RFC 5409

Using the Boneh-Franklin and Boneh-Boyen Identity-Based Encryption Algorithms with the Cryptographic Message Syntax (CMS)

📅 published January 2009, from ietf

Using the Boneh-Franklin and Boneh-Boyen Identity-Based Encryption Algorithms with the Cryptographic Message Syntax (CMS) 🎀

Okay bestie, let's start with the basics 🦋 This is RFC 5409, from the Network Working Group, dated January 2009. The authors are L. Martin (Voltage Security) and M. Schertler (Axway). It's Informational, which means it's sharing knowledge, not setting an official standard. Also, the header doesn't list it as obsoleting or updating any other RFC, so it's a solo queen 👑

Status of This Memo ✨

This memo gives info to the Internet community. It is not an Internet standard of any kind, and anyone can share it freely 💅

Copyright Notice 🌸

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were on the date it was published. Read those carefully, because they spell out your rights and restrictions for this document 📜

Abstract 🧚

This doc explains how to use the Boneh-Franklin (BF) and Boneh-Boyen (BB1) identity-based encryption algorithms inside the Cryptographic Message Syntax (CMS), so you can encrypt content-encryption keys. It also defines the object identifiers and the way you encode a recipient's identity 🔐

Table of Contents 📖

1. Introduction ....................................................2
   1.1. Terminology ................................................3
   1.2. IBE Overview ...............................................3
2. Using Identity-Based Encryption .................................3
3. Key Encryption Algorithm Identifiers ............................6
4. Processing by the Sender ........................................7
5. Processing by the Receiver ......................................7
6. ASN.1 Module ....................................................8
7. Security Considerations .........................................9
   7.1. Attacks outside the Scope of This Document .................9
   7.2. Attacks within the Scope of This Document .................10
   7.3. Attacks to Which the Protocols Defined in This Document
        Are Susceptible............................................11
8. References .....................................................12
   8.1. Normative References ......................................12
   8.2. Informative References ....................................12

1. Introduction 💖

Okay so this doc defines how to use the Boneh-Franklin [IBCS] and Boneh-Boyen [IBCS] identity-based encryption (IBE) public-key algorithms inside the Cryptographic Message Syntax (CMS) [CMS]. IBE is a public-key tech for encrypting content-encryption keys (CEKs), and it fits right into the CMS framework. The recipient's identity gets stored in the EnvelopedData CMS content type, using the OtherRecipientInfo CHOICE in the RecipientInfo field, as defined in Section 6.2.5 of [CMS]. This doc does not cover how the BF and BB1 algorithms work internally. Those details live in [IBCS] 🧠

IBE is giving "the public key comes from your identity" energy. Instead of making a random key, the public key is calculated straight from a user's identity 🫶 Because of that, encryption and decryption need different steps than other public-key algorithms. Those steps are in Section 4 (encryption) and Section 5 (decryption) of this document 🔥

This doc also defines the object identifiers and the syntax for the object that identifies a message recipient 🌈

CMS values and identity objects are defined using ASN.1 [ASN1] 🎀

1.1. Terminology 💅

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [KEYWORDS] ✨

1.2. IBE Overview 🦋

Besides the client parts described in this document, you also need these extra components for a complete IBE messaging system:

A Private-Key Generator (PKG) 🔑 The PKG holds the cryptographic material called a master secret, which it uses to generate an individual's IBE private key. A PKG takes an IBE user's private key request and, once it has authenticated them somehow, sends back their IBE private key.
A Public Parameter Server (PPS) 🌸 IBE system parameters include publicly shareable cryptographic material, called IBE public parameters, plus policy info for the PKG. The PPS is the well-known place where those public parameters and the policy info for the IBE PKG get distributed.

Senders and receivers of IBE-encrypted messages are described in [IBE]. All communication between IBE system users and the PPS or PKG MUST be protected using TLS [TLS], as described in [IBE]. That gives confidentiality and integrity for everything delivered to users, plus authentication of the PPS and PKG 🔐

2. Using Identity-Based Encryption 🍓

To use IBE, the ori field in RecipientInfo MUST be used. Set the fields like this: oriType gets ibeORIType, and oriValue gets ibeORIValue 💖

Here's what those fields mean:

ibeORIType is the object identifier (OID) that tells you the subsequent ibeORIValue holds the info needed to decrypt the message using IBE. This field MUST be set to the following:

ibeORIType OBJECT IDENTIFIER ::= {
  joint-iso-itu(2) country(16) us(840)
  organization(1) identicrypt(114334)
  ibcs(1) cms(4) ori-oid(1) version(1)
}

ibeORIValue is the identity that was used in the IBE algorithm to encrypt the CEK. It's an IBERecipientInfo type, defined like this:

IBERecipientInfo ::= SEQUENCE {
  cmsVersion         INTEGER { v3(3) },
  keyFetchMethod     OBJECT IDENTIFIER,
  recipientIdentity  IBEIdentityInfo,
  serverInfo         SEQUENCE SIZE (1..MAX) OF
    OIDValuePairs OPTIONAL,
  encryptedKey       EncryptedKey
}

The fields of IBERecipientInfo MUST be set as follows 📝

The cmsVersion MUST be set to 3 🧁

The keyFetchMethod is the OID that defines how the recipient MUST get their private key. This SHOULD be set to uriPPSOID [IBE], which is defined as:

uriPPSOID OBJECT IDENTIFIER ::= {
  joint-iso-itu-t(2) country(16) us(840)
  organization(1) identicrypt(114334)
  pps-schemas(3) ic-schemas(1) pps-uri(1) version(1)
}

The recipientIdentity is the data the sender used to calculate the IBE public key that encrypts the content-encryption key. It's used to calculate the IBE public and private keys, as described in [IBCS]. This MUST be a DER-encoded [DER] IBEIdentityInfo type [IBE], defined as:

IBEIdentityInfo ::= SEQUENCE {
  district        IA5String,
  serial          INTEGER,
  identityType    OBJECT IDENTIFIER,
  identityData    OCTET STRING
}

identityType defines the format used to encode the info that identifies the recipient. This MUST be set to cmsIdentityOID, to show that identityData holds an EmailIdentityData type. The value of cmsIdentityOID is:

cmsIdentityOID OBJECT IDENTIFIER ::= {
  joint-iso-itu-t(2) country(16) us(840)
  organization(1) identicrypt(114334)
  keyschemas(2) icschemas(1) email(1) version(1)
}

identityData MUST be an EmailIdentityData type, defined as:

EmailIdentityData ::= SEQUENCE {
  rfc822Name   IA5String,
  time         GeneralizedTime
}

The rfc822Name field is the recipient's email address, in the format defined in Section 4.2.1.6 of [PKIX] for the rfc822Name subjectAltName variant. The rules for encoding Internet mail addresses with internationalized domain names are in Section 7.5 of [PKIX] 📬

The time field is the UTC time after which the sender lets the recipient decrypt the message, so it can also be called the "not-before" time. It's usually the time the message gets encrypted, but it MAY be set to a future time ⏰ The value of "time" MUST be expressed in Greenwich Mean Time (Zulu), MUST include seconds (so times are always YYYYMMDDHHMMSSZ, even when the seconds are zero), and MUST be expressed to the nearest second.

Senders might want to round this time to a time interval to create a key lifetime. A key lifetime cuts down how many IBE private keys a recipient has to fetch, but it still makes the IBE user re-authenticate every so often. Based on the interval you pick, a recipient only needs to grab a new IBE key once per interval. To do that, follow these steps, where "time-interval" is the number of seconds in that larger interval:

Find the GeneralizedTime for the not-before value.
Convert this GeneralizedTime into the number of seconds since January 1, 1970. Call this "total-time".
Calculate reduced-time = (floor (total-time / time-interval)) * time-interval.
Convert reduced-time to a GeneralizedTime to get the not-before "time" value.

Here's an example of this algorithm for a one-week time interval 🗓️

Say the GeneralizedTime is 20020401000000Z.
Then the total-time is 1017612000.
A time-interval of 1 week is 604800 seconds. So reduced-time = (floor (1017612000 / 604800)) * 604800 = 1017273600.
That gives the GeneralizedTime form of the reduced-time as 20020328000000Z.

When a PKG issues IBE private keys, it SHOULD NOT issue them too far into the future. This is to stop an adversary who gets an IBE user's authentication credentials from requesting private keys far ahead and cancelling out the periodic re-authentication that key lifetime provides 🚨 For example, if you pick a one-week key lifetime, IBE private keys should not be issued more than one week in advance. Otherwise, once an adversary gets into the PKG with stolen IBE user credentials, they can request every future key and bypass the IBE user authentication restraints that are in place 💀

The serverInfo is an optional sequence of OID-value pairs, defined as:

OIDValuePairs ::= SEQUENCE {
  fieldID     OBJECT IDENTIFIER,
  fieldData   OCTET STRING
}

These can carry any other info a PKG might use. Examples could be the user interface the recipient will see, including localization or commercial branding details that change how the UI looks 🌈 A client MUST ignore any part of serverInfo that it is unable to process 🙈

The encryptedKey is the result of encrypting the CEK with an IBE algorithm, using recipientIdentity as the IBE public key 🦋

3. Key Encryption Algorithm Identifiers ✨

okay so the BF and BB1 algorithms from [IBCS] each get their own object identifier 🦋 and these same OIDs also live in the ASN.1 module in [IBCS], so you'll see them in both places bestie 💅

bf OBJECT IDENTIFIER ::= {
  joint-iso-itu-t(2) country(16) us(840)
  organization(1) identicrypt(114334)
  ibcs(1) ibcs1(1) ibe-algorithms(2) bf(1)
}

this is the OID that MUST be inserted in the keyEncryptionAlgorithm field in the CMS when the BF algorithm is used to encrypt the CEK 🎀

bb1 OBJECT IDENTIFIER ::= {
  joint-iso-itu-t(2) country(16) us(840)
  organization(1) identicrypt(114334)
  ibcs(1) ibcs1(1) ibe-algorithms(2) bb1(2)
}

and this is the OID that MUST be inserted in the keyEncryptionAlgorithm field in the CMS when the BB1 algorithm is used to encrypt the CEK 🌸

4. Processing by the Sender 💖

the sender of a message that uses IBE to encrypt content-encryption keys goes through these steps, no skipping 👑

Selects a set of IBE public parameters to use in the subsequent steps in accordance with their local security policy. Then they figure out the URI where the public parameters can be obtained, using the process in [IBE]. This information MUST be encoded in the IBEIdentityInfo as described in Section 2 🧚
Sets the fields of an OtherRecipientInfo object to their appropriate values as described in Section 2 ✨
Calculates an IBE public key as defined in [IBCS] using this IBEIdentityInfo as the identity information 🔥
This IBE public key is then used to encrypt the content-encryption key (CEK), using the algorithms defined in [IBCS] 🫶
Sets encryptedKey to the IBE-encrypted CEK 💜
Within the CMS, keyEncryptionAlgorithm MUST then be set to the appropriate OID for the IBE algorithm that was used (see Section 3) 💅

5. Processing by the Receiver 🦋

okay now the receiving side. when a message comes in with a CEK encrypted with IBE, the recipient runs through these steps to decrypt it 😭

Determines that the CEK is IBE-encrypted by noting that the oriType of the OtherRecipientInfo type is set to ibeORIType 🌈
Determines that the recipientIdentity was used as the identity in IBE encryption of the CEK 🍓
Determines the location of the IBE public parameters and the IBE Private Key Generator as described in [IBE] ⭐
Obtains the IBE public parameters from the location determined in Step 3 using the process defined in [IBE] 🌸
Obtains the IBE private key needed to decrypt the encrypted CEK using the process defined in [IBE] 💖
Decrypts the CEK using the IBE private key obtained in Step 4 using the algorithms described in [IBCS] 🎀

6. ASN.1 Module 🧚

this is the ASN.1 module that summarizes all the ASN.1 definitions in this document, so bookmark it bestie 🔖✨

IBECMS-module {
  joint-iso-itu-t(2) country(16) us(840)
  organization(1) identicrypt(114334)
  ibcs(1) cms(4) module(5) version(1)
}

DEFINITIONS IMPLICIT TAGS ::= BEGIN

IMPORTS IBEIdentityInfo, uriPPSOID FROM

  IBEARCH-module { joint-iso-itu-t(2) country(16)
    us(840) organization(1) identicrypt(114334) ibcs(1)
    ibearch(5) module(5) version(1)
  };

IBEOtherRecipientInfo ::= SEQUENCE {
  oriType   OBJECT IDENTIFIER,
  oriValue  IBERecipientInfo
}
ibeORIType OBJECT IDENTIFIER ::= {
  joint-iso-itu-t(2) country(16) us(840)
  organization(1) identicrypt(114334)
  ibcs(1) cms(4) ori-oid(1) version(1)
}

IBERecipientInfo ::= SEQUENCE {
  cmsVersion         INTEGER { v3(3) },
  keyFetchMethod     OBJECT IDENTIFIER,
  recipientIdentity  IBEIdentityInfo,
  serverInfo         SEQUENCE SIZE (1..MAX) OF
    OIDValuePairs OPTIONAL,
  encryptedKey       EncryptedKey
}


OIDValuePairs ::= SEQUENCE {
  fieldID     OBJECT IDENTIFIER,
  fieldData   OCTET STRING
}

EncryptedKey ::= OCTET STRING

EmailIdentityData ::= SEQUENCE {
  rfc822Name   IA5String,
  time         GeneralizedTime
}

cmsIdentityOID OBJECT IDENTIFIER ::= {
  joint-iso-itu-t(2) country(16) us(840)
  organization(1) identicrypt(114334)
  keyschemas(2) icschemas(1) email(1) version(1)
}

END

7. Security Considerations 🔐

okay this part is SERIOUS bestie, so read it carefully 😭🔥

This document is based on [CMS], [IBCS], and [IBE], and the relevant security considerations of those documents apply 💅

7.1. Attacks outside the Scope of This Document 🙈

attacks on the cryptographic algorithms used to implement IBE are outside the scope of this document. those attacks are covered in [IBCS], which defines parameters giving 80-bit, 112-bit, 128-bit, and 256-bit encryption strength. we assume capable administrators of an IBE system will pick parameters with sufficient resistance to cryptanalytic attacks by adversaries 🛡️

attacks that let an adversary access or change the information on a PPS or PKG, especially the cryptographic material (called the master secret in this document), will defeat the security of an IBE system 💀 if that cryptographic material gets compromised, the adversary can recreate any user's private key and therefore decrypt all messages protected with the corresponding public key. so to address this, it is highly RECOMMENDED that best practices for physical and operational security for PPS and PKG servers be followed, and that these servers be configured (sometimes called hardened) in accordance with best current practices [NIST] 🔒 an IBE system SHOULD be operated in an environment where illicit access to the PKG, or the ability to modify the information distributed by the PPS, is infeasible for attackers to obtain 🚫

attacks that require administrative access or IBE-user-equivalent access to machines used by either the client or server components defined in this document are also outside the scope of this document 🙅

we also assume that all administrators of a system implementing the protocols defined in this document are trustworthy and will not abuse their authority to bypass the security an IBE system provides. this matters a LOT with IBE, because an administrator of a PKG could potentially abuse their authority and configure the PKG to grant them any IBE private key the PKG is capable of calculating 😱 to minimize the chance of that, a system implementing IBE SHOULD implement n-out-of-m control for critical administrative functions, and SHOULD maintain auditable logs of all security-critical events that occur in an operating IBE system 📜

similarly, we assume users of an IBE system will behave responsibly and not share their authentication credentials with others. so attacks that depend on those assumptions are outside the scope of this document 🫠

7.2. Attacks within the Scope of This Document 🎯

attacks within the scope of this document are those that allow an adversary to:

passively monitor information transmitted between users of an IBE system and the PPS and PKG
masquerade as a PPS or PKG
perform a denial-of-service (DoS) attack on a PPS or PKG
easily guess an IBE user's authentication credential

7.3. Attacks to Which the Protocols Defined in This Document Are Susceptible 🥺

all communications between users of an IBE system and the PPS or PKG are protected using TLS [TLS]. the IBE system defined here adds no extra security for communications between IBE users and the PPS or PKG 🙃 so the described IBE system is completely dependent on the TLS security mechanisms for authenticating the PKG or PPS server and for confidentiality and integrity of the communications. if the TLS security mechanisms are ever compromised, the integrity of all communications between an IBE user and the PPS or PKG will be suspect 😬

the protocols defined in this document do not explicitly defend against an attacker masquerading as a legitimate IBE PPS or PKG. they rely on the server authentication mechanism of TLS [TLS]. on top of TLS server authentication, IBE client software can help protect against this by providing user interface capabilities that let users visually check that a connection to the PPS and PKG servers is legitimate 👀 this extra capability can help make sure users can't easily be tricked into handing valid authorization credentials to an attacker 🪤

the protocols defined in this document are also vulnerable to attacks against an IBE PPS or PKG. denial-of-service attacks against either component can leave users unable to encrypt or decrypt using IBE, and users of an IBE system SHOULD take the appropriate countermeasures [DOS, BGPDOS] that their use of IBE requires 🚨

the IBE user authentication method used by an IBE PKG SHOULD be strong enough to stop attackers from easily guessing the IBE user's authentication credentials through trial and error 🔐💅

8. References 📚

8.1. Normative References 💜

[ASN1] ITU-T Recommendation X.680: Information Technology - "Abstract Syntax Notation One (ASN.1): Specification of Basic Notation", July 2002.
[CMS] Housley, R., "Cryptographic Message Syntax (CMS)", RFC 3852, July 2004.
[DER] ITU-T Recommendation X.690: OSI Networking and System Aspects: Abstract Syntax Notation One (ASN.1), July 2002.
[DOS] Ferguson, P. and D. Senie, "Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing", BCP 38, RFC 2827, May 2000.
[IBCS] Boyen, X. and L. Martin, "Identity-Based Cryptography Standard (IBCS) #1: Supersingular Curve Implementations of the BF and BB1 Cryptosystems", RFC 5091, December 2007.
[IBE] Appenzeller, G., Martin, L., and M. Schertler, "Identity-Based Encryption Architecture and Supporting Data Structures", RFC 5408, January 2009.
[KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[PKIX] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008.
[TLS] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008.

8.2. Informative References 🌈

[BGPDOS] Turk, D., "Configuring BGP to Block Denial-of-Service Attacks", RFC 3882, September 2004.
[NIST] M. Souppaya, J. Wack and K. Kent, "Security Configuration Checklist Program for IT Products - Guidance for Checklist Users and Developers", NIST Special Publication SP 800-70, May 2005.

Authors' Addresses 🎀

Luther Martin Voltage Security 1070 Arastradero Rd, Suite 100 Palo Alto, CA 94304 USA

Phone: +1 650 543 1280 EMail: martin@voltage.com

Mark Schertler Axway 1600 Seaport Blvd, Suite 400 Redwood City, CA 94063 USA

Phone: +1 650 216 2039 EMail: mschertler@us.axway.com

📦 where this page comes from

ietf: rfc5409 2009-01
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms