RFC 5917

Clearance Sponsor Attribute

📅 published June 2010, from ietf

📄 RFC 5917 — the clearance sponsor attribute spec, written by Sean Turner (IECA) 💖 🏷️ Category: Informational (published for information, not a Standards Track spec) 📅 Date: June 2010 🔢 ISSN: 2070-1721 ♻️ Obsoletes / Updates: nothing is listed in the title block, so it doesn't obsolete or update any other RFCs 🦋

Abstract

okay so this doc defines the clearance sponsor attribute 🎀 it tells you which entity sponsored (aka granted) the clearance. it's meant to go in public key certificates and attribute certificates that also include the clearance attribute. main character energy 👑

Status of This Memo

this one is not an Internet Standards Track spec. it's published for info purposes only 🌸

it IS a product of the IETF, it represents the consensus of the IETF community, it got public review, and the IESG approved it for publication. not every IESG-approved doc is a candidate for any level of Internet Standard though, so check Section 2 of RFC 5741 if you want the deets 🤓

info about the current status, errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc5917 🔗

Copyright Notice

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. please actually read those, they spell out your rights and restrictions for this doc 🙈 and any Code Components pulled out of this doc must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions. they come without warranty, as described in the Simplified BSD License.

1. Introduction ✨

so this doc specifies the clearance sponsor attribute 🧚 it gets included in public key certificates [RFC5280] and attribute certificates [RFC5755]. it's only meaningful as a companion of the clearance attribute [RFC5755] [RFC5912], so it never shows up solo 😭

the clearance sponsor is the entity (think agency, department, or organization) that granted the clearance to the subject named in the certificate. for example, a subject asserting the Amoco clearance values [RFC3114] could have a clearance sponsor of "Engineering" 💅

this attribute can be used in automated authorization decisions 🤖 picture a web server deciding whether to let a user in. it could check that the clearance sponsor in the user's certificate is on an "approved" list. that check happens in addition to certification path validation [RFC5280]. how you manage that "approved" list is out of scope for this doc 🫶

NOTE: this doc does NOT provide an equivalent Lightweight Directory Access Protocol (LDAP) schema spec. reason being, this attribute is initially aimed at public key certificates [RFC5280] and attribute certificates [RFC5755]. defining an equivalent LDAP schema is left for a future spec 🍓

1.1. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 📚

1.2. ASN.1 Syntax Notation

The attribute is defined using ASN.1 [X.680], [X.681], [X.682], and [X.683]. 🧩

okay the clearance sponsor attribute is only meaningful if the clearance attribute [RFC5755] [RFC5912] is also present. it tells you the sponsor of the clearance for the subject this attribute belongs to 👑

it's a DirectoryString [RFC5280], and it MUST use the UTF8String CHOICE. length-wise it's at least 1 character and at most 64 characters 🎀

here's the object identifier that identifies the sponsor attribute:

id-clearanceSponsor OBJECT IDENTIFIER ::= {
  joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101)
  dod(2) infosec(1) attributes(5) 68
}

and here's the ASN.1 syntax for it 🤩

at-clearanceSponsor ATTRIBUTE ::= {
  TYPE                   DirectoryString { ub-clearance-sponsor }
                         ( WITH COMPONENTS { utf8String PRESENT } )
  EQUALITY MATCHING RULE caseIgnoreMatch
  IDENTIFIED BY          id-clearanceSponsor
}

ub-clearance-sponsor INTEGER ::= 64

bestie listen 👂 there MUST only be ONE value of clearanceSponsor on a particular certificate. if you have distinct sponsors, they MUST be represented in separate certificates 🙅‍♀️

also, when an environment uses this attribute, the sponsor should be represented the same way everywhere in that environment (like always using the same acronym) 💖 the value is also NOT meant to be globally unique. inside a certificate it's only unique within the scope of the issuer 🦋

3. Security Considerations 🔒

this part is serious, so pay attention 😭 if this attribute is used as part of an authorization process, the procedures used by whoever assigns each clearance sponsor value must make sure the correct value gets applied. including this attribute in a public key certificate or attribute certificate means the clearance sponsor value is integrity protected 🛡️

the certificate issuer and the clearance sponsor are not necessarily the same entity. if they're separate entities, the mechanism the clearance sponsor uses to tell the certificate issuer that they really did grant the clearance to the subject needs protection from unauthorized modification. no sneaky edits allowed 🚫

now the tricky one 🙈 say two entities are verifying each other's certificates, they don't share the same issuer, and they use the same clearance sponsor value. for example, a United Kingdom PKI includes "MoD" and a New Zealand PKI also includes "MoD". then the relying party has two choices: 1) accept the two strings as equivalent, or 2) indicate the sponsor as well as the trust anchor. to fix this, a mechanism (outside the scope of this spec) could be developed that lets a relying party group together issuers sharing the same context, where sponsor names have a unique meaning 🧠

also, DirectoryString values can include the NUL (U+0000) code point, but values used for clearance sponsors typically wouldn't. implementations of the caseIgnoreMatch rule must, per X.501, consider all of the assertion value and attribute value when matching, so they're protected against truncation attacks 💀

4. References

4.1. Normative References

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 📖
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008. 📖
[RFC5755] Farrell, S., Housley, R., and S. Turner, "An Internet Attribute Certificate Profile for Authorization", RFC 5755, January 2010. 📖
[RFC5912] Schaad, J. and P. Hoffman, "New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)", RFC 5912, June 2010. 📖
[X.520] ITU-T Recommendation X.520 (2002) | ISO/IEC 9594-6:2002, Information technology - The Directory: Selected Attribute Types. 📖
[X.680] ITU-T Recommendation X.680 (2002) | ISO/IEC 8824-1:2002, Information technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation. 📖
[X.681] ITU-T Recommendation X.681 (2002) | ISO/IEC 8824-2:2002, Information Technology - Abstract Syntax Notation One: Information Object Specification. 📖
[X.682] ITU-T Recommendation X.682 (2002) | ISO/IEC 8824-3:2002, Information Technology - Abstract Syntax Notation One: Constraint Specification. 📖
[X.683] ITU-T Recommendation X.683 (2002) | ISO/IEC 8824-4:2002, Information Technology - Abstract Syntax Notation One: Parameterization of ASN.1 Specifications. 📖

4.2. Informative References

[RFC3114] Nicolls, W., "Implementing Company Classification Policy with the S/MIME Security Label", RFC 3114, May 2002. 🌈

Appendix A. ASN.1 Module 🧚

this appendix has the normative ASN.1 [X.680] definitions for the structures in this spec, using ASN.1 as defined in [X.680], [X.681], [X.682], and [X.683]. it's the source of truth, so copy it exactly 🫶

ClearanceSponsorAttribute-2008
  { joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101)
    dod(2) infosec(1) modules(0)
    id-clearanceSponsorAttribute-2008(35) }

DEFINITIONS IMPLICIT TAGS ::=

BEGIN

-- EXPORTS ALL --

IMPORTS

-- Imports from New PKIX ASN.1 [RFC5912]

  DirectoryString
    PKIX1Explicit-2009
      { iso(1) identified-organization(3) dod(6) internet(1)
        security(5) mechanisms(5) pkix(7) id-mod(0)
        id-pkix1-explicit-02(51) }

-- Imports from New PKIX ASN.1 [RFC5912]

  ATTRIBUTE
    FROM PKIX-CommonTypes-2009
      { iso(1) identified-organization(3) dod(6) internet(1)
        security(5) mechanisms(5) pkix(7) id-mod(0)
        id-mod-pkixCommon-02(57) }

-- Imports from ITU-T X.520 [X.520]

  caseIgnoreMatch
    FROM SelectedAttributeTypes
      { joint-iso-itu-t ds(5) module(1) selectedAttributeTypes(5) 4 }

;

-- sponsor attribute OID and syntax

id-clearanceSponsor OBJECT IDENTIFIER ::= {
  joint-iso-ccitt(2) country(16) us(840) organization(1) gov(101)
  dod(2) infosec(1) attributes(5) 68

}

at-clearanceSponsor ATTRIBUTE ::= {
  TYPE                   DirectoryString { ub-clearance-sponsor }
                         ( WITH COMPONENTS { utf8String PRESENT } )
  EQUALITY MATCHING RULE caseIgnoreMatch
  IDENTIFIED BY          id-clearanceSponsor
}

ub-clearance-sponsor INTEGER ::= 64

END

Author's Address 🌸

Sean Turner IECA, Inc. 3057 Nutley Street, Suite 106 Fairfax, VA 22031 USA

EMail: turners@ieca.com 💌

📦 where this page comes from

ietf: rfc5917 2010-06
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms