RFC 6488
Signed Object Template for the Resource Public Key Infrastructure (RPKI)
Abstract ✨
This document defines a generic profile for signed objects used in the Resource Public Key Infrastructure (RPKI). These RPKI signed objects use Cryptographic Message Syntax (CMS) as their standard encapsulation format. 🎀
Title Block 📜
RFC 6488: Signed Object Template for the Resource Public Key Infrastructure (RPKI) 💖
- Request for Comments: 6488 🌸
- Authors: M. Lepinski, A. Chi, S. Kent (all from BBN) 🫶
- Category: Standards Track 🦋
- ISSN: 2070-1721 ✨
- Date: February 2012 🧚
- Obsoletes / Updates: the header doesn't list either one, so this doc doesn't say it replaces or updates anything 🙈
Status of This Memo 🍓
This is an Internet Standards Track document. 🔥
It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). For more on Internet Standards, check Section 2 of RFC 5741 💅
Info about the current status of this doc, any errata, and how to send feedback is at http://www.rfc-editor.org/info/rfc6488 💜
Copyright Notice 🌈
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. ✨
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these documents carefully, because they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License. 💖
Table of Contents 🗂️
1. Introduction ....................................................2
1.1. Terminology ................................................3
1.2. Note on Algorithms .........................................3
2. Signed Object Syntax ............................................3
2.1. Signed-Data Content Type ...................................4
2.1.1. version .............................................4
2.1.2. digestAlgorithms ....................................4
2.1.3. encapContentInfo ....................................4
2.1.3.1. eContentType ...............................5
2.1.3.2. eContent ...................................5
2.1.4. certificates ........................................5
2.1.5. crls ................................................5
2.1.6. signerInfos .........................................5
2.1.6.1. version ....................................6
2.1.6.2. sid ........................................6
2.1.6.3. digestAlgorithm ............................6
2.1.6.4. signedAttrs ................................6
2.1.6.4.1. Content-Type Attribute ..........7
2.1.6.4.2. Message-Digest Attribute ........7
2.1.6.4.3. Signing-Time Attribute ..........7
2.1.6.4.4. Binary-Signing-Time Attribute ...8
2.1.6.5. signatureAlgorithm .........................8
2.1.6.6. signatureValue .............................8
2.1.6.7. unsigneAttrs ...............................8
3. Signed Object Validation ........................................8
4. Definition of Specific Signed Objects ..........................10
5. Security Considerations ........................................10
6. IANA Considerations ............................................11
7. Acknowledgements ...............................................11
8. Normative References ...........................................11
9. Informative References .........................................121. Introduction 🦋
The whole point of the Resource Public Key Infrastructure (RPKI) is to let current resource holders make assertions about their IP address space (IPv4 and IPv6) and AS numbers. The records come from organizations that act as Certification Authorities (CAs). IP address and AS number info lives in X.509 certificates through the RFC 3779 extensions [RFC6487]. Other assertions about resources are expressed through digitally signed, non-X.509 data structures, which the RPKI calls "signed objects" [RFC6480]. This document standardizes a template for specifying signed objects that can be validated using the RPKI. 🌸
RPKI signed objects use Cryptographic Message Syntax (CMS) [RFC5652] as their standard encapsulation format. CMS was picked because there's already open source software out there for processing messages in this format, which is so practical 💅 RPKI signed objects follow a profile (specified in Section 2) of the CMS signed-data object. ✨
The template in this document is not a complete spec for any one type of signed object. It only includes the stuff that's common to all RPKI signed objects. Fully specifying a particular type takes an additional document with the details for that type. Those details include Abstract Syntax Notation One (ASN.1) [X.208-88] for the object's payload, plus any extra steps needed to validate that type of signed object. Section 4 goes into more detail about the extra pieces you have to specify to define a new type of RPKI signed object using this template. For an example of a document that uses this template for a specific type, see [RFC6482], which covers the Route Origination Authorization (ROA). 🧚
1.1. Terminology 📚
You're expected to already know the terms and concepts from "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile" [RFC5280], "X.509 Extensions for IP Addresses and AS Identifiers" [RFC3779], and "Cryptographic Message Syntax (CMS)" [RFC5652]. 🤓
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 💖
1.2. Note on Algorithms 🔐
CMS is a general format that can handle a huge variety of signature and digest algorithms. The algorithms used in the RPKI, along with their key sizes, are specified in [RFC6485]. 💅
2. Signed Object Syntax 🎀
The RPKI signed object is a profile of the CMS [RFC5652] signed-data object, with one big restriction: RPKI signed objects MUST be encoded using the ASN.1 Distinguished Encoding Rules (DER) [X.509-88]. No cap, the encoding is not optional 😭
The general format of a CMS object looks like this:
ContentInfo ::= SEQUENCE {
contentType ContentType,
content [0] EXPLICIT ANY DEFINED BY contentType }
ContentType ::= OBJECT IDENTIFIERThe content type is the signed-data type of id-data, namely the id-signedData OID [RFC5652], 1.2.840.113549.1.7.2. 🦋
2.1. Signed-Data Content Type 🌈
According to the CMS standard, the signed-data content type is the ASN.1 type SignedData:
SignedData ::= SEQUENCE {
version CMSVersion,
digestAlgorithms DigestAlgorithmIdentifiers,
encapContentInfo EncapsulatedContentInfo,
certificates [0] IMPLICIT CertificateSet OPTIONAL,
crls [1] IMPLICIT RevocationInfoChoices OPTIONAL,
signerInfos SignerInfos }
DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier
SignerInfos ::= SET OF SignerInfoAlso, the SignerInfos set MUST contain only a single SignerInfo object. One signer, one vibe 👑
2.1.1. version 🌸
The version is the syntax version number. It MUST be 3, which matches the signerInfo structure having version number 3. ✨
2.1.2. digestAlgorithms 🍓
The digestAlgorithms set holds the OIDs of the digest algorithm(s) used when signing the encapsulated content. This set MUST contain exactly one digest algorithm OID, and that OID MUST be selected from the ones specified in [RFC6485]. Exactly one, bestie 💅
2.1.3. encapContentInfo 💜
encapContentInfo is the signed content. It's made up of a content type identifier and the content itself. The encapContentInfo is the payload of the RPKI signed object. 🎁
EncapsulatedContentInfo ::= SEQUENCE {
eContentType ContentType,
eContent [0] EXPLICIT OCTET STRING OPTIONAL }
ContentType ::= OBJECT IDENTIFIER2.1.3.1. eContentType 🧚
This profile leaves this field undefined. The eContentType is an OID that specifies the type of payload in this signed object. It MUST be specified by the Internet Standards Track document that defines the object. 📜
2.1.3.2. eContent 🫶
This profile leaves this field undefined too. The eContent is the payload of the signed object. It MUST be specified by the Internet Standards Track document that defines the RPKI object. 🎀
Heads up: the signed object profile doesn't give signed objects version numbers. So, to make it easier to move to new versions of the signed objects over time, it is RECOMMENDED that each type of signed object defined using this profile include a version number within its eContent. Future-proofing is everything 🔮
2.1.4. certificates 🦋
The certificates field MUST be included, and it MUST contain exactly one certificate: the RPKI end-entity (EE) certificate needed to validate this signed object. One EE cert, that's the whole list 🪪
2.1.5. crls ✨
The crls field MUST be omitted. Nothing to see here, no CRLs allowed 🙅♀️
2.1.6. signerInfos 💖
SignerInfo is defined in CMS like this:
SignerInfo ::= SEQUENCE {
version CMSVersion,
sid SignerIdentifier,
digestAlgorithm DigestAlgorithmIdentifier,
signedAttrs [0] IMPLICIT SignedAttributes OPTIONAL,
signatureAlgorithm SignatureAlgorithmIdentifier,
signature SignatureValue,
unsignedAttrs [1] IMPLICIT UnsignedAttributes OPTIONAL }2.1.6.1. version 🌸
The version number MUST be 3. That matches the choice of SubjectKeyIdentifier for the sid. Everything lines up 🫶
2.1.6.2. sid 🍓
The sid is defined as:
SignerIdentifier ::= CHOICE {
issuerAndSerialNumber IssuerAndSerialNumber,
subjectKeyIdentifier [0] SubjectKeyIdentifier }For RPKI signed objects, the sid MUST be the SubjectKeyIdentifier that appears in the EE certificate carried in the CMS certificates field. So the signer is identified by the EE cert's key, and that's the only way it's identified 🔑
2.1.6.3. digestAlgorithm 🌈
The digestAlgorithm MUST consist of the OID of a digest algorithm that conforms to the RPKI Algorithms and Key Size Profile specification [RFC6485]. Only the approved algorithms get to play 💅
(Part 1 ends here. Part 2 picks up with the rest of Section 2.1.6, and the parts after it. ✨💜)
2.1.6.4. signedAttrs ✨
okay so signedAttrs is basically the VIP list of the whole signature 👑 here's the shape:
SignedAttributes ::= SET SIZE (1..MAX) OF Attribute
Attribute ::= SEQUENCE {
attrType OBJECT IDENTIFIER,
attrValues SET OF AttributeValue }
AttributeValue ::= ANYbestie, signedAttrs is non-negotiable 💅 it MUST be present, and it MUST include the content-type and message-digest attributes [RFC5652]. the signer MAY also add the signing-time attribute [RFC5652], the binary-signing-time attribute [RFC6019], or both 🕰️ but other signed attributes MUST NOT be included. no plus-ones 🙅♀️
the signedAttrs element MUST include only a single instance of any particular attribute, so no duplicates 👯 and even though the syntax technically lets a SET OF AttributeValue hold more, in an RPKI signed object the attrValues MUST consist of only a single AttributeValue. one value, periodt 💖
2.1.6.4.1. Content-Type Attribute
the content-type attribute MUST be present 🎀 its attrType OID is 1.2.840.113549.1.9.3.
the attrValues for the content-type attribute MUST match the eContentType in the EncapsulatedContentInfo. so basically, attrValues MUST contain the OID that names the payload type of the specific RPKI signed object sitting inside the CMS signed data structure 🧚
2.1.6.4.2. Message-Digest Attribute
the message-digest attribute MUST be present 💅 its attrType OID is 1.2.840.113549.1.9.4.
the attrValues for the message-digest attribute holds the output of the digest algorithm run over the content being signed, as specified in Section 5.4 of [RFC5652]. it's giving fingerprint energy 🫶
2.1.6.4.3. Signing-Time Attribute
the signing-time attribute MAY be present 🌸 but the presence or absence of the signing-time attribute MUST NOT affect the validity of the signed object (as specified in Section 3). its attrType OID is 1.2.840.113549.1.9.5.
id-signingTime OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs9(9) 5 }the attrValues for the signing-time attribute is defined as:
SigningTime ::= Time
Time ::= CHOICE {
utcTime UTCTime,
generalizedTime GeneralizedTime }the Time element is the time, read off the local system clock, at which the digital signature got applied to the content ⏰
the definition of Time matches the one in the 1997 version of X.509. more info on UTCTime and GeneralizedTime lives in [RFC5652] if you're curious 🤓
2.1.6.4.4. Binary-Signing-Time Attribute
the binary-signing-time attribute MAY be present ✨ and the presence or absence of the binary-signing-time attribute MUST NOT affect the validity of the signed object (as specified in Section 3). its attrType OID is 1.2.840.113549.1.9.16.2.46.
id-aa-binarySigningTime OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) aa(2) 46 }the attrValues for the signing-time attribute is defined as:
BinarySigningTime ::= BinaryTime
BinaryTime ::= INTEGER (0..MAX)the BinaryTime element is again the time from the local system clock when the digital signature got applied to the content. the precise definition of BinaryTime is in [RFC6019] 🦋
2.1.6.5. signatureAlgorithm
the signatureAlgorithm MUST conform to the RPKI Algorithms and Key Size Profile specification [RFC6485] 🔥
2.1.6.6. signature
SignatureValue ::= OCTET STRINGthe signature characteristics are defined by the digest and signature algorithms 💜
2.1.6.7. unsignedAttrs
unsignedAttrs MUST be omitted. not even a little bit 🙈
3. Signed Object Validation ✨
okay this part is the bouncer 🚪 before a relying party can use a signed object, the relying party MUST validate it by checking that all of the following conditions hold. the checks can happen in any order, and they're necessary but not sufficient. further validation MUST be performed based on the specific type of signed object, so the bouncer's not done yet 💅
- the signed object syntax complies with this specification. specifically, each of these is true:
- a. the content-type of the CMS object is SignedData (OID
1.2.840.113549.1.7.2) - b. the version of the SignedData object is 3.
- c. the certificates field in the SignedData object is present and contains one EE certificate, whose SubjectKeyIdentifier field matches the sid field of the SignerInfo object.
- d. the crls field in the SignedData object is omitted.
- e. the version of the SignerInfo is 3.
- f. the signedAttrs field in the SignerInfo object is present and contains both the content-type attribute (OID
1.2.840.113549.1.9.3) and the message-digest attribute (OID1.2.840.113549.1.9.4). - g. the signedAttrs field in the SignerInfo object does not contain any attributes other than these four: the content-type attribute (OID
1.2.840.113549.1.9.3), the message-digest attribute (OID1.2.840.113549.1.9.4), the signing-time attribute (OID1.2.840.113549.1.9.5), and the binary-signing-time attribute (OID1.2.840.113549.1.9.16.2.46). note that the signing-time and binary-signing-time attributes MAY be present, but they are not required. - h. the eContentType in the EncapsulatedContentInfo is an OID that matches the attrValues in the content-type attribute.
- i. the unsignedAttrs field in the SignerInfo object is omitted.
- j. the digestAlgorithm in the SignedData and SignerInfo objects conforms to the RPKI Algorithms and Key Size Profile specification [RFC6485].
- k. the signatureAlgorithm in the SignerInfo object conforms to the RPKI Algorithms and Key Size Profile specification [RFC6485].
- l. the signed object is DER encoded.
- a. the content-type of the CMS object is SignedData (OID
- the public key of the EE certificate (contained within the CMS signed-data object) can be used to successfully verify the signature on the signed object.
- the EE certificate (contained within the CMS signed-data object) is a valid EE certificate in the RPKI as specified by [RFC6487]. specifically, a valid certification path from a trust anchor to this EE certificate exists.
if the procedure above says the signed object is invalid, then the signed object MUST be discarded and treated as though no signed object were present 🗑️ if all the conditions above are true, then the signed object may be valid. the relying party MUST then perform any additional validation steps required for the particular type of signed object 💖
note that a previously valid signed object will stop being valid when the associated EE certificate stops being valid (for example, when the end of the certificate's validity period is reached, or when the issuing authority revokes the certificate). see [RFC6487] for the full scoop on resource certificate validity 📜
4. Definition of Specific Signed Objects 🌈
each RPKI signed object MUST be defined in an Internet Standards Track document based on this profile, and that document has to spell out the following data elements and validation procedure:
- eContentType: a single OID used for both the eContentType field and the content-type attribute. this OID uniquely identifies the type of signed object 🧾
- eContent: define the syntax for the eContent field in encapContentInfo. this is the payload carrying the data specific to a given type of signed object 📦
- Additional Validation: define a set of additional validation steps for the specific signed object. before using this specific signed object, a relying party MUST perform both the generic validation steps in Section 3 above, as well as these additional steps 🔍
5. Security Considerations 💀
okay, serious moment incoming 🙏 there is no assumption of confidentiality for the data in an RPKI signed object. the integrity and authenticity of each signed object rest on verifying the object's digital signature and on validating the EE certificate used for that verification. it's anticipated that signed objects will be stored in repositories that are publicly accessible, so everyone can see them 👀
since RPKI signed objects use CMS as their encapsulation format, the security considerations for CMS apply too [RFC5652]. read that one, it's not optional 😭
6. IANA Considerations 🦋
IANA has created a registry of "RPKI Signed Objects" types that use the template defined in this document. the registry has three fields: an informal name for the signed object, the OID for the eContentType of the signed object, and a specification pointer that references the RFC where the signed object is specified. entries in this registry are managed by IETF Standards Action 🏛️
the registry was initially populated with these two entries:
Name | OID | Specification
----------------------------------------------------------------
ROA | 1.2.840.113549.1.9.16.1.24 | RFC 6482
Manifest | 1.2.840.113549.1.9.16.1.26 | RFC 64867. Acknowledgements 🫶
the authors want to thank Charles Gardiner, Russ Housley, and Derek Kong for their help and contributions 💕 they also want to thank Rob Austein, Roque Gagliano, Danny McPherson, Sean Turner, and Sam Weiler for their careful reviews and helpful comments 🌷
8. Normative References 📚
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP Addresses and AS Identifiers", RFC 3779, June 2004.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008.
[RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", STD 70, RFC 5652, September 2009.
[RFC6485] Huston, G., "The Profile for Algorithms and Key Sizes for Use in the Resource Public Key Infrastructure (RPKI)", RFC 6485, February 2012.
[RFC6487] Huston, G., Michaelson, G., and R. Loomans, "A Profile for X.509 PKIX Resource Certificates", RFC 6487, February 2012.
[X.208-88] CCITT. Recommendation X.208: Specification of Abstract Syntax Notation One (ASN.1), 1988.
[X.509-88] CCITT. Recommendation X.509: The Directory Authentication Framework, 1988.
9. Informative References 💌
[RFC6019] Housley, R., "BinaryTime: An Alternate Format for Representing Date and Time in ASN.1", RFC 6019, September 2010.
[RFC6480] Lepinski, M. and S. Kent, "An Infrastructure to Support Secure Internet Routing", RFC 6480, February 2012.
[RFC6482] Lepinski, M., Kent, S., and D. Kong, "A Profile for Route Origin Authorizations (ROAs)", RFC 6482, February 2012.
Authors' Addresses 🌟
Matt Lepinski BBN Technologies 10 Moulton Street Cambridge MA 02138
EMail: mlepinski@bbn.com
Andrew Chi BBN Technologies 10 Moulton Street Cambridge MA 02138
EMail: achi@bbn.com
Stephen Kent BBN Technologies 10 Moulton Street Cambridge MA 02138
EMail: kent@bbn.com
📦 where this page comes from
- ietf: rfc6488 2012-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms