RFC 5081

Using OpenPGP Keys for Transport Layer Security (TLS) Authentication

📅 published November 2007, from ietf

RFC 5081 🎀 Using OpenPGP Keys for Transport Layer Security (TLS) Authentication

Network Working Group 🌸 Author: N. Mavrogiannopoulos (Independent) 💅 Category: Experimental 🧪 · Date: November 2007 📅 Obsoletes / Updates: the title block doesn't list any RFCs it obsoletes or updates 🙈

Status of This Memo

okay so this memo is an Experimental protocol for the Internet community 🧪. it is NOT an Internet standard of any kind, so chill 😌. they're literally asking for feedback and suggestions to make it better, and distribution is unlimited 💜.

Abstract

this memo is basically a glow-up for TLS 💖 it proposes extensions so TLS can use the OpenPGP key format ✨. the extensions include a certificate type negotiation mechanism and the required modifications to the TLS Handshake Protocol 🦋.

Table of Contents

1. Introduction ....................................................2
2. Terminology .....................................................2
3. Changes to the Handshake Message Contents .......................2
   3.1. Client Hello ...............................................2
   3.2. Server Hello ...............................................3
   3.3. Server Certificate .........................................3
   3.4. Certificate Request ........................................4
   3.5. Client Certificate .........................................5
   3.6. Other Handshake Messages ...................................5
4. Security Considerations .........................................5
5. IANA Considerations .............................................6
6. Acknowledgements ................................................6
7. References ......................................................6
   7.1. Normative References .......................................6
   7.2. Informative References .....................................7

1. Introduction ✨

okay bestie, so the IETF has two sets of standards for public key certificates 🔑. one set is for X.509 certificates [PKIX] and the other is for OpenPGP certificates [OpenPGP] 💅. at the time of writing, TLS [TLS] standards only use X.509 certificates 🙃. this doc is all about negotiating OpenPGP certificates for a TLS session, and it explains how to send OpenPGP certificates over TLS 🎀. the best part? the extensions are backward compatible with the current TLS spec 🫶, so existing client and server implementations that use X.509 certificates are not affected at all 😭✨.

2. Terminology 🧚

the term "OpenPGP key" is used here the same way the OpenPGP specification [OpenPGP] uses it 📖. we say "OpenPGP certificate" when we mean OpenPGP keys that are enabled for authentication 🔐.

this document uses the same notation and terminology as the TLS Protocol specification [TLS] 💜.

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🌈.

3. Changes to the Handshake Message Contents 🤝

this section is the tea ☕ on what changes in the TLS handshake message contents when OpenPGP certificates are used for authentication.

3.1. Client Hello 👋

so to show that it supports multiple certificate types, a client MUST include an extension of type "cert_type" (see Section 5) in the extended client hello message 🙌. the hello extension mechanism is described in [TLSEXT] 📎.

this extension carries a list of the certificate types the client can use, sorted by client preference 📋. this extension MUST be omitted if the client only supports X.509 certificates 🙅‍♀️. the "extension_data" field of this extension contains a CertificateTypeExtension structure 🧩. here's the vibe check:

   enum { client, server } ClientOrServerExtension;

   enum { X.509(0), OpenPGP(1), (255) } CertificateType;

   struct {
      select(ClientOrServerExtension) {
         case client:
            CertificateType certificate_types<1..2^8-1>;
         case server:
            CertificateType certificate_type;
      }
   } CertificateTypeExtension;

no new cipher suites are required to use OpenPGP certificates 🥳. all the existing cipher suites that support a key exchange method compatible with the key can be used together with OpenPGP certificates 💖.

3.2. Server Hello 🦋

if the server gets a client hello that has the "cert_type" extension, and it picks a cipher suite that needs a certificate, there are two outcomes 👀. the server MUST either select a certificate type from the certificate_types field in the extended client hello, or end the connection with a fatal alert of type unsupported_certificate 💀.

the certificate type the server picks is encoded in a CertificateTypeExtension structure, and that goes into the extended server hello message using an extension of type "cert_type" 🎀. servers that only support X.509 certificates MAY leave out the "cert_type" extension in the extended server hello 🌸.

3.3. Server Certificate 🧾

the stuff inside the certificate message sent from server to client (and the other way around) depends on the negotiated certificate type and the key exchange algorithm of the selected cipher suite ✨.

if the OpenPGP certificate type is negotiated, then it is required to present an OpenPGP certificate in the certificate message 🔏. the certificate must contain a public key that matches the selected key exchange algorithm, as the table below shows 👇:

   Key Exchange Algorithm  OpenPGP Certificate Type

   RSA                     RSA public key that can be used for
                           encryption.

   DHE_DSS                 DSS public key that can be used for
                           authentication.

   DHE_RSA                 RSA public key that can be used for
                           authentication.

an OpenPGP certificate in the certificate message is sent using the binary OpenPGP format 💾. the certificate MUST contain all the elements required by Section 11.1 of [OpenPGP] 🫡.

you're also allowed to send an OpenPGP fingerprint instead of the whole certificate 🪄. the process of fingerprint generation is described in Section 12.2 of [OpenPGP] 📖. the peer shall respond with a certificate_unobtainable fatal alert if the certificate with the given fingerprint can't be found 😬. the certificate_unobtainable fatal alert is defined in Section 4 of [TLSEXT] 📎.

here's the grammar for all of that 🧩:

   enum {
        cert_fingerprint (0), cert (1), (255)
   } OpenPGPCertDescriptorType;

   opaque OpenPGPCertFingerprint<16..20>;

   opaque OpenPGPCert<0..2^24-1>;

   struct {
        OpenPGPCertDescriptorType descriptorType;
        select (descriptorType) {
             case cert_fingerprint: OpenPGPCertFingerprint;
             case cert: OpenPGPCert;
        }
   } Certificate;

3.4. Certificate Request 📮

the semantics of this message stay the same as in the TLS spec 🙆‍♀️. BUT, if this message is sent and the negotiated certificate type is OpenPGP, the "certificate_authorities" list MUST be empty 🚫.

3.5. Client Certificate 🙋‍♀️

this message is only sent in response to the certificate request message 🔁. the client certificate message uses the same formatting as the server certificate message, and it is also required to present a certificate that matches the negotiated certificate type 📜. if OpenPGP certificates were selected and the client has no certificate available, then a certificate structure containing an empty OpenPGPCert vector MUST be sent 🫳. the server SHOULD respond with a "handshake_failure" fatal alert if client authentication is required 😤.

3.6. Other Handshake Messages 🌈

all the other handshake messages are identical to the TLS spec, so nothing new to see there ✨.

more coming in part 2, including the Security Considerations, IANA Considerations, Acknowledgements, and References 🧚💜

Author's Address 💖

okay bestie, here's where you can find our author 🧚 Nikos Mavrogiannopoulos is Independent (no company, just skills 💅) and lives in Halandri, Attiki, Greece. Here's the exact address:

Nikos Mavrogiannopoulos
Independent
Arkadias 8
Halandri, Attiki  15234
Greece

EMail: nmav@gnutls.org
URI:   http://www.gnutls.org/

the legal bit, and it matters ngl 🫶 the copyright is owned by Copyright (C) The IETF Trust (2007). this document is covered by the rights, licenses and restrictions in BCP 78. except for what BCP 78 says, the authors keep all their own rights 💜

the document and everything in it is handed over on an "AS IS" basis. the contributor, the organization they represent or are sponsored by (if any), the Internet Society, the IETF Trust, and the Internet Engineering Task Force all say no warranties 🙈 that's express or implied, including no promise that using the info won't infringe any rights, and no implied promise of merchantability or fitness for a particular purpose. literally no guarantees, so keep that in mind 💀

Intellectual Property 🦋

the IETF doesn't take a position on whether any Intellectual Property Rights (or other rights someone might claim) are valid or how far they reach, and it doesn't say whether licenses for them are available. it also doesn't claim to have searched for those rights on its own 🔍 if you want to learn how rights work for RFC documents, check BCP 78 and BCP 79.

copies of IPR disclosures sent to the IETF Secretariat, any assurances that licenses will be available, and the results of any attempt to get a general license or permission for implementers or users of this spec can be found in the IETF's online IPR repository at http://www.ietf.org/ipr 🌸

and the IETF invites anyone who's interested to flag any copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard. send that info to the IETF at ietf-ipr@ietf.org 🧚✨

📦 where this page comes from