RFC 6032

Cryptographic Message Syntax (CMS) Encrypted Key Package Content Type

📅 published December 2010, from ietf

RFC 6032: Cryptographic Message Syntax (CMS) Encrypted Key Package Content Type 🎀

Okay bestie, this one is a Standards Track doc 💅, written by S. Turner from IECA and R. Housley from Vigil Security. It's ISSN 2070-1721 and dated December 2010. The title block doesn't list anything it obsoletes or updates, so it's standing on its own ✨.

Abstract ✨

Okay so this doc defines the Cryptographic Message Syntax (CMS) encrypted key package content type 🔐. Its whole job is encrypting content that holds a key package, whether that's a symmetric key package or an asymmetric key package. It's transport independent 🦋, meaning it doesn't care how it travels. CMS can digitally sign, digest, authenticate, or further encrypt this content type. It's built to work with the CMS Content Constraints (CCC) extension, and CCC does not constrain EncryptedData, EnvelopedData, and AuthEnvelopedData. 💖

Status of This Memo

This is an Internet Standards Track document. 🌸

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). For more on Internet Standards, check Section 2 of RFC 5741 📚.

Info about the current status of this document, any errata, and how to give feedback is at http://www.rfc-editor.org/info/rfc6032 🧚.

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document 🙈. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License.

1. Introduction 🌈

Okay so the Cryptographic Message Syntax (CMS) spec [RFC5652] is the one that defines how to digitally sign, digest, authenticate, or encrypt arbitrary message content 🔥. Tons of specs define content types meant to be used with CMS. [RFC6031] and [RFC5958] define symmetric key package and asymmetric key package content types that can be signed or encrypted using CMS 🗝️. CMS lets you compose complex messages with an arbitrary number of layers, which is giving main character energy 👑. A few other specs ([RFC3274], [RFC4073], and [RFC5083]) have augmented CMS with extra mechanisms, so you can build messages of arbitrary depth and breadth using a mix of authentication, encryption, and compression techniques 💅.

The CMS Content Constraints (CCC) certificate extension [RFC6010] is an authorization mechanism. It lets recipients check whether the originator of an authenticated CMS content type is allowed to produce messages of that type 🫶. CCC is used to authorize CMS-protected content. It cannot constrain these structures, which provide the layers of protection: SignedData, EnvelopedData, EncryptedData, DigestData, CompressedData, AuthenticatedData, ContentCollection, ContentWithAttributes, or AuthEnvelopedData 💀.

Here's the tea ☕. With the existing CMS mechanisms, producers of authenticated plaintext key packages can be authorized by putting a CCC extension with the right content type in their certificate. BUT these mechanisms can't authorize the producers of encrypted key material 😭. In some key management systems, encrypted key packages get passed between entities that can't decrypt them. The encrypted key package itself may be authenticated and passed along to another entity. In those cases, checking whether the producer of the encrypted key package is authorized may be desired at the intermediate points 🦋.

This document defines the encrypted key package content type, which can be used to encrypt content that includes a key package, like a symmetric key package [RFC6031] or an asymmetric key package [RFC5958]. It's transport independent 🌸. The Cryptographic Message Syntax (CMS) [RFC5652] can digitally sign, digest, authenticate, or further encrypt this content type ✨.

The encrypted key package content type is designed for use with [RFC6010]. To authorize an originator's public key to originate an encrypted key package, the object identifier linked to the encrypted key package content type goes in the originator's public key certificate CCC certificate extension. For CCC to work, originators wrap the encrypted key package in a SignedData, EnvelopedData, or AuthEnvelopedData. Then, during certificate path validation, the recipient figures out whether the originator is authorized to originate the encrypted key package 🔍.

In [RFC6010] terminology, the encrypted key package is a leaf node 🍃. Extra authorization checks may be required once the key package is decrypted. For example, the key package shown below has a SignedData layer that wraps an encrypted key package, which wraps a SignedData layer containing a symmetric key package 🪆. A recipient who can decrypt the key package would do the following steps before accepting the wrapped symmetric key material:

Verify the signature on the outer SignedData layer per [RFC5652].
Build and validate a certification path of the outer signer, and confirm the outer signer is authorized to produce the encrypted key package per [RFC5280] and [RFC6010].
Decrypt the encrypted key package.
Verify the signature on the inner SignedData layer per [RFC5652].
Build and validate a certification path to the signer of the inner SignedData, and confirm the inner signer is authorized to produce the symmetric key package per [RFC5280] and [RFC6010]. As specified in [RFC6010], the validator may use the attributes and public keys returned from the second step as inputs for this CMS content constraints processing 🧠.
Use the symmetric key material 🔑.

          +--------------------------------------+
          | ContentInfo                          |
          |                                      |
          | +----------------------------------+ |
          | | SignedData                       | |
          | |                                  | |
          | | +------------------------------+ | |
          | | | EncryptedKeyPackage          | | |
          | | |   (encrypted)                | | |
          | | |                              | | |
          | | | +-------------------------+  | | |
          | | | | SignedData              |  | | |
          | | | |                         |  | | |
          | | | | +---------------------+ |  | | |
          | | | | | SymmetricKeyPackage | |  | | |
          | | | | +---------------------+ |  | | |
          | | | +-------------------------+  | | |
          | | +------------------------------+ | |
          | +----------------------------------+ |
          +--------------------------------------+

In the example, the authorization of the SymmetricKeyPackage originator doesn't need an intermediate SignedData layer 🙌. For instance, if the AuthEnvelopedData option within an EncryptedKeyPackage were used, the second authorization check would start at the authEnveloped field 💜.

This document also defines an unprotected attribute, Content Decryption Key Identifier, for use with EncryptedData 🎀.

1.1. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📖.

1.2. ASN.1 Syntax Notation

The key package is defined using the ASN.1 [X.680], [X.681], [X.682], and [X.683] 🧩.

2. Encrypted Key Package ✨

okay so the encrypted key package content type is basically a wrapper that hides a key package inside encryption 🔐 It's usually used to encrypt a key package or a signed key package, and it borrows from one of three existing CMS content types depending on which fields you need for key management: EncryptedData [RFC5652], EnvelopedData [RFC5652], or AuthEnvelopedData [RFC5083]. The only real difference between this new type and those three protecting types is the object identifier and one tag. Otherwise it's the same as whichever one you picked, so it's giving "same energy, new name" 💅

The encrypted key package content type has the following syntax:

   ct-encrypted-key-package CONTENT-TYPE ::=
     { TYPE EncryptedKeyPackage
       IDENTIFIED BY id-ct-KP-encryptedKeyPkg }

   id-ct-KP-encryptedKeyPkg OBJECT IDENTIFIER ::=
     { joint-iso-itu-t(2) country(16) us(840) organization(1)
       gov(101) dod(2) infosec(1) formats(2)
       key-package-content-types(78) 2 }

   EncryptedKeyPackage ::= CHOICE {
     encrypted        EncryptedData,
     enveloped        [0] EnvelopedData,
     authEnveloped    [1] AuthEnvelopedData }

The EncryptedData structure is for simple symmetric encryption, where the sender and the receiver already share the encryption key 🗝️ It carries an encryption algorithm identifier, and an unprotected attribute can be used to carry an encryption key identifier if you need one (see Section 3). For more on the EncryptedData fields, check [RFC5652] 🦋

The EnvelopedData structure is used for encryption where the key management information gets transferred, so the receiver can decrypt 🎀 The details depend on the key management algorithm you use. Along with that key management info, EnvelopedData also carries an encryption algorithm identifier. Again, [RFC5652] has the deep dive on its fields 📖

The AuthEnvelopedData structure is for authenticated encryption, and it handles key management in a way that's similar to EnvelopedData 💜 The details, once again, depend on the key management algorithm. On top of the key management info, it carries a message authentication code that covers the content and the authenticated attributes. For its fields, see [RFC5083] ✨

Implementations of this document MUST support the EnvelopedData choice, SHOULD support the EncryptedData choice, and MAY support the AuthEnvelopedData.

Implementations that support EnvelopedData and EncryptedData to encapsulate with this content type MUST support an EncryptedKeyPackage that encapsulates either a SignedData [RFC5652] that further encapsulates a SymmetricKeyPackage [RFC6031] or a SignedData that further encapsulates an AsymmetricKeyPackage [RFC5958]. Implementations that support AuthEnvelopedData to encapsulate with this content type MUST support an EncryptedKeyPackage that encapsulates either a SymmetricKeyPackage [RFC6031] or an AsymmetricKeyPackage [RFC5958]. It is OPTIONAL for implementations that support AuthEnvelopedData to encapsulate with this content type to support an EncryptedKeyPackage that encapsulates either a SignedData [RFC5652] that further encapsulates a SymmetricKeyPackage [RFC6031] or a SignedData that further encapsulates an AsymmetricKeyPackage [RFC5958]. Likewise, implementations that process this content type to decrypt the encapsulated data MUST support an EncryptedKeyPackage that encapsulates either a SignedData that further encapsulates a SymmetricKeyPackage or a SignedData that further encapsulates an AsymmetricKeyPackage. An EncryptedKeyPackage content type MUST contain at least one SymmetricKeyPackage or AsymmetricKeyPackage. Implementations MAY support additional encapsulating layers.

Note that interoperability between an originator and a recipient that do not support the same innermost content (for example, an originator that supports AsymmetricKeyPackage while the recipient supports SymmetricKeyPackage) is not a concern, as originators should be aware of the recipient's capabilities 🤝 The mechanism for exchanging those capabilities, however, is beyond the scope of this document.

3. Content Decryption Key Identifier

The content-decryption-key-identifier attribute can be used to identify the symmetric keying material needed to decrypt the EncryptedData content, if there's any ambiguity 🕵️‍♀️ The ATTRIBUTE definition is taken from [RFC5912]. There MUST be only one instance of the content-decryption-key-identifier attribute, and there MUST be only one value for that attribute. One and done, bestie 🎯

The content-decryption-key-identifier attribute has the following syntax:

   aa-content-decrypt-key-identifier ATTRIBUTE ::= {
     TYPE          ContentDecryptKeyID
     IDENTIFIED BY id-aa-KP-contentDecryptKeyID }

   id-aa-KP-contentDecryptKeyID OBJECT IDENTIFIER ::= {
     joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101)
     dod(2) infosec(1) attributes(5) 66 }

   ContentDecryptKeyID ::= OCTET STRING

The content decryption key identifier is an OCTET STRING, and this syntax doesn't impose any particular structure on the identifier value 🌸

Because there can be multiple layers of encryption, the content-decryption-key-identifier attribute can show up in more than one place in the overall key package 🧅 When there are multiple occurrences, each one is evaluated independently, and each one is used to identify the keying material needed for that particular layer of encryption. Layers, layers everywhere 🥰

4. Security Considerations

Implementers of this protocol are strongly encouraged to consider generally accepted principles of secure key management when integrating this capability into an overall security architecture 🔒 This part is seriously important, so please don't skip it 😭

The security considerations from [RFC5083], [RFC5652], [RFC5911], [RFC5912], [RFC5958], and [RFC6031] apply. If the CCC extension is used as an authorization mechanism, then the security considerations from [RFC6010] also apply. So you've got a whole squad of security notes to read, periodt 💀

The encrypted key package content type might not provide proof of origin if the content encryption algorithm doesn't support authenticated key exchange. To provide proof of origin for this content, another security protocol needs to be used. This is the reason support for encapsulating the SymmetricKeyPackage and AsymmetricKeyPackage with a SignedData content type from [RFC5652] is required for the EnvelopedData and EncryptedData choices. So that's why that requirement is there, and yes, it's iconic design logic 👑

When this content type is used, the CMS SignedData [RFC5652] validation rules MUST be used. The PKCS #7 [RFC2315] validation rules MUST NOT be used. Do NOT mix these up, it's a whole mess if you do 🚨

5. IANA Considerations

This document makes use of object identifiers to identify a CMS content type, a CMS attribute, and the ASN.1 module, all of which can be found in Appendix A 🧚 All OIDs are registered in an arc delegated by RSADSI to the SMIME Working Group. Very organized, very slay 📋

6. References

6.1. Normative References

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 🔑
[RFC5083] Housley, R., "Cryptographic Message Syntax (CMS) Authenticated-Enveloped-Data Content Type", RFC 5083, November 2007.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008.
[RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", STD 70, RFC 5652, September 2009.
[RFC5911] Hoffman, P. and J. Schaad, "New ASN.1 Modules for Cryptographic Message Syntax (CMS) and S/MIME", RFC 5911, June 2010.
[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)", RFC 5912, June 2010.
[RFC5958] Turner, S., "Asymmetric Key Packages", RFC 5958, August 2010.
[RFC6010] Housley, R., Ashmore, S., and C. Wallace, "Cryptographic Message Syntax (CMS) Content Constraints Extension", RFC 6010, September 2010.
[RFC6031] Turner, S. and R. Housley, "Cryptographic Message Syntax (CMS) Symmetric Key Package Content Type", RFC 6031, December 2010.
[X.680] ITU-T Recommendation X.680 (2002) | ISO/IEC 8824-1:2002. Information Technology - Abstract Syntax Notation One.
[X.681] ITU-T Recommendation X.681 (2002) | ISO/IEC 8824-2:2002. Information Technology - Abstract Syntax Notation One: Information Object Specification.
[X.682] ITU-T Recommendation X.682 (2002) | ISO/IEC 8824-3:2002. Information Technology - Abstract Syntax Notation One: Constraint Specification.
[X.683] ITU-T Recommendation X.683 (2002) | ISO/IEC 8824-4:2002. Information Technology - Abstract Syntax Notation One: Parameterization of ASN.1 Specifications.

6.2. Informative References

[RFC2315] Kaliski, B., "PKCS #7: Cryptographic Message Syntax Version 1.5", RFC 2315, March 1998. 📚
[RFC3274] Gutmann, P., "Compressed Data Content Type for Cryptographic Message Syntax (CMS)", RFC 3274, June 2002.
[RFC4073] Housley, R., "Protecting Multiple Contents with the Cryptographic Message Syntax (CMS)", RFC 4073, May 2005.

Appendix A. ASN.1 Module ✨

okay so this appendix is the official ASN.1 [X.680] version of everything we've been talking about 🎀 it's the normative definition, so if the words and this module ever disagree, the module wins. the structures are described using ASN.1 as defined in [X.680] through [X.683] 💅

   EncryptedKeyPackageModuleV1
     { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
       smime(16) modules(0) id-mod-encryptedKeyPkgV1(51) }

   DEFINITIONS IMPLICIT TAGS ::=

   BEGIN

   -- EXPORTS ALL --

   IMPORTS

   -- From New SMIME ASN.1 [RFC5911]

   EncryptedData, EnvelopedData, CONTENT-TYPE
     FROM CryptographicMessageSyntax-2009
       { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
         smime(16) modules(0) cms-2004-02(41) }

   -- From New SMIME ASN.1 [RFC5911]

   AuthEnvelopedData
     FROM CMS-AuthEnvelopedData-2009
        { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
          pkcs-9(9) smime(16) modules(0) cms-authEnvelopedData-02(43) }

   -- From New PKIX ASN.1 [RFC5912]

   ATTRIBUTE
     FROM PKIX-CommonTypes-2009
       { iso(1) identified-organization(3) dod(6) internet(1)
         security(5) mechanisms(5) pkix(7) id-mod(0)
         id-mod-pkixCommon-02(57) }

   ;

   ContentSet CONTENT-TYPE ::= {
     ct-encrypted-key-package,
     ... -- Expect additional content types --
   }
   ct-encrypted-key-package CONTENT-TYPE ::=
       { TYPE EncryptedKeyPackage
         IDENTIFIED BY id-ct-KP-encryptedKeyPkg }

   id-ct-KP-encryptedKeyPkg OBJECT IDENTIFIER ::=
     { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101)
       dod(2) infosec(1) formats(2) key-package-content-types(78) 2 }

   EncryptedKeyPackage ::= CHOICE {
       encrypted        EncryptedData,
       enveloped        [0] EnvelopedData,
       authEnveloped    [1] AuthEnvelopedData }

   aa-content-decrypt-key-identifier ATTRIBUTE ::= {
       TYPE          ContentDecryptKeyID
       IDENTIFIED BY id-aa-KP-contentDecryptKeyID }

   id-aa-KP-contentDecryptKeyID OBJECT IDENTIFIER ::= {
     joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101)
     dod(2) infosec(1) attributes(5) 66 }

   ContentDecryptKeyID ::= OCTET STRING

   END

Authors' Addresses 🎀

okay and last but not least, who wrote this thing 🫶 here are the authors and how to reach them

   Sean Turner
   IECA, Inc.
   3057 Nutley Street, Suite 106
   Fairfax, VA 22031
   USA

   EMail: turners@ieca.com


   Russell Housley
   Vigil Security, LLC
   918 Spring Knoll Drive
   Herndon, VA 20170
   USA

   EMail: housley@vigilsec.com

📦 where this page comes from

ietf: rfc6032 2010-12
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms