RFC 6403

Suite B Profile of Certificate Management over CMS

📅 published November 2011, from ietf

RFC 6403 🎀 Suite B Profile of Certificate Management over CMS

okay bestie, here's the deets 💅

Authors: L. Zieglar (NSA), S. Turner (IECA), and M. Peck 🦋
Category: Informational, so it's published for info, not as a Standards Track spec ✨
Date: November 2011 🌸
ISSN: 2070-1721
Obsoletes / Updates: this title block doesn't list either one, so it doesn't say it obsoletes or updates anything 🙈

Abstract 💖

so the US government put out guidelines called "NSA Suite B Cryptography," which sets the crypto algorithm policy for national security stuff 🔥 this doc is a profile of the Certificate Management over CMS (CMC) protocol for managing Suite B X.509 public key certificates 💜 it's a refinement of RFCs 5272, 5273, and 5274 🍓

Status of This Memo 🌈

this one is not an Internet Standards Track spec, it's just published for info 🧚

it's a product of the IETF, it represents the consensus of the IETF community, it got public review, and the IESG approved it for publication ⭐ not every IESG-approved doc is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 if you're curious 🫶

for the current status, errata, and how to give feedback, go to http://www.rfc-editor.org/info/rfc6403 💅

Copyright Notice 🎀

this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date 📜 read them carefully bestie, they spell out your rights and restrictions for this doc 👑 any Code Components pulled out of this doc must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty as described in the Simplified BSD License 🦋

1. Introduction ✨

so this doc is a profile for using the Certificate Management over CMS (CMC) protocol, which is defined in [RFC5272], [RFC5273], and [RFC5274] and updated by [RFC6402] 💖 it's for managing X.509 public key certificates that follow the NSA's Suite B Cryptography, as defined in the Suite B Certificate and Certificate Revocation List (CRL) Profile [RFC5759] 🔥

the main focus is CMC interactions for both initial enrollment and rekey of Suite B public key certificates between a client and a Certification Authority (CA) 🧚 one or more Registration Authorities (RAs) can act as go-betweens for the client and the CA 🫶 specific communities may tailor this profile to fit their needs, and they'll also define the Certificate Policies that implementations have to follow 💅

2. Terminology 🌸

the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this doc get read as described in [RFC2119] 💜

the terminology in [RFC5272] Section 2.1 applies to this profile too 🎀

3. Requirements and Assumptions 🦋

all key pairs are on either the curve P-256 or the curve P-384 💎 FIPS 186-3 [DSS], Appendix B.4, has useful guidance for elliptic curve key pair generation, and systems that conform to this doc SHOULD follow it 🌈

this doc assumes the required trust anchors have been securely provisioned to the client and, when it applies, to any RAs 🔐

all requirements in [RFC5272], [RFC5273], [RFC5274], and [RFC6402] apply, except where this profile overrides them 🍓

this profile was developed with the scenarios in Appendix A in mind, but using it isn't limited to just those scenarios ✨

the term "client" here usually means an end-entity, but it can also mean a third party acting on the end-entity's behalf 🧚 the client may or may not be the entity that actually generates the key pair, but it does do the CMC protocol interactions with the RA and/or CA 🫶 for example, the client could be a token management system talking to a cryptographic token through an out-of-band secure protocol 🔥

this profile uses "rekey" the same way CMC does (defined in Section 2 of [RFC5272]) 💅 it makes no specific statements about "renewal" operations, but the statements that apply to rekey should be applied to renewal as well 🌸

this profile may be used to manage RA and/or CA certificates 👑 in that case, the RA and/or CA whose certificate is being managed counts as the end-entity 💖

this profile does not support key establishment certification requests from cryptographic modules that can't generate a one-time signature with a key establishment key for proof-of-possession purposes 🙈 if that's your situation, a separate profile would be needed to define another proof-of-possession technique 🦋

4. Client Requirements: Generating PKI Requests 🎀

this section lays out the conventions used when a client requests a certificate from a Public Key Infrastructure (PKI) 💜

the Full PKI Request MUST be used, it MUST be encapsulated in a SignedData, and the SignedData MUST be constructed as defined in [RFC6318] 🔥 the PKIData content type complies with [RFC5272] with these extra requirements:

controlSequence SHOULD be present, and it SHOULD include these CMC controls: Transaction ID and Sender Nonce 💅 other CMC controls MAY be included ✨
- if the request is authenticated using a shared-secret, these requirements apply too 🔐
  - the Identity Proof Version 2 control, as defined in [RFC5272], MUST be included 🫶
  - hashAlgId MUST be id-sha256 or id-sha384 for P-256 certification requests, and MUST be id-sha384 for P-384 certification requests (both algorithm OIDs are defined in [RFC5754]) 🌈
  - macAlgId MUST be HMAC-SHA256 when the hashAlgId is id-sha256, and MUST be HMAC-SHA384 when the hashAlgId is id-sha384 (both HMAC algorithms are defined in [RFC4231]) 🧚
- if the subject in the certification request is NULL or otherwise doesn't uniquely identify the end-entity, then the POP Link Random control MUST be included, and the POP Link Witness Version 2 control MUST be included in the inner PKCS #10 or Certificate Request Message Format (CRMF) request, as described in Sections 4.1 and 4.2 👑
reqSequence MUST be present 🎀 it MUST include at least one tcr (see Section 4.1) or crm (see Section 4.2) TaggedRequest 💖 support for the orm choice is OPTIONAL 🌸

if the Full PKI Request contains a P-256 public key certification request, the SignedData encapsulating it MUST be generated using either SHA-256 and ECDSA on P-256, or SHA-384 and ECDSA on P-384 💎 if it contains a P-384 public key certification request, the SignedData MUST be generated using SHA-384 and ECDSA on P-384 🔥

a Full PKI Request MUST be signed using the private key that matches the public key of an existing signature certificate, unless an appropriate signature certificate doesn't exist yet, like during initial enrollment 🦋

if there's no appropriate signature certificate yet, and a Full PKI Request includes one or more certification requests and is authenticated using a shared-secret (because there's no certificate to authenticate the request with yet), the Full PKI Request MUST be signed using the private key that matches the public key of one of the requested certificates 🧚 when it's necessary (meaning there's no existing signature certificate and no signature certification request included), a Full PKI Request MAY be signed using a key pair meant for a key establishment certificate 🌈 however, servers are not required to allow this 🙈

4.1. Tagged Certification Request ✨

the reqSequence tcr choice carries PKCS #10 [RFC2986] syntax 🍓 the CertificateRequest MUST comply with [RFC5272], Section 3.2.1.2.1, with these extra requirements:

certificationRequestInfo:
- subjectPublicKeyInfo MUST be set as defined in Section 4.4 of [RFC5759] 💜
- attributes:
  - the ExtensionReq attribute MUST be included, with its contents as follows:
    - the Key Usage extension MUST be included, and it MUST be set as defined in [RFC5759] 🎀
    - for rekey requests, the SubjectAltName extension MUST be included and set equal to the SubjectAltName of the certificate being used to sign the SignedData that encapsulates the request (so not the certificate being rekeyed), if the Subject field of the certificate used to generate the signature is NULL 🔥
    - other extension requests MAY be included as desired 💅
  - the ChangeSubjectName attribute, as defined in [RFC6402], MUST be included if the Full PKI Request encapsulating this Tagged Certification Request is signed by a key that has a certificate currently, and that existing certificate's Subject or SubjectAltName doesn't match the desired Subject or SubjectAltName of this certification request 🦋
  - the POP Link Witness Version 2 attribute MUST be included if the request is authenticated using a shared-secret and the Subject in the certification request is NULL or otherwise doesn't uniquely identify the end-entity 🫶 in the POP Link Witness Version 2 attribute, keyGenAlgorithm MUST be id-sha256 or id-sha384 for P-256 certification requests and MUST be id-sha384 for P-384 certification requests, as defined in [RFC5754] 🌸 macAlgorithm MUST be HMAC-SHA256 when the keyGenAlgorithm is id-sha256, and MUST be HMAC-SHA384 when the keyGenAlgorithm is id-sha384, as defined in [RFC4231] 🧚
signatureAlgorithm MUST be ecdsa-with-sha256 for P-256 certification requests, and MUST be ecdsa-with-sha384 for P-384 certification requests 💖
signature MUST be generated using the private key that corresponds to the public key in the CertificationRequestInfo, for both signature and key establishment certification requests 🔐 the signature provides proof-of-possession of the private key to the Certification Authority 👑 💜

4.2. Certificate Request Message 💖

okay so the reqSequence crm choice is where the Certificate Request Message Format (CRMF) [RFC4211] syntax lives 🎀 and the CertReqMsg MUST comply with [RFC5272], Section 3.2.1.2.2, plus these extra rules:

popo MUST be included using the signature (POPOSigningKey) proof-of-possession choice and set as defined in [RFC4211], Section 4.1, for both signature and key establishment certification requests.
- The POPOSigningKey poposkInput field MUST be omitted. The POPOSigningKey algorithmIdentifier MUST be ecdsa-with-sha256 for P-256 certification requests and MUST be ecdsa-with-sha384 for P-384 certification requests. The signature MUST be generated using the private key corresponding to the public key in the CertTemplate. 🔥

The CertTemplate MUST comply with [RFC5272], Section 3.2.1.2.2, with these extra requirements:

version MAY be included and, if included, it MUST be set to 2 as defined in Section 4.3 of [RFC5759] ✨;
publicKey MUST be set as defined in Section 4.4 of [RFC5759] 🦋;
extensions:
- The Key Usage extension MUST be included, and it MUST be set as defined in [RFC5759].
- For rekey requests, the SubjectAltName extension MUST be included and set equal to the SubjectAltName of the certificate that is being used to sign the SignedData encapsulating the request (i.e., not the certificate being rekeyed) if the Subject field of the certificate being used to generate the signature is NULL. 🙈
- Other extension requests MAY be included as desired. 🌈
controls:
- The ChangeSubjectName attribute, as defined in [RFC6402], MUST be included if the Full PKI Request encapsulating this Tagged Certification Request is being signed by a key for which a certificate currently exists and the existing certificate's Subject or SubjectAltName does not match the desired Subject or SubjectAltName of this certification request. 👑
- The POP Link Witness Version 2 attribute MUST be included if the request is being authenticated using a shared-secret, and the Subject in the certification request is NULL or otherwise does not uniquely identify the end-entity. In the POP Link Witness Version 2 attribute, keyGenAlgorithm MUST be id-sha256 or id-sha384 for P-256 certification requests and MUST be id-sha384 for P-384 certification requests; macAlgorithm MUST be HMAC-SHA256 when keyGenAlgorithm is id-sha256 and MUST be HMAC-SHA384 when keyGenAlgorithm is id-sha384. 🫶

5. RA Requirements 🧚

this section is about the optional case where one or more RAs act as middle-people between the client and the CA, as described in Section 7 of [RFC5272] 💜. in here, "client" means the entity the RA got the PKI Request from. and this section only applies to RAs, so CAs and clients can chill 🌸.

5.1. RA Processing of Requests

RAs conforming to this document MUST ensure that only the permitted signature, hash, and MAC algorithms described throughout this profile are used in requests; if they are not, the RA MUST reject those requests. The RA SHOULD return a CMCFailInfo with the value of badAlg [RFC5272]. 💀

When processing end-entity-generated SignedData objects, RAs MUST NOT perform Cryptographic Message Syntax (CMS) Content Constraints (CCC) certificate extension processing [RFC6010]. 🙅‍♀️

Other RA processing is as in [RFC5272]. ✨

5.2. RA-Generated PKI Requests

If the RA encapsulates the client-generated PKI Request in a new RA-signed PKI Request, it MUST create a Full PKI Request encapsulated in a SignedData, and the SignedData MUST be constructed as defined in [RFC6318]. The PKIData content type complies with [RFC5272] with these extra requirements:

controlSequence MUST be present. It MUST include the following CMC controls: Transaction ID, Sender Nonce, and Batch Requests. Other appropriate CMC controls MAY be included. 🎀
cmsSequence MUST be present. It contains the original, unmodified request(s) received from the client.

RA certificates are authorized to sign Full PKI Requests with an Extended Key Usage (EKU) and/or with the CCC certificate extension [RFC6010]. Certificates may also be authorized through local configuration. Authorized certificates SHOULD include the id-kp-cmcRA EKU from [RFC6402]. Authorized certificates MAY also include the CCC certificate extension [RFC6010], or the authorized certificate MAY just include the CCC certificate extension. If the RA is authorized via the CCC extension, then the CCC extension MUST include the object identifier for the PKIData content type. CCC SHOULD be included if constraints are to be placed on the content types generated. 🦋

If the RA-signed PKI Request contains a certification request for a P-256 public key, then the SignedData MUST be generated using either SHA-256 and ECDSA on P-256 or SHA-384 and ECDSA on P-384. If the request contains a certification request for a P-384 public key, then the SignedData MUST be generated using SHA-384 and ECDSA on P-384. If the RA-signed PKI Request contains requests for certificates on the P-256 and P-384 curve, then the SignedData MUST be generated using SHA-384 and ECDSA on P-384. If the Full PKI Response is a successful response to a PKI Request that only contained a Get Certificate or Get CRL control, then the SignedData MUST be signed by either SHA-256 and ECDSA on P-256 or SHA-384 and ECDSA on P-384, the algorithm used in the response MUST match the algorithm used in the request. 🔥

5.3. RA-Generated Errors

RA certificates authorized with the CCC certificate extension [RFC6010] MUST include the object identifier for the PKIResponse content type to authorize them to generate responses. 🌈

6. CA Requirements 👑

this section is the rulebook for CAs that receive PKI Requests and generate PKI Responses 💅.

6.1. CA Processing of PKI Requests

CAs conforming to this document MUST ensure that only the permitted signature, hash, and MAC algorithms described throughout this profile are used in requests; if they are not, the CA MUST reject those requests. The CA SHOULD return a CMCStatusInfoV2 control with CMCStatus of failed and a CMCFailInfo with the value of badAlg [RFC5272]. 💀

For requests involving an RA, the CA MUST verify the RA's authorization. The following certificate fields MUST NOT be modifiable using the Modify Certification Request control: publicKey and the key usage extension. The request MUST be rejected if an attempt to modify those certification request fields is present. The CA SHOULD return a CMCStatusInfoV2 control with CMCStatus of failed and a CMCFailInfo with a value of badRequest. 🙈

When processing end-entity-generated SignedData objects, CAs MUST NOT perform CCC certificate extension processing [RFC6010]. 🙅‍♀️

If the client-generated PKI Request includes a ChangeSubjectName attribute either in the CertRequest controls field for a CRMF request or in the tcr attributes field for a PKCS#10 request, then the CA MUST ensure that name change is authorized. The mechanism for ensuring that the name change is authorized is out of scope. If the CA performs this check, and the name change is not authorized, then the CA MUST reject the PKI Request. The CA SHOULD return a CMCStatusInfoV2 control with CMCStatus of failed. 🫶

Other processing of PKIRequests is as in [RFC5272]. ✨

6.2. CA-Generated PKI Responses

If a Full PKI Response is returned, it MUST be encapsulated in a SignedData, and the SignedData MUST be constructed as defined in [RFC6318]. 🦋

If the PKI Response is in response to an RA-encapsulated PKI Request, then the above PKI Response is encapsulated in another CA-generated PKI Response. That PKI Response MUST be encapsulated in a SignedData and the SignedData MUST be constructed as defined in [RFC6318]. The above PKI Response is placed in the encapsulating PKI Response cmsSequence field. The other fields are as above with the addition of the batch response control in controlSequence. The following illustrates a successful CA response to an RA-encapsulated PKI Request, both of which include Transaction IDs and Nonces: 🧚

   SignedData (applied by the CA)
     PKIData
       controlSequence (Transaction ID, Sender Nonce, Recipient
                        Nonce, Batch Response)
       cmsSequence
         SignedData (applied by CA and includes returned
                     certificates)
           PKIData
             controlSequence (Transaction ID, Sender Nonce,
                              Recipient Nonce)

The same private key used to sign certificates MUST NOT be used to sign Full PKI Response messages. Instead, a separate certificate authorized to sign CMC responses MUST be used. Certificates are authorized to sign Full PKI Responses with an EKU and/or with the CCC certificate extension [RFC6010]. Certificates may also be authorized through local configuration. Authorized certificates SHOULD include the id-kp-cmcCA EKU from [RFC6402]. Authorized certificates MAY also include the CCC certificate extension [RFC6010], or the authorized certificate MAY just include the CCC certificate extension. If the CA is authorized via the CCC extension, then the CCC extension MUST include the object identifier for the PKIResponse content type. CCC SHOULD be included if constraints are to be placed on the content types generated. 💜

The signature on the SignedData MUST be generated using either ECDSA P-256 on SHA-256 or ECDSA P-384 on SHA-384. If the Full PKI Response is a successful response to a P-256 public key certification request, then the SignedData MUST be generated using either SHA-256 and ECDSA on P-256 or SHA-384 and ECDSA on P-384. If the Full PKI Response is a successful response to a P-384 public key certification request, then the SignedData MUST be generated using SHA-384 and ECDSA on P-384. If the Full PKI Response is a successful response to certification requests on both the P-256 and P-356 curves, then the SignedData MUST be generated using SHA-384 and ECDSA on P-384. If the Full PKI Response is an unsuccessful response to a PKI Request, then the SignedData MUST be signed by either SHA-256 and ECDSA on P-256 or SHA-384 and ECDSA on P-384, the algorithm used in the response MUST match the algorithm used in the request. If the Full PKI Response is an unsuccessful response to certification requests on both the P-256 and P-356 curves, then the SignedData MUST be generated using SHA-384 and ECDSA on P-384. If the Full PKI Response is a successful response to a PKI Request that only contained a Get Certificate or Get CRL control, then the SignedData MUST be signed by either SHA-256 and ECDSA on P-256 or SHA-384 and ECDSA on P-384, the algorithm used in the response MUST match the algorithm used in the request. 🔥

If the PKI Response is in response to an RA-encapsulated PKI Request, the signature algorithm for each SignedData is selected independently. 🌸

7. Client Requirements: Processing PKI Responses ✨

okay bestie, clients that follow this doc MUST make sure that only the permitted signature, hash, and MAC algorithms described throughout this profile show up in responses 🔐. If they don't, the client MUST reject those responses 🙅‍♀️. no exceptions, periodt 💅

Clients MUST authenticate all Full PKI Responses 🛡️. That means checking that the PKI Response is signed by an authorized CA or RA whose certificate validates back to a trust anchor. The authorized CA certificate MUST include the id-kp-cmcCA EKU and/or include a CCC extension that includes the object identifier for the PKIResponse content type. Or, the CA is determined to be authorized to sign responses through an implementation-specific mechanism. The PKI Response can be signed by an RA if it is an error message, if it is a response to a Get Certificate or Get CRL request, or if the PKI Response contains an inner PKI Response signed by a CA. In that last case, each layer of PKI Response MUST still contain an authorized, valid signature signed by an entity with a valid certificate that verifies back to an acceptable trust anchor. The authorized RA certificate MUST include the id-kp-cmcRA EKU and/or include a CCC extension that includes the object identifier for the PKIResponse content type. Or, the RA is determined to be authorized to sign responses through an implementation-specific mechanism. 🌸

When a newly issued certificate shows up in the PKI Response, the client MUST verify that the newly issued certificate's public key matches the public key that the client requested 🔑. The client MUST also ensure that the certificate's signature is valid and that the signature validates back to an acceptable trust anchor. the chain has to be legit, bestie 🦋

Clients MUST reject PKI Responses that do not pass these tests. ❌ Local policy decides whether the client returns a Full PKI Response with an Extended CMC Status Info control with CMCStatus set to failed to a user console, an error log, or the server 📋.

If the Full PKI Response contains an Extended Status Info with a CMCStatus set to failed, then local policy decides whether the client resends a duplicate certification request back to the server, or whether an error state gets returned to a console or error log. it's giving "pick your own adventure" 🧚

8. Shared-Secrets 🤫

When the Identity Proof V2 and POP Link Witness V2 controls are used, the shared-secret MUST be randomly generated and securely distributed 🎀. The shared-secret MUST provide at least 128 bits of strength for P-256 certification requests, and at least 192 bits of strength for P-384 certification requests 💪. main character secret energy ✨

9. Security Considerations 🚨

okay this section is SERIOUS, bestie, so read it like it's your group chat's most important announcement 📢😭

Protocol security considerations live in [RFC2986], [RFC4211], [RFC6318], [RFC5272], [RFC5273], [RFC5274], [RFC5759], and [RFC6402]. When CCC is used to authorize RA and CA certificates, the security considerations in [RFC6010] also apply. Algorithm security considerations are found in [RFC6318] 🧠.

Compliant with NIST Special Publication 800-57 [SP80057], this profile defines proof-of-possession of a key establishment private key by performing a digital signature 🔏. Except for one-time proof-of-possession, a single key pair MUST NOT be used for both signature and key establishment. absolutely do not mix those up, bestie 🙅‍♀️

This specification requires implementations to generate key pairs and other random values 🎲. If the PRNG is inadequate, you can end up with little or no security, and that's a whole disaster 💀. Generating quality random numbers is genuinely hard. NIST Special Publication 800-90 [SP80090], FIPS 186-3 [DSS], and [RFC4086] offer random number generation guidance 📚, so go read them, babe.

When RAs are used, the list of authorized RAs must be securely distributed out-of-band to CAs 🗝️.

The presence of the POP Link Witness Version 2 and POP Link Random attributes protects against substitution attacks 🛡️✨.

The Certificate Policy for a particular environment will specify whether expired certificates can be used to sign certification requests 🗓️. check your policy, bestie.

10. Acknowledgments 🫶

Michael Peck wishes to acknowledge that he was employed at the National Security Agency during much of the work on this document 🙌.

11. References 📚

11.1. Normative References

[DSS] National Institute of Standards and Technology (NIST), FIPS 186-3: Digital Signature Standard (DSS), June 2009.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2986] Nystrom, M. and B. Kaliski, "PKCS #10: Certification Request Syntax Specification Version 1.7", RFC 2986, November 2000.
[RFC4086] Eastlake 3rd, D., Schiller, J., and S. Crocker, "Randomness Requirements for Security", BCP 106, RFC 4086, June 2005.
[RFC4211] Schaad, J., "Internet X.509 Public Key Infrastructure Certificate Request Message Format (CRMF)", RFC 4211, September 2005.
[RFC4231] Nystrom, M., "Identifiers and Test Vectors for HMAC-SHA-224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512", RFC 4231, December 2005.
[RFC5272] Schaad, J. and M. Myers, "Certificate Management over CMS (CMC)", RFC 5272, June 2008.
[RFC5273] Schaad, J. and M. Myers, "Certificate Management over CMS (CMC): Transport Protocols", RFC 5273, June 2008.
[RFC5274] Schaad, J. and M. Myers, "Certificate Management Messages over CMS (CMC): Compliance Requirements", RFC 5274, June 2008.
[RFC5754] Turner, S., "Using SHA2 Algorithms with Cryptographic Message Syntax", RFC 5754, January 2010.
[RFC5759] Solinas, J. and L. Zieglar, "Suite B Certificate and Certificate Revocation List (CRL) Profile", RFC 5759, January 2010.
[RFC6010] Housley, R., Ashmore, S., and C. Wallace, "Cryptographic Message Syntax (CMS) Content Constraints Extension", RFC 6010, September 2010.
[RFC6318] Housley, R. and J. Solinas, "Suite B in Secure/Multipurpose Internet Mail Extensions (S/MIME)", RFC 6318, June 2011.
[RFC6402] Schaad, J., "Certificate Management over CMS (CMC) Updates", RFC 6402, November 2011.

11.2. Informative References

[SP80057] National Institute of Standards and Technology (NIST), Special Publication 800-57 Part 1: Recommendation for Key Management, March 2007.
[SP80090] National Institute of Standards and Technology (NIST), Special Publication 800-90: Recommendation for Random Number Generation Using Deterministic Random Number Bits Generators (Revised), March 2007.

Appendix A. Scenarios 🧚‍♀️

this section shows off a few certificate enrollment and rekey scenarios this profile supports 🎀. It doesn't put any limits or restrictions on using CMC, so don't panic 🌈.

A.1. Initial Enrollment 🌱

this section covers three ways to authenticate initial enrollment requests:

Previously installed signature certificate (e.g., Manufacturer Installed Certificate);
Shared-secret distributed securely out-of-band;
RA authentication.

A.1.1. Previously Installed Signature Certificate 🔏

In this scenario, the end-entity had a signature certificate installed by the cryptographic module manufacturer 🏭. Since the end-entity already has a signature certificate, it can be used to authenticate a request for a new certificate. The end-entity signs the Full PKI Request with the private key that corresponds to the subject public key of a previously installed signature certificate. The CA recognizes the authorization of the previously installed certificate and issues an appropriate certificate to the end-entity 🥰.

A.1.2. Shared-Secret Distributed Securely Out-of-Band 🤫

In this scenario, the CA distributes a shared-secret out-of-band to the end-entity, and the end-entity uses it to authenticate its certification request. The end-entity signs the Full PKI Request with the private key for which the certification is being requested. The end-entity includes the Identity Proof Version 2 control to authenticate the request using the shared-secret. The CA uses either the Identification control or the Subject in the end-entity's enclosed PKCS #10 or CRMF certification request message to identify the request. The end-entity performs either the POP Link Witness Version 2 mechanism as described in [RFC5272], Section 6.3.1.1, or the Shared-Subject/Subject Distinguished Name (DN) linking mechanism as described in [RFC5272], Section 6.3.2. The Subject in the enclosed PKCS #10 or CRMF certification request does not necessarily match the issued certificate, since it may be used just to help identify the request (and corresponding shared-secret) to the CA 🧩.

A.1.3. RA Authentication 🙋‍♀️

In this scenario, the end-entity does not automatically authenticate its enrollment request to the CA, either because it has nothing to authenticate the request with or because organizational policy requires RA involvement 🏢. The end-entity creates a Full PKI Request and sends it to an RA. The RA verifies the authenticity of the request, then, if approved, encapsulates and signs the request as described in Section 5.2, forwarding the new request on to the CA 📨. The Subject in the PKCS #10 or CRMF certification request is not required to match the issued certificate. It may be used just to help identify the request to the RA and/or CA 🎯.

A.2. Rekey 🔄

There are two scenarios for rekeying certificates that are already enrolled 💫. One addresses the rekey of signature certificates, and the other addresses the rekey of key establishment certificates. Typically, organizational policy will require certificates to be currently valid in order to be rekeyed, and it may require initial enrollment to be repeated when rekey isn't possible. However, some organizational policies might allow a grace period during which an expired certificate could be used to rekey ⏳.

A.2.1. Rekey of Signature Certificates ✍️

When a signature certificate is rekeyed, the PKCS #10 or CRMF certification request message enclosed in the Full PKI Request will include the same Subject as the current signature certificate. The Full PKI Request will be signed by the current private key corresponding to the current signature certificate 🔐.

A.2.2. Rekey of Key Establishment Certificates 🗝️

When a key establishment certificate is rekeyed, the Full PKI Request will generally be signed by the current private key corresponding to the current signature certificate. If there is no current signature certificate, one of the initial enrollment options in Appendix A.1 may be used 🌷.

Authors' Addresses 💌

Lydia Zieglar National Information Assurance Research Laboratory National Security Agency

EMail: llziegl@tycho.ncsc.mil

Sean Turner IECA, Inc. 3057 Nutley Street, Suite 106 Fairfax, VA 22031 USA

EMail: turners@ieca.com

Michael Peck

EMail: mpeck@alumni.virginia.edu

📦 where this page comes from

ietf: rfc6403 2011-11
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms