RFC 4476
Attribute Certificate (AC) Policies Extension
RFC 4476: Attribute Certificate (AC) Policies Extension 🦋
okay bestie, this one is the spec for the Attribute Certificate (AC) Policies Extension and it's giving rules 💅 Here's the title block tea: it's from the Network Working Group, the category is Standards Track, and it's dated May 2006. The authors are C. Francis (Raytheon) and D. Pinkas (Bull) 🫶 The title block doesn't list anything it obsoletes or updates.
Status of This Memo 📜
So this document specifies an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 💭 If you want the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈
Copyright Notice ©️
Copyright (C) The Internet Society (2006).
Abstract ✨
This document describes one certificate extension that explicitly states the Attribute Certificate Policies (ACPs) that apply to a given Attribute Certificate (AC). The whole point is to let relying parties run an extra check when they validate an AC. In other words, they can assess whether an AC carrying some attributes can be accepted based on references to one or more specific ACPs 🔍
1. Introduction ✨
okay so when a Certificate Authority (CA) issues a Public Key Certificate (PKC), it can do different levels of verification on the subject identity (see [RFC3280]) 🧐 The CA makes its verification procedures, and the other operational rules it follows, "visible" through a certificate policy. A PKC can point to that policy with a certificate policies extension 📎
The purpose of this document is to define an Attribute Certificate (AC) policies extension that can explicitly state the AC policies that apply to a given AC. It does NOT contain the AC policies themselves 🙈 Attribute Certificates are defined in [RFC3281] 💜
1.1. Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 🎀
2. AC Policies Extension Semantics 💖
An Attribute Certificate Policy is a named set of rules. It tells you whether an AC is applicable to a particular community and/or class of applications that share the same security requirements 🌸 It defines rules for generating, issuing, and revoking ACs, and it can also include extra rules for attributes registration.
So an Attribute Authority (AA) doesn't have to support just one single ACP 🤷♀️ But for every AC that gets delivered, the AA SHALL make sure the policy applies to ALL the attributes contained in it. That's non-negotiable, bestie 😭
An ACP can be used by an AC user to decide whether or not to trust the attributes in an AC for a particular purpose 🔥
When an AC contains an AC policies extension, the extension MAY, at the option of the AA, be either critical or non-critical.
The AC Policies extension MAY be included in an AC. Like all X.509 certificate extensions [X.509], it's defined using ASN.1 [ASN1]. See Appendix A 📚
The definitions are written in the 1988 Abstract Syntax Notation One (ASN.1), not the 1997 ASN.1 syntax used in the most recent ISO/IEC/ITU-T standards 🧠
The AC policies extension is identified by id-pe-acPolicies:
id-pe-acPolicies OBJECT IDENTIFIER ::= { iso(1)
identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) id-pkix(7) id-pe(1) 15 }The AC policies extension includes a list of AC policies that the AA recognizes and that apply to the attributes included in the AC 🌟 Any organization with a need can define AC Policies. The object identifiers used to identify them are assigned in accordance with [X.660|ISO9834-1] 🦋
The AC policies extension in an AC indicates the AC policies that the AC is valid for ✨
An application that recognizes this extension and its content SHALL process the extension, regardless of the value of the criticality flag. 💅
If the extension is both flagged non-critical AND not recognized by the AC-using application, then the application MAY ignore it 🙈
If the extension is marked critical or is recognized by the AC-using application, it means the attributes in the attribute certificate SHALL only be used for the purpose, and in accordance with the rules tied to one of the indicated AC policies. If none of the ACP identifiers is adequate for the application, then the AC MUST be rejected. Not me rejecting an AC 💀
If the extension is marked critical or is recognized by the AC using application, the AC-using application MUST use the list of AC policies to figure out whether it's appropriate to use the attributes in that AC for a particular transaction. When the appropriate policy is not found, the AC SHALL be rejected 🚫
2.1. AC Policy Extension Syntax 🎀
The syntax for the AC Policy extension is:
AcPoliciesSyntax ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
PolicyInformation ::= SEQUENCE {
policyIdentifier AcPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL}
AcPolicyId ::= OBJECT IDENTIFIER
PolicyQualifierInfo ::= SEQUENCE {
policyQualifierId PolicyQualifierId,
qualifier ANY DEFINED BY policyQualifierId }
-- policyQualifierIds for Internet policy qualifiers
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
id-qt-acps OBJECT IDENTIFIER ::= { id-qt 4 }
id-qt-acunotice OBJECT IDENTIFIER ::= { id-qt 5 }
id-qt-acps OBJECT IDENTIFIER ::= { iso(1)
identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) id-pkix(7) id-qt(2) 4 }
id-qt-acunotice OBJECT IDENTIFIER ::= { iso(1)
identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) id-pkix(7) id-qt(2) 5 }
PolicyQualifierId ::=
OBJECT IDENTIFIER ( id-qt-acps | id-qt-acunotice )
-- ACPS pointer qualifier
ACPSuri ::= IA5String
-- ACP statement user notice qualifier
ACUserNotice ::= UserNotice
-- UserNotice is defined in [RFC3280]To promote interoperability, this document RECOMMENDS that policy information terms consist of only an object identifier (OID) 🍓 When more than one policy is used, the policy requirements have to be non-conflicting. For example, one policy may refine the general requirements mandated by another policy 🧚
The extension in this spec supports two policy qualifier types for use by ACP writers and AAs: the ACPS Pointer and the AC User 💫
2.1.1. Notice Qualifiers 🦋
The ACPS Pointer qualifier contains a pointer to an Attribute Certification Practice Statement (ACPS) published by the AA. The pointer is a URI. How the processing works for this qualifier is a local matter 🌈
The AC User Notice is meant to be displayed to a relying party when an attribute certificate is used. The application software SHOULD display the AC User Notice of the AC 👑 The AC User Notice is defined in [RFC3280]. It has two optional fields: the noticeRef field and the explicitText field.
The noticeRef field, if used, names an organization and identifies, by number, a particular textual statement that organization prepared. For example, it might identify the organization's name and notice number 1. In a typical implementation, the application software has a notice file with the current set of notices for the AA. The application pulls the notice text out of that file and displays it. Messages MAY be multilingual, so the software can pick the right language for its own environment 🌸
The explicitText field includes the textual statement directly in the certificate. It's a string with a maximum size of 200 characters ✨
If both the noticeRef and explicitText options are included in the one qualifier, and the application software can locate the notice text indicated by the noticeRef option, then that text SHOULD be displayed. Otherwise, the explicitText string SHOULD be displayed 💖
2.2. Attribute Certificate Policies 🌸
The scope of this document is NOT defining the detailed content of ACPs themselves. That's why specific policies aren't defined in this document 🙌
3. Security Considerations 🔐✨
okay bestie, this section is SERIOUS but also kind of iconic, so let's get into it 💅 The ACP in this document applies to all the attributes inside one AC. AAs SHALL make sure the ACP covers every attribute in the ACs they issue, no exceptions 🫶
Attributes can get grouped together into several ACs, and it's giving multi-policy energy. Since an AC might be issued under more than one ACP, the attributes in that AC MUST be compliant with every ACP that the AC is issued under 🎀
When a relying party is verifying an AC, it MUST first figure out that the AC came from a trusted AA, and THEN check that it has the right policy. Order matters, periodt 💀
If an AA doesn't protect its private keys, an attacker can pretend to be that AA 😭 That means bogus ACs and fake revocation status could show up, and once people see fake stuff, trust in the whole system goes down the drain 🌊 If a compromise is detected, the AA's certificate MUST be revoked. No debate.
Rebuilding after a compromise is painful, so AAs are advised to combine strong technical measures (like tamper-resistant cryptographic modules) with solid management procedures (like separation of duties) so this never happens in the first place 🛡️
Losing an AA's private signing key is also a big mess 🥺 Without it, the AA can't produce revocation status or do AC renewal. (Renewal, in case you forgot, means issuing a new AC with the same attributes, same values, same holder, same AA, but a different validity period 📅) So AC issuers are advised to keep secure backups of their signing keys 🔑 And the security of those backup procedures is a critical factor in avoiding key compromise. Yikes.
Revocation status matters a lot for long-lived ACs 🦋 Those ACs do expire naturally, but stuff can happen during their lifetime that breaks the link between the AC holder and the attributes. If revocation status is late or missing, the confidence you can place in that binding drops, clearly 📉
The binding between an AC holder and attributes can't be stronger than the crypto module and the algorithms used to make the signature. Short key lengths or weak hash algorithms make the AC less useful 🙅♀️ AAs are encouraged to keep up with advances in cryptology so they can use strong techniques 🧠✨
Now the spicy one 🌶️ If an AC is tied to the holder's PKC using the baseCertificateID component of the Holder field, and the PKI has a rogue CA with the same issuer name, that rogue CA could issue a PKC to a bad actor using the same issuer name and serial number as the real holder's PKC. The bad actor could then use that PKC together with the AC. This scenario SHOULD be avoided by managing and configuring the PKI so that there cannot be two CAs with the same name 🙈 Another option is to tie ACs to PKCs using the publicKeyCert type in the ObjectDigestInfo field. If neither of those is possible, AC verifiers have to establish, using other means, that the potential collisions cannot actually happen. For example, the Certificate Policy Statements (CPSs) of the CAs involved may make it clear that no such name collisions can occur 📜
Implementers MUST make sure that, after validating an AC, only attributes the issuer is trusted to issue are used in authorization decisions. Other attributes, which MAY be present, MUST be ignored 🚫 AC verifiers SHALL support a means of being provided with this information. The AA controls PKC extension (see [RFC3281]) is one possibility, but it is optional to implement. Configuration information is a likely alternative, and out-of-band means is another. This becomes super important if an AC verification application trusts more than one AC issuer 👑
4. IANA Considerations 🌸
The AC policies extension is identified by an object identifier (OID). The OID for the AC policies extension defined in this document was assigned from an arc delegated by the IANA to the PKIX Working Group 🧚
No further action by the IANA is necessary for this document. Easy peasy 💖
5. References 📚
5.1. Normative References
[X.660|ISO9834-1] ITU-T Recommendation X.660 (1992) | ISO/IEC 9834-1:
1993, Information technology - Open Systems
Interconnection Procedures for the operation of OSI
Registration Authorities: General procedures.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3280] Housley, R., Polk, W., Ford, W., and D. Solo,
"Internet X.509 Public Key Infrastructure
Certificate and Certificate Revocation List (CRL)
Profile", RFC 3280, April 2002.
[RFC3281] Farrell, S. and R. Housley, "An Internet Attribute
Certificate Profile for Authorization", RFC 3281,
April 2002.
[ASN1] X.680 - X.693 | ISO/IEC 8824: 1-4 Abstract Syntax
Notation One (ASN.1).5.2. Informative Reference
[X.509] ITU-T Recommendation X.509 (2000): Information
Technology Open Systems Interconnections - The
Directory: Public-key and Attribute Frameworks,
March 2000.Appendix A. ASN.1 Definitions 🧩
This appendix is normative. (Yes, the code is law here 📖)
ASN.1 Module
AcPolicies { iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-ac-policies(26) }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
-- EXPORTS ALL --
IMPORTS
-- Imports from RFC 3280 [RFC3280], Appendix A
UserNotice
FROM PKIX1Implicit88 { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) 19 }
id-pkix, id-pe
FROM PKIX1Explicit88 { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) 18 };
-- Locally defined OIDs
-- policyQualifierIds for Internet policy qualifiers
id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
id-qt-acps OBJECT IDENTIFIER ::= { id-qt 4 }
id-qt-acunotice OBJECT IDENTIFIER ::= { id-qt 5 }
-- Attributes
id-pe-acPolicies OBJECT IDENTIFIER ::= { id-pe 15 }
AcPoliciesSyntax ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
PolicyInformation ::= SEQUENCE {
policyIdentifier AcPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL }
AcPolicyId ::= OBJECT IDENTIFIER
PolicyQualifierInfo ::= SEQUENCE {
policyQualifierId PolicyQualifierId,
qualifier ANY DEFINED BY policyQualifierId }
PolicyQualifierId ::=
OBJECT IDENTIFIER ( id-qt-acps | id-qt-acunotice )
-- ACPS pointer qualifier
ACPSuri ::= IA5String
-- ACP statement user notice qualifier
ACUserNotice ::= UserNotice
-- UserNotice is defined in [RFC3280]
ENDAuthors' Addresses 🦋
Christopher S. Francis
Raytheon
1501 72nd Street North, MS 25
St. Petersburg, Florida 33764
EMail: Chris_S_Francis@Raytheon.com
Denis Pinkas
Bull
Rue Jean Jaures
78340 Les Clayes-sous-Bois
FRANCE
EMail: Denis.Pinkas@bull.netFull Copyright Statement ©️
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔒
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 💜
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA).
📦 where this page comes from
- ietf: rfc4476 2006-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms