚨 That's on the CA, not on anyone else, periodt.
The permanent identifier identifies the entity no matter what any attribute extension says 🧚 When a public key certificate has attribute extensions, the permanent identifier (if it's there) should not be used for access control. It's only for audit purposes 🙈 The reason is that attributes can change over time. Access could get granted based on attributes that were in an earlier certificate issued to that entity, even though they're gone from the current one. That's a whole mess, bestie. 💀
Subject names in certificates are picked by the issuing CA and are mandated to be unique for each CA, so two subject names from the same CA can never collide 🌸 A subject name can be an end-entity name (when the certificate is a leaf certificate) or a CA name (when it's a CA certificate).
Here's where it gets slippery 🌈 A name is only unique relative to its superior CA. Unless some naming constraints are in use, a name would only be guaranteed globally unique if you included the whole sequence of names of the superior CAs. So two certificates issued under the same issuer DN that both contain the same permanent identifier extension without an assigner field do not necessarily refer to the same entity. 😭 Not me being like "they match, must be the same person" when they might not be!
Extra checks are needed before you trust a match. For example, you'd want to check whether the public key values of the two issuing CAs are identical, or whether the sequences of CA names in the certification paths from the trust anchor to those CAs are identical. 🔍
When those checks fail, the permanent identifiers may still match if there has been a CA key rollover. 🔄 In that case, the checking gets more complicated, so be extra careful, bestie. 💅
Another negative consequence: when different CAs certify the same DN, it causes problems in various parts of the PKI. The big one is that it makes the IssuerAndSerialNumber structure in [RFC3852] section 10.2.4 ambiguous. 🙈
Last but DEFINITELY not least, privacy 🦋 The permanent identifier lets organizations link different certificates belonging to an entity, whether or not their validity periods overlap. That linking ability can clash with privacy, so it's really important that a CA clearly discloses any plans to issue certificates including a permanent identifier to the potential subjects of those certificates. 🫶
5. References 📚
5.1. Normative References 💖
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC3280] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 3280, April 2002.
- [UTF-8] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.
- [X.501] ITU-T Rec X.501 | ISO 9594-2: 2001: Information technology - Open Systems Interconnection - The Directory: Models, February 2001.
5.2. Informative References 🌸
- [RFC3852] Housley, R., "Cryptographic Message Syntax (CMS)", RFC 3852, July 2004.
- [X.509] ITU-T Recommendation X.509 (1997 E): Information Technology - Open Systems Interconnection - The Directory: Authentication Framework, June 1997.
- [X.520] ITU-T Recommendation X.520: Information Technology - Open Systems Interconnection - The Directory: Selected Attribute Types, June 1997.
- [X.660] ITU-T Recommendation X.660: Information Technology - Open Systems Interconnection - Procedures for the Operation of OSI Registration Authorities: General Procedures, 1992.
- [X.680] ITU-T Recommendation X.680: Information Technology - Abstract Syntax Notation One, 1997.
Appendix A. ASN.1 Syntax 🧩
As in RFC 2459, ASN.1 modules are supplied in two different variants of the ASN.1 syntax. 🎀
This section describes data objects used by conforming PKI components in an "ASN.1-like" syntax. It's a hybrid of the 1988 and 1993 ASN.1 syntaxes. The 1988 ASN.1 syntax is augmented with the 1993 UNIVERSAL Type UTF8String. ✨
The ASN.1 syntax doesn't allow type statements in the ASN.1 module, and the 1993 ASN.1 standard doesn't allow the new UNIVERSAL types in modules that use the 1988 syntax. So this module doesn't conform to either version of the ASN.1 standard. 🙈 Lowkey chaotic, but that's just how it is.
Appendix A.1 can be parsed by a 1988 ASN.1 parser if you replace the definitions for the UNIVERSAL Types with the 1988 catch-all "ANY". 🔧
Appendix A.2 can be parsed "as is" by a 1997-compliant ASN.1 parser. 💜
If there are any discrepancies between these modules, the 1988 module is the normative one. 👑
Appendix A.1. 1988 ASN.1 Module 💅
PKIXpermanentidentifier88 {iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-perm-id-88(28) }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS ALL --
IMPORTS
-- UTF8String, / move hyphens before slash if UTF8String does not
-- resolve with your compiler
-- The content of this type conforms to [UTF-8].
id-pkix
FROM PKIX1Explicit88 { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) id-pkix1-explicit(18) } ;
-- from [RFC3280]
-- Permanent identifier Object Identifier and Syntax
id-on OBJECT IDENTIFIER ::= { id-pkix 8 }
id-on-permanentIdentifier OBJECT IDENTIFIER ::= { id-on 3 }
PermanentIdentifier ::= SEQUENCE {
identifierValue UTF8String OPTIONAL,
-- if absent, use the serialNumber attribute
-- if there is a single such attribute present
-- in the subject DN
assigner OBJECT IDENTIFIER OPTIONAL
-- if absent, the assigner is
-- the certificate issuer
}
ENDAppendix A.2. 1993 ASN.1 Module 🌈
PKIXpermanentidentifier93 {iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-perm-id-93(29) }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS ALL --
IMPORTS
id-pkix
FROM PKIX1Explicit88 { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) id-pkix1-explicit(18) }
-- from [RFC3280]
ATTRIBUTE
FROM InformationFramework {joint-iso-itu-t ds(5) module(1)
informationFramework(1) 4};
-- from [X.501]
-- Permanent identifier Object Identifiers
id-on OBJECT IDENTIFIER ::= { id-pkix 8 }
id-on-permanentIdentifier OBJECT IDENTIFIER ::= { id-on 3 }
-- Permanent Identifier
permanentIdentifier ATTRIBUTE ::= {
WITH SYNTAX PermanentIdentifier
ID id-on-permanentIdentifier }
PermanentIdentifier ::= SEQUENCE {
identifierValue UTF8String OPTIONAL,
-- if absent, use the serialNumber attribute
-- if there is a single such attribute present
-- in the subject DN
assigner OBJECT IDENTIFIER OPTIONAL
-- if absent, the assigner is
-- the certificate issuer
}
ENDAppendix B. OID's for Organizations 🏢
In order to build an OID for the assigner field, organizations first need a registered OID for themselves. 💖 That OID has to be obtained from a registration authority following [X.660]. Sometimes OID's are provided for free, and other times a one-time fee is required. The main difference is the kind of information collected at registration and how that information is verified for accuracy. 🔍
Appendix B.1. Using IANA (Internet Assigned Numbers Authority) 🦋
The application form for a Private Enterprise Number in IANA's OID list is at http://www.iana.org/cgi-bin/enterprise.pl. 📝
Currently, IANA assigns numbers for free 🎉 The IANA-registered Private Enterprises prefix is iso.org.dod.internet.private.enterprise (1.3.6.1.4.1).
These numbers are used, among other things, for defining private SNMP MIBs. 🧚
The official assignments under this OID are stored in the IANA file "enterprise-numbers", available at http://www.iana.org/assignments/enterprise-numbers. 🌸
Appendix B.2. Using an ISO Member Body 🌍
ISO structured the OID tree so that every ISO member-body has its own unique OID. Each member-body is then free to allocate its own arc space underneath that. 🌳
Organizations and enterprises can contact the ISO member-body where they're established to get an organization or enterprise OID. 💅
Currently, ISO members do not assign organization or enterprise OID's for free. 😭
Most of them don't publish registries of the OID's they've assigned. Some restrict access to registered organizations, and others charge inquirers for the assignee of an OID on a per-inquiry basis. 🙈 Using an OID from an ISO member organization that doesn't publish a registry may add extra costs for the CA, because the CA needs to make sure the OID actually corresponds to the registered organization. 💀
As an example, AFNOR (Association Francaise de Normalisation, the French organization that is a member of ISO) has defined an arc to allocate OID's for companies 👑
{iso (1) member-body (2) fr (250) type-org (1) organisation (n)}Appendix B.3. Using an ICD (International Code Designator) From British Standards Institution to Specify a New or an Existing Identification Scheme ✨
okay so the ICD (International Code Designator) is the thing that gives an identification scheme its own unique ID 🔑. It's defined under ISO 6523, which sets out how an identifier has to be structured and how you register an ICD in the first place. Put an ICD together with an identifier from the registration authority and you get something that's unique worldwide 🌍 no cap.
The code has these parts 💅:
- the ICD value: the International Code Designator given to the identification scheme, which makes the identifier worldwide unique (up to 4 digits),
- the Organization, usually a company or government body (up to 35 characters),
- an Organization Part (OPI, Organization Part Identifier): an identifier given to a particular Organization Part (optional, up to 35 characters).
The ICD is also the same thing as an object identifier (OID) under the arc {1(iso). 3(identified organization)} 🦋
On behalf of ISO, the British Standards Institution (BSI) is the Registration Authority for organizations under the arc {iso (1) org(3)}. So BSI registers code issuing authorities (organizations) by ICD values, which are equivalent to OIDs of the form {iso (1) org(3) icd(xxxx)}. The matching IdentifierValue is the code value of the scheme identified by icd(xxxx) 💖
For example, ICD 0012 was given to the European Computer Manufacturers Association: ECMA. So the OID for ECMA is {iso(1) org(3) ecma(12)} 🎀
Registration with BSI isn't free, and you need a "Sponsoring Authority" to vouch for the applying organization. Recognized "Sponsoring Authorities" are ISO Technical Committees or (Sub)Committees, Member Bodies of ISO, or International Organizations with a liaison status with ISO or with any of its Technical (Sub)Committees 🫶
One example of a Sponsoring Authority is the EDIRA Association (EDI/EC Registration Authority, web: http://www.edira.org, email: info@edira.org) 🌸
The numerical list of all ICDs that have been issued is posted on its webpage: http://www.edira.org/documents.htm#icd-List 📋
Note: IANA owns ICD code 0090, but (presumably) it isn't intending to use it for the present purpose 🙈
Authors' Addresses 🖋️
Denis Pinkas
Bull
Rue Jean-Jaures BP 68
78340 Les Clayes-sous-Bois
FRANCE
EMail: Denis.Pinkas@bull.net
Thomas Gindin
IBM Corporation
6710 Rockledge Drive
Bethesda, MD 20817
USA
EMail: tgindin@us.ibm.comFull Copyright Statement 📜
Copyright (C) The Internet Society (2005).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔐
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 🌈
Funding for the RFC Editor function is currently provided by the Internet Society. 💜
📦 where this page comes from
- ietf: rfc4043 2005-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms