RFC 5756

Updates for RSAES-OAEP and RSASSA-PSS Algorithm Parameters

📅 published January 2010, from ietf

Updates for RSAES-OAEP and RSASSA-PSS Algorithm Parameters ✨

Okay bestie, here's the whole vibe of RFC 5756 🎀 It's a Standards Track doc from January 2010, written by Sean Turner (IECA), Daniel R. L. Brown (Certicom), Kelvin Yiu (Microsoft), Russ Housley (Vigil Security), and Tim Polk (NIST). It's ISSN 2070-1721 and it's giving UPDATES RFC 4055 energy 💖 So RFC 4055 is getting a glow-up, and this doc is the patch notes 🧚

Abstract 🦋

Okay so this one updates RFC 4055 💅 It's about how we use RSAES-OAEP (the key transport algorithm) inside X.509 PKI certificates, and specifically how the algorithm parameters show up in the subjectPublicKeyInfo field of a certificate. Main character energy for certs 👑

Status of This Memo 🌸

This is an Internet Standards Track document. It's a product of the IETF and it represents the consensus of the IETF community 🫶 It got public review and was approved for publication by the IESG. If you want more on Internet Standards, check Section 2 of RFC 5741. Info about its current status, errata, and where to send feedback lives at http://www.rfc-editor.org/info/rfc5756.

Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved 🔥 This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the publication date. Read those carefully, bestie, because they spell out your rights and restrictions 💀 Code Components pulled from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in that license.

This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of that material may not have granted the IETF Trust the right to allow modifications outside the IETF Standards Process. Without an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate it into languages other than English 🙈

1. Introduction ✨

1.1. Conventions Used in This Document 🦋

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].

Okay so RFC 4055 lays out conventions for RSAES-OAEP in X.509 PKI and gives us the algorithm identifiers and parameters for it 🎀 This doc changes how RSAES-OAEP parameters show up in the subjectPublicKeyInfo field of an X.509 certificate. The PKIX WG Elliptic Curve Cryptography (ECC) design team suggested that Key Derivation Functions (KDFs) should not be constrained inside a certificate. Instead, KDF constraints should be negotiated by the protocols that actually use certificates 🧚

Only two paragraphs in [RFC4055] talk about RSAES-OAEP parameters in X.509 certificates: the second paragraph of Section 4 and the first paragraph of Section 4.1. This doc only touches those two 💅 Section 3 updates the second paragraph of Section 4 of [RFC4055], and Section 4 updates the second paragraph of Section 4.1 of [RFC4055]. "Old:" marks the text being replaced and "New:" marks the replacement 🌈

This doc also swaps out the wrong references to the publicKeyAlgorithms field in Section 3 for references to the parameters field in the subjectPublicKeyInfo algorithm field. Section 3 also rewords the second and third paragraphs for clarity ✨

2. Changes to Section 3 (Second and Third Paragraphs) 💖

This change clarifies where RSASSA-PSS-params go in the signature, signatureAlgorithm, and subjectPublicKeyInfo fields for certification authority (CA) and end-entity (EE) certificates 😭 It also clarifies where RSASSA-PSS-params go in the signatureAlgorithm field in certificate revocation lists (CRLs).

Old:

CAs that issue certificates with the id-RSASSA-PSS algorithm
identifier SHOULD require the presence of parameters in the
publicKeyAlgorithms field if the cA boolean flag is set in the basic
constraints certificate extension.  CAs MAY require that the
parameters be present in the publicKeyAlgorithms field for end-entity
certificates.

CAs that use the RSASSA-PSS algorithm for signing certificates SHOULD
include RSASSA-PSS-params in the subjectPublicKeyInfo algorithm
parameters in their own certificates.  CAs that use the RSASSA-PSS
algorithm for signing certificates or CRLs MUST include RSASSA-PSS-
params in the signatureAlgorithm parameters in the TBSCertificate or
TBSCertList structures.

New:

When the id-RSASSA-PSS object identifier appears in the
TBSCertificate or TBSCertList signature algorithm field, then the
RSASSA-PSS-params structure MUST be included in the TBSCertificate or
TBSCertList signature parameters field.

When the id-RSASSA-PSS object identifier appears in the
TBSCertificate subjectPublicKeyInfo algorithm field of CA
certificates, then the parameters field SHOULD include the RSASSA-
PSS-params structure.  When the id-RSASSA-PSS object identifier
appears in the TBSCertificate subjectPublicKeyInfo algorithm field of
EE certificates, then the parameters field MAY include the RSASSA-
PSS-params structure.

All certificates and CRLs signed by a CA that supports the id-RSASSA-
PSS algorithm MUST include the RSASSA-PSS-params in the
signatureAlgorithm parameters in Certificate and CertList structures,
respectively.

3. Changes to Section 4 (Second Paragraph) 🌸

This change bans RSAES-OAEP-params from the subjectPublicKeyInfo field 🙈 Why? Because a) it doesn't affect interoperability and b) it lines up with PKIX practice of not putting limits on how the public key can be used in subjectPublicKeyInfo. A poll of implementers happened and nobody objected, since it didn't affect current implementations 🫶

Old:

CAs that issue certificates with the id-RSAES-OAEP algorithm
identifier SHOULD require the presence of parameters in the
publicKeyAlgorithms field for all certificates.  Entities that use a
certificate with a publicKeyAlgorithm value of id-RSA-OAEP where the
parameters are absent SHOULD use the default set of parameters for
RSAES-OAEP-params.  Entities that use a certificate with a
publicKeyAlgorithm value of rsaEncryption SHOULD use the default set
of parameters for RSAES-OAEP-params.

New:

CAs that issue certificates with the id-RSAES-OAEP algorithm
identifier MUST NOT include parameters in the subjectPublicKeyInfo
algorithm field.

4. Changes to Section 4.1 (First Paragraph) 🦋

This change bans parameters from the subjectPublicKeyInfo field 💅 Same reasons as before: a) no interoperability hit and b) it matches PKIX practice of not limiting how the public key gets used in subjectPublicKeyInfo. Implementers were polled and there were no objections, because current implementations weren't affected 👑

Old:

When id-RSAES-OAEP is used in an AlgorithmIdentifier, the parameters
MUST employ the RSAES-OAEP-params syntax.  The parameters may be
either absent or present when used as subject public key information.

The parameters MUST be present when used in the algorithm identifier
associated with an encrypted value.

New:

When id-RSAES-OAEP is used in an AlgorithmIdentifier, the parameters
MUST employ the RSAES-OAEP-params syntax.  The parameters MUST be
absent when used in the subjectPublicKeyInfo field.  The parameters
MUST be present when used in the algorithm identifier associated with
an encrypted value.

5. Security Considerations 🔥

The security considerations from [RFC4055] apply. 💀

Okay this part is serious, so listen up 🙈 If the RSAES-OAEP-params are negotiated, then the negotiation mechanism needs to provide integrity for these parameters. For example, an S/MIME Agent can advertise their capabilities in the SMIMECapabilities attribute, which is either a signed attribute [RFC5751] or a certificate extension [RFC4262] 🔒✨

6. References 🧚

6.1. Normative References 💜

[RFC2119]     Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC4055]     Schaad, J., Kaliski, B., and R. Housley, "Additional
              Algorithms and Identifiers for RSA Cryptography for use
              in the Internet X.509 Public Key Infrastructure
              Certificate and Certificate Revocation List (CRL)
              Profile", RFC 4055, June 2005.

6.2. Informative References 🌈

[RFC4262]     Santesson, S., "X.509 Certificate Extension for
              Secure/Multipurpose Internet Mail Extensions (S/MIME)
              Capabilities", RFC 4262, December 2005.

[RFC5751]     Ramsdell, B. and S. Turner, "Secure/Multipurpose
              Internet Mail Extensions (S/MIME) Version 3.2 Message
              Specification", RFC 5751, January 2010.

Authors' Addresses 🎀

Sean Turner IECA, Inc. 3057 Nutley Street, Suite 106 Fairfax, VA 22031 USA

EMail: turners@ieca.com

Kelvin Yiu Microsoft One Microsoft Way Redmond, WA 98052-6399 USA

EMail: kelviny@microsoft.com

Daniel R. L. Brown Certicom Corp 5520 Explorer Drive #400 Mississauga, ON L4W 5L1 CANADA

EMail: dbrown@certicom.com

Russ Housley Vigil Security, LLC 918 Spring Knoll Drive Herndon, VA 20170 USA

EMail: housley@vigilsec.com

Tim Polk NIST Building 820, Room 426 Gaithersburg, MD 20899 USA

EMail: wpolk@nist.gov

📦 where this page comes from

ietf: rfc5756 2010-01
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms