RFC 4262

X.509 Certificate Extension for Secure/Multipurpose Internet Mail Extensions (S/MIME) Capabilities

📅 published December 2005, from ietf

X.509 Certificate Extension for Secure/Multipurpose Internet Mail Extensions (S/MIME) Capabilities 💖

Okay bestie, here's RFC 4262 🎀. It's on the Standards Track, dated December 2005, and it was written by Stefan Santesson at Microsoft (his address is down at the end 🧚). The title block doesn't list any RFCs that it obsoletes or updates, so it doesn't replace or patch anything 🌸.

Status of This Memo ✨

This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Check the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited 🦋.

Copyright Notice 🌈

Abstract 💜

This doc defines a certificate extension that lets you put Secure/Multipurpose Internet Mail Extensions (S/MIME) Capabilities into X.509 public key certificates, as defined by RFC 3280. It's optional 🫶. It's a way to show what cryptographic capabilities an entity has, and it complements the S/MIME Capabilities signed attribute in S/MIME messages, which is described in RFC 3851.

1. Introduction 🌸

Okay so this doc defines a certificate extension for putting S/MIME Capabilities into X.509 public key certificates, as defined by RFC 3280 [RFC3280]. Iconic.

The S/MIME Capabilities attribute, defined in RFC 3851 [RFC3851], shows the cryptographic capabilities of the sender of a signed S/MIME message. The recipient can use that info in later S/MIME exchanges to pick suitable cryptographic properties 💅.

But here's the thing 😭: S/MIME also covers situations where, for example, the sender of an encrypted message has never exchanged S/MIME messages with the recipient, so they don't know the recipient's capabilities. In that case the sender has to rely on out-of-band means or its default configuration to pick a content encryption algorithm for recipients with unknown capabilities. That default might not match the recipient's capabilities or security policy, which is so not it 💀.

This spec's fix is lowkey genius 🧚. S/MIME encryption already needs the recipient's public key certificate, and that certificate already has info about the recipient's public key and the cryptographic capabilities of that key. With the extension defined here, the certificate can also say what the subject's S/MIME capabilities are. Applications can use that as an optional info source for picking encryption settings for the communication ✨.

This doc only covers the "static" approach, where the asserted capabilities stay the same until the certificate expires or is revoked. "Dynamic" approaches, which let you retrieve dynamically updateable capabilities that are certified during a certificate's lifetime, are out of scope here 🙈.

1.1. Terminology 🎀

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [STDWORDS]. (Yes, these are the official BCP 14 words, bestie 🤓.)

2. S/MIME Capabilities Extension 💖

This section defines the S/MIME Capabilities extension 🦋.

The data structure used by this extension is identical to the data structure of the SMIMECapabilities attribute defined in RFC 3851 [RFC3851]. The ASN.1 structure of smimeCapabilities is shown below, but only for illustration 🍓.

   smimeCapabilities OBJECT IDENTIFIER ::=
      {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
      pkcs-9(9) 15}

   SMIMECapabilities ::= SEQUENCE OF SMIMECapability

   SMIMECapability ::= SEQUENCE {
      capabilityID OBJECT IDENTIFIER,
      parameters ANY DEFINED BY capabilityID OPTIONAL }

All content requirements that RFC 3851 defines for the SMIMECapabilities attribute also apply to this extension 🔥.

There are loads of different types of S/MIME Capabilities defined in various documents. You can put all of them in this extension, but this spec is mainly for including S/MIME Capabilities that specify content encryption algorithms 👑.

Certification Authorities (CAs) SHOULD limit the types of S/MIME Capabilities they include in this extension to types that are relevant to the certificate's intended use 🫶.

Client applications that process this extension MAY, at their own discretion, ignore any S/MIME Capabilities present. They SHOULD always gracefully ignore any present S/MIME Capabilities that aren't relevant to the particular use of the certificate ✨.

This extension MUST NOT be marked critical. Don't mark it critical, it's a big no 🙅‍♀️💅.

3. Use in Applications 🧚

Applications that use the S/MIME Capabilities extension SHOULD NOT use the information in the extension if more reliable and relevant authenticated capabilities information is available to the application 💜.

What counts as a more reliable source of information is up to the application using the certificate. This spec doesn't define that 🌈.

4. Security Considerations 💀

This is the serious part, bestie 😭. The S/MIME Capabilities extension contains a statement about the subject's capabilities, made at the time the certificate was issued. Implementers should therefore take into account any effect caused by a change in these capabilities during the certificate's lifetime 🔥.

A change in the subject's capabilities during a certificate's lifetime may require revoking the certificate. Revocation should, however, only be motivated if a listed algorithm is considered broken, or too weak for the governing security policy 💀.

Implementers should also keep in mind that using this extension doesn't change the fact that the sender is always responsible for choosing sufficiently strong encryption for its information disclosure. Protect your info, periodt 🛡️👑.

5. Normative References 📚

[STDWORDS] Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC3280]  Housley, R., Polk, W., Ford, W., and D. Solo, "Internet
           X.509 Public Key Infrastructure Certificate and
           Certificate Revocation List (CRL) Profile", RFC 3280,
           April 2002.

[RFC3851]  Ramsdell, B., "Secure/Multipurpose Internet Mail
           Extensions (S/MIME) Version 3.1 Message Specification",
           RFC 3851, July 2004.

Author's Address 🦋

Stefan Santesson Microsoft Tuborg Boulevard 12 2900 Hellerup Denmark

EMail: stefans@microsoft.com

Full Copyright Statement 🌸

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 💅

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't represent that it has made any independent effort to identify any such rights. Information on the procedures for rights in RFC documents can be found in BCP 78 and BCP 79 🧾.

Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org ✨.

Acknowledgement 🫶

Funding for the RFC Editor function is currently provided by the Internet Society 🌈.

📦 where this page comes from

ietf: rfc4262 2005-12
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms