RFC 5916

Device Owner Attribute

📅 published June 2010, from ietf

RFC 5916: Device Owner Attribute 💖

okay bestie, so this one is an Informational RFC from June 2010 🦋 It was written by Sean Turner at IECA, and it's published under ISSN 2070-1721. The header doesn't list anything it obsoletes or updates, so it's just doing its own thing 💅

Abstract

okay so this doc defines the Device Owner attribute 🎀 It says which entity (like a company, org, department, or agency) owns a device. This attribute can go inside public key certificates and attribute certificates ✨

Status of This Memo

ngl this is not a standards track spec, it's just published for info 🌸

this is a product of the IETF, so it reflects the consensus of the IETF community. it got public review and was approved for publication by the IESG. not every IESG-approved doc is on track to become any level of Internet Standard, so check Section 2 of RFC 5741 if you're curious 🧚

you can find the current status, errata, and how to send feedback at http://www.rfc-editor.org/info/rfc5916 💜

Copyright Notice

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. please actually read those, they spell out your rights and restrictions for this doc 🫶

if you pull Code Components out of this doc, they have to include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. they come with no warranty, as the Simplified BSD License describes 💅

1. Introduction ✨

okay so this doc specifies the Device Owner attribute 🎀 It names the entity (company, org, department, agency, etc.) that owns the device. It's meant to live in public key certificates [RFC5280] and attribute certificates [RFC5755] 💖

this attribute can be used in automated authorization decisions 🔥 for example, when two peers are deciding whether to talk to each other, each one could check that the device owner in the other device's certificate is on an "approved" list. that check happens on top of certification path validation [RFC5280] 🦋 how the "approved" list gets managed is totally out of scope for this doc 🙈

NOTE: this doc does not give an equivalent Lightweight Directory Access Protocol (LDAP) schema. the attribute is aimed at public key certificates [RFC5280] and attribute certificates [RFC5755], and an LDAP schema is left for a future spec 👑

1.1. Terminology

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this doc are to be read as described in [RFC2119] ✨

1.2. ASN.1 Syntax Notation

the attribute is defined using ASN.1 [X.680], [X.681], [X.682], and [X.683] 🧚

2. Device Owner 🌸

the Device Owner attribute says which entity (company, org, department, agency) owns the device this attribute is attached to 💅 Device Owner is an object identifier, aka an OID 💖

this OID identifies the Device Owner attribute:

   id-deviceOwner OBJECT IDENTIFIER ::= {
     joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101)
     dod(2) infosec(1) attributes(5) 69
   }

and here's the ASN.1 syntax for the Device Owner attribute:

   at-deviceOwner ATTRIBUTE ::= {
     TYPE                    OBJECT IDENTIFIER
     EQUALITY MATCHING RULE  objectIdentifierMatch
     IDENTIFIED BY           id-deviceOwner
   }

okay this is the important part 😭 A device MUST only have one Device Owner value. If there are distinct owners, they MUST be represented in separate certificates 🔥

3. Security Considerations 🔥

okay this one is serious, bestie 😭 if this attribute is used in an authorization process, the procedures used by whoever assigns each value MUST make sure the right value gets applied. (no wait, the original says "must", so I'll keep it plain: the procedures used by the entity that assigns each value have to make sure the correct value is applied 💀) Putting this attribute in a public key certificate or attribute certificate means the device owner value is integrity protected 🛡️✨

4. Normative References 💜

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008.
[RFC5755] Farrell, S., Housley, R., and S. Turner, "An Internet Attribute Certificate Profile for Authorization", RFC 5755, January 2010.
[RFC5912] Schaad, J. and P. Hoffman, "New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)", RFC 5912, June 2010.
[X.501] ITU-T Recommendation X.520 (2002) | ISO/IEC 9594-2:2002, Information technology - The Directory: Models.
[X.680] ITU-T Recommendation X.680 (2002) | ISO/IEC 8824-1:2002, Information technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation.
[X.681] ITU-T Recommendation X.681 (2002) | ISO/IEC 8824-2:2002, Information Technology - Abstract Syntax Notation One: Information Object Specification.
[X.682] ITU-T Recommendation X.682 (2002) | ISO/IEC 8824-3:2002, Information Technology - Abstract Syntax Notation One: Constraint Specification.
[X.683] ITU-T Recommendation X.683 (2002) | ISO/IEC 8824-4:2002, Information Technology - Abstract Syntax Notation One: Parameterization of ASN.1 Specifications.

Appendix A. ASN.1 Module 🧚

this appendix has the normative ASN.1 [X.680] definitions for the structures in this spec, using ASN.1 as defined in [X.680], [X.681], [X.682], and [X.683] 🎀

   DeviceOwnerAttribute-2008
     { joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101)
       dod(2) infosec(1) module(0) id-deviceOwnerAttribute-2008(34) }

   DEFINITIONS IMPLICIT TAGS ::=

   BEGIN

   -- EXPORTS ALL --

   IMPORTS

   -- IMPORTS from New PKIX ASN.1 [RFC5912]

     ATTRIBUTE
       FROM PKIX-CommonTypes-2009
         { iso(1) identified-organization(3) dod(6) internet(1)
           security(5) mechanisms(5) pkix(7) id-mod(0)
           id-mod-pkixCommon-02(57) }

   -- Imports from ITU-T X.501 [X.501]

     objectIdentifierMatch
       FROM InformationFramework
         { joint-iso-itu-t ds(5) module(1) informationFramework(1) 4 }

   ;

   -- device owner attribute OID and syntax

   id-deviceOwner OBJECT IDENTIFIER ::= {
     joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101)
     dod(2) infosec(1) attributes(5) 69
   }

   at-deviceOwner ATTRIBUTE ::= {
     TYPE                     OBJECT IDENTIFIER
     EQUALITY MATCHING RULE   objectIdentifierMatch
     IDENTIFIED BY            id-deviceOwner
   }

   END

Author's Address 💖

Sean Turner IECA, Inc. 3057 Nutley Street, Suite 106 Fairfax, VA 22031 USA

EMail: turners@ieca.com

📦 where this page comes from

ietf: rfc5916 2010-06
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms