RFC 6091

RFC 6091: Using OpenPGP Keys for Transport Layer Security (TLS) Authentication ✨

Okay bestie, so this is RFC 6091, all about using OpenPGP keys for TLS authentication 🔐. It was written by N. Mavrogiannopoulos (KUL) and D. Gillmor (Independent) and it's dated February 2011. It's in the Informational category, so it's published for information and it's not a Standards Track thing 📚. The ISSN is 2070-1721. It obsoletes RFC 5081, and its title block doesn't list anything it updates 🌸.

Abstract 🦋

Okay so this memo defines TLS extensions and the semantics that go with them, so clients and servers can negotiate the use of OpenPGP certificates for a TLS session 💖. It also explains how to transport OpenPGP certificates over TLS, and it defines the registry for non-X.509 certificate types 🧚.

Status of This Memo 📝

This document is not an Internet Standards Track specification. It's published for informational purposes 💅.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG) 🫶. Not every document the IESG approves is a candidate for any level of Internet Standard, so see Section 2 of RFC 5741 for that 👑.

For info on the current status of this document, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc6091 🔥.

Copyright Notice ©️

Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved 🌈.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they're in effect on the date this document was published. Please read these carefully, because they describe your rights and restrictions regarding this document 📜. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 💜.

Table of Contents 🧚

   1. Introduction ....................................................2
   2. Terminology .....................................................2
   3. Changes to the Handshake Message Contents .......................3
      3.1. Client Hello ...............................................3
      3.2. Server Hello ...............................................4
      3.3. Server Certificate .........................................4
      3.4. Certificate Request ........................................6
      3.5. Client Certificate .........................................6
      3.6. Other Handshake Messages ...................................7
   4. Security Considerations .........................................7
   5. IANA Considerations .............................................7
   6. Acknowledgements ................................................8
   7. References ......................................................8
      7.1. Normative References .......................................8
      7.2. Informative References .....................................8
   Appendix A.  Changes from RFC 5081 .................................9

1. Introduction ✨

Okay so there are two sets of standards for public key certificates. One set is for X.509 certificates [RFC5280], and the other is for OpenPGP certificates [RFC4880] 🌸. When this was written, TLS [RFC5246] was defined to use X.509 certificates. This document describes a way to negotiate the use of OpenPGP certificates for a TLS session, and it explains how to transport OpenPGP certificates over TLS 🦋. The proposed extensions are backward-compatible with the current TLS spec, so existing client and server implementations that use X.509 certificates aren't affected 🫶.

Heads up, though! These extensions are not backward-compatible with [RFC5081], and the major differences are summarized in Appendix A 👀. The OpenPGP CertificateType value is reused by this memo with the same number that [RFC5081] specified, but with different semantics. We believe this causes no interoperability issues, because the older version was not widely deployed 🙈.

2. Terminology 🎀

The term "OpenPGP key" is used in this document the same way it's used in the OpenPGP specification [RFC4880]. We use the term "OpenPGP certificate" to refer to OpenPGP keys that are enabled for authentication 💖.

This document uses the same notation and terminology as the TLS Protocol specification [RFC5246] 📚.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🔥.

3. Changes to the Handshake Message Contents 💅

This section covers the changes to the TLS handshake message contents when OpenPGP certificates are going to be used for authentication 🧚.

3.1. Client Hello 🦋

Okay so to say that you support multiple certificate types, clients MUST include an extension of type "cert_type" in the extended client hello message 💜. The "cert_type" TLS extension is assigned the value of 9 from the TLS ExtensionType registry. This value is used as the extension number for the extensions in both the client hello message and the server hello message. The hello extension mechanism is described in [RFC5246] ✨.

This extension carries a list of the supported certificate types the client can use, sorted by client preference. This extension MUST be omitted if the client only supports X.509 certificates 🌈. The "extension_data" field of this extension contains a CertificateTypeExtension structure. Note that the CertificateTypeExtension structure is used by both the client and the server, even though the structure is only specified once in this document 🫶. Reusing a single spec for both client and server is pretty common in other specs too, like the TLS protocol itself [RFC5246] 🍓.

      enum { client, server } ClientOrServerExtension;

      enum { X.509(0), OpenPGP(1), (255) } CertificateType;

      struct {
         select(ClientOrServerExtension) {
            case client:
               CertificateType certificate_types<1..2^8-1>;
            case server:
               CertificateType certificate_type;
         }
      } CertificateTypeExtension;

No new cipher suites are required to use OpenPGP certificates 🎀. All existing cipher suites that support a key exchange method compatible with the key in the certificate can be used together with OpenPGP certificates 💖.

3.2. Server Hello 🌸

If the server gets a client hello that contains the "cert_type" extension and picks a cipher suite that requires a certificate, then there are two possible outcomes 👀. The server MUST either select a certificate type from the certificate_types field in the extended client hello, or terminate the session with a fatal alert of type "unsupported_certificate" 😭.

The certificate type the server selects is encoded in a CertificateTypeExtension structure, which is included in the extended server hello message using an extension of type "cert_type" 🦋. Servers that only support X.509 certificates MAY omit including the "cert_type" extension in the extended server hello 🍓.

3.3. Server Certificate 🔐

The contents of the certificate message sent from server to client, and vice versa, are determined by the negotiated certificate type and the selected cipher suite's key exchange algorithm 💅.

If the OpenPGP certificate type is negotiated, then it is required to present an OpenPGP certificate in the certificate message. The certificate must contain a public key that matches the selected key exchange algorithm, as shown below 🧚.

      Key Exchange Algorithm    OpenPGP Certificate Type

      RSA                       RSA public key that can be used for
                                encryption.

      DHE_DSS                   DSA public key that can be used for
                                authentication.

      DHE_RSA                   RSA public key that can be used for
                                authentication.

An OpenPGP certificate that shows up in the certificate message is sent using the binary OpenPGP format. The certificate MUST contain all the elements required by Section 11.1 of [RFC4880] ✨.

OpenPGP certificates to be transferred are placed in the Certificate structure and tagged with the OpenPGPCertDescriptorType "subkey_cert". Since those certificates might contain several subkeys, the subkey ID to be used for this session is explicitly specified in the OpenPGPKeyID field. The key ID must be specified even if the certificate has only a primary key 🎀. The peer, upon receiving this type, has to either use the specified subkey or terminate the session with a fatal alert of "unsupported_certificate" 💜.

There's also an option to send an OpenPGP fingerprint, instead of the entire certificate, by using the "subkey_cert_fingerprint" tag 🦋. This tag uses the OpenPGPSubKeyFingerprint structure and requires the primary key fingerprint to be specified, as well as the subkey ID to be used for this session 🌈. The peer shall respond with a "certificate_unobtainable" fatal alert if the certificate with the given fingerprint cannot be found. The "certificate_unobtainable" fatal alert is defined in Section 5 of [RFC6066] 😭.

Implementations of this protocol MUST ensure that the sizes of key IDs and fingerprints in the OpenPGPSubKeyCert and OpenPGPSubKeyFingerprint structures comply with [RFC4880]. Moreover, it is RECOMMENDED that the keys used with this protocol have the authentication flag (0x20) set 🫶.

The process of fingerprint generation is described in Section 12.2 of [RFC4880] 📚.

The enumerated types "cert_fingerprint" and "cert" of OpenPGPCertDescriptorType, which were defined in [RFC5081], are not used and are marked as obsolete by this document 🙈. The "empty_cert" type has replaced "cert" and is a backward-compatible way to specify an empty certificate. "cert_fingerprint" MUST NOT be used with this updated specification, so that old alternative has been removed from the Certificate struct description 💀.

      enum {
           empty_cert(1),
           subkey_cert(2),
           subkey_cert_fingerprint(3),
           (255)
      } OpenPGPCertDescriptorType;

      uint24 OpenPGPEmptyCert = 0;

      struct {
          opaque OpenPGPKeyID<8..255>;
          opaque OpenPGPCert<0..2^24-1>;
      } OpenPGPSubKeyCert;

      struct {
          opaque OpenPGPKeyID<8..255>;
          opaque OpenPGPCertFingerprint<20..255>;
      } OpenPGPSubKeyFingerprint;

      struct {
           OpenPGPCertDescriptorType descriptorType;
           select (descriptorType) {
                case empty_cert: OpenPGPEmptyCert;
                case subkey_cert: OpenPGPSubKeyCert;
                case subkey_cert_fingerprint:
                    OpenPGPSubKeyCertFingerprint;
           }
      } Certificate;

3.4. Certificate Request 👑

The semantics of this message stay the same as in the TLS specification 💖. However, if this message is sent and the negotiated certificate type is OpenPGP, the "certificate_authorities" list MUST be empty 🔥.

3.5. Client Certificate ✨

okay so this message only ever gets sent in response to a certificate request message 🎀 it uses the same formatting as the server certificate message, and the client ALSO has to present a certificate that matches the negotiated certificate type 💅 like, no skipping!! bestie, here's the tricky bit: if OpenPGP certificates were picked and the client doesn't have one available, it MUST send a certificate structure of type empty_cert that holds an OpenPGPEmptyCert value 🧚 and if client authentication is required, the server SHOULD respond with a "handshake_failure" fatal alert 💀

3.6. Other Handshake Messages 🌸

every other handshake message is identical to the TLS spec, so no new drama there 🫶

4. Security Considerations 🔥

okay this section is SO important, bestie, so read it carefully 🙈

All security considerations discussed in [RFC5246], [RFC6066], and [RFC4880] apply to this document. Questions about the web of trust or about identity and certificate verification procedures are outside the scope of this document 🦋 those are issues the application layer protocols are supposed to handle.

the certificate type negotiation works exactly like cipher suite negotiation in the TLS spec [RFC5246] 💖 the only difference is that default values apply when the extension is omitted. because those omissions have a unique meaning, and the values get the same protection as cipher suites, it's believed that the security properties of this negotiation match cipher suite negotiation ✨

when OpenPGP fingerprints are used instead of full certificates, Section 5 of [RFC6066] for "Client Certificate URLs" applies, especially when external servers are used to get keys 👑 but here's the major difference: the "client_certificate_url" extension can identify certificates without including their hashes, and this protocol can't do that 😭 in this protocol, certificates that aren't sent are always identified by their fingerprint, which works as a cryptographic hash of the certificate (see Section 12.2 of [RFC4880]) 🍓

the information available to participating parties and eavesdroppers (when confidentiality isn't available through a previous handshake) is the number and types of certificates they hold, plus the contents of the certificates 👀

5. IANA Considerations 🌈

this document uses a registry and the "cert_type" extension that were originally defined in [RFC5081] 💜 existing IANA references have been updated to point to this document ✨

the "TLS Certificate Types" registry established by [RFC5081] was also updated in these ways:

1. Values 0 (X.509) and 1 (OpenPGP) are defined in this document 🎀
2. Values from 2 through 223 decimal inclusive are assigned via "RFC Required" [RFC5226] 🦋
3. Values from 224 decimal through 255 decimal inclusive are reserved for Private Use [RFC5226] 🔥

6. Acknowledgements 🫶

the authors wanna thank Alfred Hoenes and Ted Hardie for their suggestions on improving this document 💖

7. References 📚

7.1. Normative References

[RFC2119]   Bradner, S., "Key words for use in RFCs to Indicate
            Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC4880]   Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R.
            Thayer, "OpenPGP Message Format", RFC 4880,
            November 2007.

[RFC5226]   Narten, T. and H. Alvestrand, "Guidelines for Writing an
            IANA Considerations Section in RFCs", BCP 26, RFC 5226,
            May 2008.

[RFC5246]   Dierks, T. and E. Rescorla, "The Transport Layer Security
            (TLS) Protocol Version 1.2", RFC 5246, August 2008.

[RFC6066]   Eastlake 3rd, D., "Transport Layer Security (TLS)
            Extensions: Extension Definitions", RFC 6066,
            January 2011.

7.2. Informative References

[RFC5081]   Mavrogiannopoulos, N., "Using OpenPGP Keys for Transport
            Layer Security (TLS) Authentication", RFC 5081,
            November 2007.

[RFC5280]   Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
            Housley, R., and W. Polk, "Internet X.509 Public Key
            Infrastructure Certificate and Certificate Revocation
            List (CRL) Profile", RFC 5280, May 2008.

Appendix A. Changes from RFC 5081 🦋

this document makes a major change to the "Server Certificate" and "Client Certificate" TLS messages 😭 that means implementations following this protocol will be incompatible with those following [RFC5081] 💀 the change requires the subkey IDs used for TLS authentication to be marked explicitly in the handshake procedure, and it was decided this way so there's no limitation on the contents of the OpenPGP certificates that can be used with this protocol 🧚

[RFC5081] required that an OpenPGP key or subkey be marked with the authentication flag, so authentication would have failed if this flag wasn't set or if it was set in more than one subkey. the protocol in this memo has no such limitation 💅

---

Authors' Addresses 🎀

Nikos Mavrogiannopoulos ESAT/COSIC Katholieke Universiteit Leuven Kasteelpark Arenberg 10, bus 2446 Leuven-Heverlee, B-3001 Belgium

EMail: nikos.mavrogiannopoulos@esat.kuleuven.be

Daniel Kahn Gillmor Independent 119 Herkimer St. Brooklyn, NY 11216-2801 US

EMail: dkg@fifthhorseman.net