RFC 6664
S/MIME Capabilities for Public Key Definitions
RFC 6664: S/MIME Capabilities for Public Key Definitions ✨
okay bestie, title block time 🎀 this one is from the Internet Engineering Task Force (IETF), written by J. Schaad at Soaring Hawk Consulting. It's marked Informational, which means it's published for info and is NOT a standards track spec 🌸. It's dated July 2012, with ISSN 2070-1721. The title block doesn't list anything it obsoletes or updates, so there's no other RFC it replaces or changes 💅
Abstract 💖
this doc defines a set of Secure/Multipurpose Internet Mail Extensions (S/MIME) Capability types for ASN.1 encoding, covering the current set of public keys that the PKIX working group defined. the whole point is that a requester can say what public keys and signature algorithms it wants to see in responses ✨ "Online Certificate Status Protocol Algorithm Agility" (RFC 6277) has an example of this in action 🦋
Status of This Memo 🧚
this is NOT an Internet Standards Track spec. it's just published for informational purposes 📚
this doc is a product of the Internet Engineering Task Force (IETF). it represents the consensus of the IETF community, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). not every IESG-approved doc is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 if you're curious 🙈
for the latest on this doc's status, errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc6664 🔥
Copyright Notice 🌈
Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. 🫶
this doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they were on the publication date. please actually read these, bestie, because they spell out your rights and restrictions for this doc 👑
code components pulled out of this doc must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, same as the Simplified BSD License says 💀
Table of Contents 📖
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. ASN.1 Notation . . . . . . . . . . . . . . . . . . . . . . 3
1.2. Requirements Terminology . . . . . . . . . . . . . . . . . 4
2. RSA Public Keys . . . . . . . . . . . . . . . . . . . . . . . 4
2.1. Generic RSA Public Keys . . . . . . . . . . . . . . . . . 4
2.2. RSASSA-PSS Signature Public Keys . . . . . . . . . . . . . 5
2.3. RSAES-OAEP Key Transport Public Keys . . . . . . . . . . . 6
3. Diffie-Hellman Keys . . . . . . . . . . . . . . . . . . . . . 7
3.1. DSA Signature Public Key . . . . . . . . . . . . . . . . . 7
3.2. DH Key Agreement Keys . . . . . . . . . . . . . . . . . . 8
4. Elliptic Curve Keys . . . . . . . . . . . . . . . . . . . . . 8
4.1. Generic Elliptic Curve Keys . . . . . . . . . . . . . . . 9
4.2. Elliptic Curve DH Keys . . . . . . . . . . . . . . . . . . 10
4.3. Elliptic Curve MQV Keys . . . . . . . . . . . . . . . . . 10
5. RSASSA-PSS Signature Algorithm Capability . . . . . . . . . . 10
6. Security Considerations . . . . . . . . . . . . . . . . . . . 12
7. References . . . . . . . . . . . . . . . . . . . . . . . . . . 13
7.1. Normative References . . . . . . . . . . . . . . . . . . . 13
7.2. Informative References . . . . . . . . . . . . . . . . . . 13
Appendix A. 2008 ASN.1 Module . . . . . . . . . . . . . . . . . . 15
Appendix B. 1988 ASN.1 Module . . . . . . . . . . . . . . . . . . 18
Appendix C. Future Work . . . . . . . . . . . . . . . . . . . . . 191. Introduction 🦋
so the OCSP agility problems in [RFC6277] made everyone go "ugh, we really need a way to describe what info to use when picking a public key" 😭 but there was no way to do that. this doc fixes that hole by defining a set of S/MIME Capability types for a small set of public key representations ✨
S/MIME capabilities were first defined in [SMIMEv3-MSG] as a way for the sender of an S/MIME message to tell the recipient which encryption algorithms the sender's system supported 💅 at first it was mostly about encryption algorithms, but it grew over time. now a client can say it supports newer stuff like the compression data type and binary encoded contents 🌸 the structure also lets you pass parameters inside a capability so you can use subsets of algorithms. that got used for the RC2 encryption algorithm, even though only two of its values were ever actually used 🙈 the whole goal of restricting the set of values is so a client can do a simple binary comparison to check for equality. the client should never need to decode the capability and compare it element by element 🧚 and honestly, this hasn't been a problem, because most S/MIME capabilities are just the algorithm identifier by itself, no cap 💖
lowkey this is a big one: lots of people think an object identifier can only ever map to a single data structure, but that's not true ✨ for example, the OID rsaEncryption shows up in multiple places for different data. it represents a public key, it represents a key transport algorithm (in S/MIME), and it was originally used in the Public-Key Cryptography Standards (PKCS) #7 specification as a signature value identifier (S/MIME specs have since changed that) 🌈 so the takeaway is that when you map an object identifier to a data type structure, you also have to consider where it sits in the ASN.1 structure 🫶
1.1. ASN.1 Notation 📝
the main body of the text uses ASN.1 snippets pulled from the ASN.1 2008 module in Appendix A. ASN.1 2008 is used because it directly represents metadata that the 1988 version of ASN.1 can't represent, and that metadata is part of the text instead 🦋 following the current PKIX working group policy, the 1988 module along with the text is the normative module. if the two modules ever conflict, the 1988 module wins 👑
when you read this doc, it's assumed you already know the basic object module from Section 3 of RFC 5912 [RFC5912]. we use the SMIME-CAPS object here, which pairs two fields together in one object 💅
SMIME-CAPS ::= CLASS {
&id OBJECT IDENTIFIER UNIQUE,
&Type OPTIONAL
}
WITH SYNTAX { [TYPE &Type] IDENTIFIED BY &id }the fields are:
&idholds an object identifier. when it's placed in an object set, this element gets tagged so no two elements in the set can have the same value in the&idfield. this is NOT a rule saying only one object can exist with a given object identifier 🙈&Typeoptionally holds an ASN.1 type identifier. if&Typeisn't defined, the optional parameters field of the AlgorithmIdentifier type gets left out 🌸
the class also has its own special syntax for defining an object in it. the all-uppercase words TYPE IDENTIFIER and BY are just syntactic sugar to make things easier to read. the square brackets mark optional pieces of the syntax ✨
the ASN.1 syntax lets any field in an object be referenced somewhere else. so if an object called foo has a field named &value, you can reference the value directly as foo.&value. that means any updates to values or types get propagated automatically, and we don't have to copy the data around 🧚
1.2. Requirements Terminology 🎀
when they're capitalized, the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💖
2. RSA Public Keys 🔥
right now there are three different public key object identifiers for RSA public keys 🌈 they're RSA, RSA Encryption Scheme - Optimal Asymmetric Encryption Padding (RSAES-OAEP), and RSA Signature Scheme with Appendix - Probabilistic Signature Scheme (RSASSA-PSS) 💅
2.1. Generic RSA Public Keys 🦋
almost all RSA keys in certificates today use the generic RSA public key format and identifier 👑 that lets the key be used for both key transport and signature validation (as long as it's compatible with the bits in the key usage extension) ✨ the only reason to use one of the more specific public key identifiers is if you want to restrict the RSA public key to one specific algorithm 🙈
for the generic RSA public key, the S/MIME capability that gets advertised is a request for a specific key size to be used 🌸 this would normally come up when dealing with a request for a key that the client would then use to verify a signature 🧚 in general, the user would supply a specific key when a key transport algorithm is being considered 💖
the ASN.1 for the generic RSA public key is defined below 📝
scap-pk-rsa SMIME-CAPS ::= {
TYPE RSAKeyCapabilities
IDENTIFIED BY pk-rsa.&id
}
RSAKeyCapabilities ::= SEQUENCE {
minKeySize RSAKeySize,
maxKeySize RSAKeySize OPTIONAL
}
RSAKeySize ::= INTEGER (1024 | 2048 | 3072 | 4096 | 7680 |
8192 | 15360, ...)so in the ASN.1 above, here's what's going on 🫶
scap-pk-rsais a new SMIME-CAPS object. it links the existing object identifier (rsaEncryption), which is used for the public key in certificates (defined in [RFC3279] and [RFC5912]), with a new type defined in this doc 🦋RSAKeyCapabilitiescarries the set of desired capabilities for an RSA key. its fields are:minKeySizeholds the minimum length of the RSA modulus to be used. this field SHOULD NOT contain a value less than 1024 ⚠️maxKeySizeholds the maximum length of the RSA modules that should be used. if this field is absent, no maximum length is requested or expected. this value is normally picked so the current code doesn't run unacceptably long when processing signatures 🌈
RSAKeySizegives a set of suggested values to use. the values 1024, 2048, 3072, 7680, and 15360 come from the NIST guide on signature sizes [NIST-SIZES], while the others are common powers of two that get used. the list isn't closed, so other values can be used too ✨
theSHOULD NOTonminKeySizeis the one to remember, bestie: don't go under 1024 💅
(part 2 is next, so stay tuned 🧚💜)
2.2. RSASSA-PSS Signature Public Keys
Most of the time you'll see the generic RSA public key identifier in a certificate 🎀, but the RSASSA-PSS one is there if the key owner wants to lock the key down to just this algorithm 🔒. Technically this algorithm can stash a set of algorithm parameters in the public key info structure, but they're not put there here, because that same info is supposed to ride along in the signature S/MIME capabilities instead ✨.
Here's the ASN.1 for the RSASSA-PSS public key 💅:
scap-pk-rsaSSA-PSS SMIME-CAPS ::= {
TYPE RSAKeyCapabilities
IDENTIFIED BY pk-rsaSSA-PSS.&id
}So, breaking down what's happening 🧠:
scap-pk-rsaSSA-PSSis a brand new SMIME-CAPS object 🆕. It links the existing object identifier (id-RSASSA-PSS), which is already used for public key certificates (defined in [RFC4055] and [RFC5912]), with the typeRSAKeyCapabilities.
2.3. RSAES-OAEP Key Transport Public Keys
Same energy as the last one 💖. Most of the time the generic RSA public key identifier does the job in a certificate, but the RSAES-OAEP identifier is there if the key owner wants to restrict the key to just this algorithm 🦋. Parameters could go in the public key info structure, but they're left out, because that info is meant to be carried in the key transport S/MIME capabilities instead 🫶.
The ASN.1 for the RSAES-OAEP public key:
scap-pk-rsaES-OAEP SMIME-CAPS ::= {
TYPE RSAKeyCapabilities
IDENTIFIED BY pk-rsaES-OAEP.&id
}In that ASN.1 🌸:
scap-pk-rsaES-OAEPis a new SMIME-CAPS object. It ties the existing object identifier (id-RSAES-OAEP), used for public key certificates (defined in [RFC4055] and [RFC5912]), to the typeRSAKeyCapabilities.
3. Diffie-Hellman Keys 🌊
Right now there are two Diffie-Hellman (DH) public key object identifiers: DH key agreement and Digital Signature Standard (DSA) 💧.
3.1. DSA Signature Public Key
This public key type is for validating DSA signatures 🖋️.
The ASN.1 for DSA keys:
scap-pk-dsa SMIME-CAPS ::= {
TYPE DSAKeyCapabilities
IDENTIFIED BY pk-dsa.&id
}
DSAKeyCapabilities ::= CHOICE {
keySizes [0] SEQUENCE {
minKeySize DSAKeySize,
maxKeySize DSAKeySize OPTIONAL,
maxSizeP [1] INTEGER OPTIONAL,
maxSizeQ [2] INTEGER OPTIONAL,
maxSizeG [3] INTEGER OPTIONAL
},
keyParams [1] pk-dsa.&Params
}
DSAKeySize ::= INTEGER (1024 | 2048 | 3072 | 7680 | 15360 )Here's the rundown 📋:
scap-pk-dsais a new SMIME-CAPS object 🆕. It links the existing object identifier (id-dsa), used for the public key in certificates (defined in [RFC3279] and [RFC5912]), with a new type we're defining here,DSAKeyCapabilities.DSAKeyCapabilitiescarries the set of capabilities wanted for the DSA key. Its fields are:keySizesis for when you only need to specify a key size and not a specific group. This is expected to be the more popular of the two options 👑. For key sizes, the fields work like this:minKeySizeholds the minimum length of the DSA modulus to be used.maxKeySizeholds the maximum length of the DSA modules that should be used. If this field is absent, then no maximum length is requested or expected.maxSizePholds the maximum length of the value p that should be used. If this field is absent, then no maximum length is imposed.maxSizeQholds the maximum length of the value q that should be used. If this field is absent, then no maximum length is imposed.maxSizeGholds the maximum length of the value g that should be used. If this field is absent, then no maximum length is imposed.
keyParamsholds the exact set of DSA parameters for the key used to sign the message. It's here for completeness and to match the Elliptic Curve fields 🙈, but using it is expected to be extremely rare 💀.
3.2. DH Key Agreement Keys
This public key type goes with the DH key agreement algorithm 🍓.
The ASN.1 for DH keys:
scap-pk-dh SMIME-CAPS ::= {
TYPE DSAKeyCapabilities
IDENTIFIED BY pk-dh.&id
}In that ASN.1 ✨:
scap-pk-dhis a new SMIME-CAPS object. It associates the existing object identifier (dhpublicnumber), used for the public key algorithm in certificates (defined in [RFC3279] and [RFC5912]), with the new type defined above,DSAKeyCapabilities.
4. Elliptic Curve Keys 🦋
There are currently three Elliptic Curve Cryptography (ECC) public key object identifiers: EC, EC-DH, and Elliptic Curve Menezes-Qu-Vanstone (EC-MQV) 🌈.
4.1. Generic Elliptic Curve Keys
Almost every ECC key in a certificate today uses the generic ECC public key format and identifier 🎀. That lets the key be used for both key agreement and signature validation (as long as the right bits are in the certificate). The only reason to use one of the more specific public key identifiers is if the user wants to restrict the ECC key to one specific algorithm 🔒.
For the generic ECC public key, the S/MIME capability that gets advertised is a request for a specific group to be used 💜.
The ASN.1 for the generic ECC public key:
scap-pk-ec SMIME-CAPS ::= {
TYPE EC-SMimeCaps
IDENTIFIED BY pk-ec.&id
}
EC-SMimeCaps ::= SEQUENCE (SIZE (1..MAX)) OF ECParametersIn that ASN.1 🧩:
scap-pk-ecis a new SMIME-CAPS object. It associates the existing object identifier (id-ecPublicKey), used for the public key algorithm in certificates (defined in [RFC5480] and [RFC5912]), with the new typeEC-SMimeCaps.EC-SMimeCapscarries a sequence of at least oneECParametersstructure. That means you can request multiple curves in a single capability request 🙌. There's no maximum/minimum style of sizing here, because picking a specific curve takes way more care than making the parameters for a DSA/DH key 🫠. As specified in [RFC5480], for PKIX-compliant certificates, only thenamedCurvechoice ofECParametersis expected to be used.
4.2. Elliptic Curve DH Keys
This public key type is for the Elliptic Curve Diffie-Hellman key agreement algorithm 🌸.
The ASN.1 for EC-DH keys:
scap-pk-ecDH SMIME-CAPS ::= {
TYPE EC-SMimeCaps
IDENTIFIED BY pk-ecDH.&id
}In that ASN.1 🍒:
scap-pk-ecDHis a new SMIME-CAPS object. It associates the existing object identifier (id-ecDH), used for the public key algorithm in the certificate (defined in [RFC5480] and [RFC5912]), with the same type structure used for public keys.
4.3. Elliptic Curve MQV Keys
This public key type is for the Elliptic Curve MQV key agreement algorithm 🪄.
The ASN.1 for EC-MQV keys:
scap-pk-ecMQV SMIME-CAPS ::= {
TYPE EC-SMimeCaps
IDENTIFIED BY pk-ecMQV.&id
}In that ASN.1 💫:
scap-pk-ecMQVis a new SMIME-CAPS object. It associates the existing object identifier (id-ecMQV), used for the public key algorithm in the certificate (defined in [RFC5480] and [RFC5912]), with the same type structure used for public keys.
5. RSASSA-PSS Signature Algorithm Capability 👑
This document defines a new SMIMECapability for the RSASSA-PSS signature algorithm 🎉. One already exists in [RFC4055], but there the parameters field isn't used.
When the S/MIME group defined an S/MIME capability for RSASSA-PSS, it did so in the context of how S/MIME defines and uses capabilities 🧐. In an S/MIME message [SMIME-MSG] or a certificate [RFC4262], capabilities always show up in a sequence. So you could put the RSASSA-PSS identifier in that sequence next to the identifiers for MD5, SHA-1, and SHA-256 😬. The assumption was that you could work out every combination in the matrix, and that the publisher would support every element of it. The catch is that the publisher could accidentally advertise a point in that matrix that they don't actually support 😭.
So here, there's only a single item being published 🎯. That means all the related info has to be published together with the signature algorithm identifier, in one entity. For that reason, we now define a new parameter type to use as the SMIMECapability type. It holds a hash identifier and a mask identifier 🔥. The ASN.1 looks like this:
scap-sa-rsaSSA-PSS SMIME-CAPS ::= {
TYPE RsaSsa-Pss-sig-caps
IDENTIFIED BY sa-rsaSSA-PSS.&id
}
RsaSsa-Pss-sig-caps ::= SEQUENCE {
hashAlg SMIMECapability{{ MaskAlgorithmSet }},
maskAlg SMIMECapability{{ ... }} OPTIONAL,
trailerField INTEGER DEFAULT 1
}
scap-mf-mgf1 SMIME-CAPS ::= {
TYPE SMIMECapability{{ ... }}
IDENTIFIED BY id-mgf1
}
MaskAlgorithmSet SMIME-CAPS ::= {scap-mf-mgf1, ...}In that ASN.1 🧾:
scap-sa-rsaSSA-PSSis a new SMIME-CAPS object. It associates the existing object identifier (id-RSASSA-PSS), used for the signature algorithm (defined in [RFC4055] and [RFC5912]), with the new typeRsaSsa-Pss-sig-caps.RsaSsa-Pss-sig-capscarries the set of capabilities for the RSASSA-PSS signature algorithm. Its fields are:hashAlgholds the S/MIME capability for the hash algorithm we're declaring support for with the RSASSA-PSS signature algorithm.maskAlgholds the S/MIME capability for the mask algorithm we're declaring support for with the RSASSA-PSS signature algorithm.trailerFieldspecifies which trailer field algorithm is being supported. This MUST be the value 1 ⚠️.
NOTE: In at least one iteration of the design, we used a sequence of hash identifiers and a sequence of masking functions, and again assumed the entire matrix would be supported. That's been removed at this point, because the original intent of S/MIME capabilities is that you should be able to do a binary comparison of the DER encoding of the field and figure out whether a specific capability was published 🔍. We could bring back the sequence if we wanted to lose the ability to do a binary compare but needed to shorten the encodings. That doesn't currently appear to be an issue 🌷.
6. Security Considerations ✨
okay bestie, this doc gives us brand new fields that can go inside an S/MIME capabilities sequence 🎀. There are a bunch of things to think about when you do this, so let's go 💅
As we said above, we set up data structures that get attached to object identifiers in places where that association already exists 🦋. When you're encoding OR decoding these structures, you need to make sure the association you're using fits where it sits in the surrounding ASN.1 structure. So only public keys go in public key spots, signatures go in signature spots, and S/MIME capabilities go in SMIMECapability spots. Mess that up and you get decode errors at best and incorrect behavior at worst 💀
The more specific the info in an S/MIME Capabilities field, the better the end results 🍓 Naming a signature algorithm means the receiver doesn't have to wonder whether it's supported. Signature algorithms can also be implied by listing public key algorithms and hash algorithms together. If the list includes RSA v1.5, EC-DSA, SHA-1, and SHA-256, the implication is that all four values in the cross section are supported by the sender. If the sender doesn't support EC-DSA with SHA-1, the recipient could end up using a signature algorithm the sender can't do 😭 And leaving SHA-1 off the list can cause trouble too: both entities might only share RSA v1.5 with SHA-1, but the recipient can't discover that anymore 🙈
As a general rule, giving more info about the supported algorithms is preferable 🔥 The more choices you give the recipient, the better the odds of landing on a common algorithm with good security. But don't go overboard and be exhaustive, because a huge list makes it harder for the recipient to make smart decisions. This is an even bigger deal when more than two entities are involved in the "negotiation" of a common algorithm (like sending an encrypted S/MIME message where a common content encryption algorithm is needed). The larger the set of algorithms and the more recipients, the more memory and processing time the decision-making takes 🧚
The order of algorithms in the S/MIME capabilities sequence is meant to encode a preference order from the sender 👑 Lots of entities ignore that order though, either using their own preferred order or making a random decision from a matrix 🥀
7. References
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3279] Bassham, L., Polk, W., and R. Housley, "Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 3279, April 2002.
[RFC4055] Schaad, J., Kaliski, B., and R. Housley, "Additional Algorithms and Identifiers for RSA Cryptography for use in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 4055, June 2005.
[RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T. Polk, "Elliptic Curve Cryptography Subject Public Key Information", RFC 5480, March 2009.
7.2. Informative References
[NIST-SIZES] Barker, E., Barker, W., Burr, W., Polk, W., and M. Smid, "Recommendation for Key Management -- Part 1: General", NIST Special Publication 800-57, March 2007.
[RFC4262] Santesson, S., "X.509 Certificate Extension for Secure/Multipurpose Internet Mail Extensions (S/MIME) Capabilities", RFC 4262, December 2005.
[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)", RFC 5912, June 2010.
[RFC6277] Santesson, S. and P. Hallam-Baker, "Online Certificate Status Protocol Algorithm Agility", RFC 6277, June 2011.
[SMIME-MSG] Ramsdell, B. and S. Turner, "Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.2 Message Specification", RFC 5751, January 2010.
[SMIMEv3-MSG] Ramsdell, B., "S/MIME Version 3 Message Specification", RFC 2633, June 1999.
Appendix A. 2008 ASN.1 Module
This appendix contains a module compatible with the work done to update the PKIX ASN.1 modules to recent versions of the ASN.1 specifications [RFC5912]. Per the current direction of the PKIX working group, this appendix is to be considered informational 🧸
PUBLIC-KEY-SMIME-CAPABILITIES
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pubKeySMIMECaps-08(78) }
DEFINITIONS ::=
BEGIN
IMPORTS
SMIME-CAPS, PUBLIC-KEY, SMIMECapability
FROM AlgorithmInformation-2009
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-algorithmInformation-02(58)}
pk-rsa, pk-dsa, pk-dh, pk-ec, pk-ecDH, pk-ecMQV, ECParameters
FROM PKIXAlgs-2009
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkix1-algorithms2008-02(56) }
pk-rsaSSA-PSS, pk-rsaES-OAEP, sa-rsaSSA-PSS,
HashAlgorithms, id-mgf1
FROM PKIX1-PSS-OAEP-Algorithms-2009
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkix1-rsa-pkalgs-02(54)}
;
--
-- Define a set containing all of the S/MIME capabilities defined
-- by this document.
--
SMimeCaps SMIME-CAPS ::= {
PubKeys-SMimeCaps |
scap-sa-rsaSSA-PSS
}
PubKeys-SMimeCaps SMIME-CAPS ::= {
scap-pk-rsa | scap-pk-rsaSSA-PSS |
scap-pk-dsa |
scap-pk-ec | scap-pk-ecDH | scap-pk-ecMQV
}
--
-- We defined RSA keys from the modules in RFC 3279 and RFC 4055.
--
scap-pk-rsa SMIME-CAPS ::= {
TYPE RSAKeyCapabilities
IDENTIFIED BY pk-rsa.&id
}
RSAKeyCapabilities ::= SEQUENCE {
minKeySize RSAKeySize,
maxKeySize RSAKeySize OPTIONAL
}
RSAKeySize ::= INTEGER (1024 | 2048 | 3072 | 4096 | 7680 |
8192 | 15360, ...)
scap-pk-rsaES-OAEP SMIME-CAPS ::= {
TYPE RSAKeyCapabilities
IDENTIFIED BY pk-rsaES-OAEP.&id
}
scap-pk-rsaSSA-PSS SMIME-CAPS ::= {
TYPE RSAKeyCapabilities
IDENTIFIED BY pk-rsaSSA-PSS.&id
}
scap-sa-rsaSSA-PSS SMIME-CAPS ::= {
TYPE RsaSsa-Pss-sig-caps
IDENTIFIED BY sa-rsaSSA-PSS.&id
}
RsaSsa-Pss-sig-caps ::= SEQUENCE {
hashAlg SMIMECapability{{ MaskAlgorithmSet }},
maskAlg SMIMECapability{{ ... }} OPTIONAL,
trailerField INTEGER DEFAULT 1
}
scap-mf-mgf1 SMIME-CAPS ::= {
TYPE SMIMECapability{{ ... }}
IDENTIFIED BY id-mgf1
}
MaskAlgorithmSet SMIME-CAPS ::= {scap-mf-mgf1, ...}
--
-- We define DH/DSA keys from the module in RFC 3279.
--
scap-pk-dsa SMIME-CAPS ::= {
TYPE DSAKeyCapabilities
IDENTIFIED BY pk-dsa.&id
}
DSAKeyCapabilities ::= CHOICE {
keySizes [0] SEQUENCE {
minKeySize DSAKeySize,
maxKeySize DSAKeySize OPTIONAL,
maxSizeP [1] INTEGER OPTIONAL,
maxSizeQ [2] INTEGER OPTIONAL,
maxSizeG [3] INTEGER OPTIONAL
},
keyParams [1] pk-dsa.&Params
}
DSAKeySize ::= INTEGER (1024 | 2048 | 3072 | 7680 | 15360 )
scap-pk-dh SMIME-CAPS ::= {
TYPE DSAKeyCapabilities
IDENTIFIED BY pk-dh.&id
}
--
-- We define Elliptic Curve keys from the module in RFC 3279.
--
scap-pk-ec SMIME-CAPS ::= {
TYPE EC-SMimeCaps
IDENTIFIED BY pk-ec.&id
}
EC-SMimeCaps ::= SEQUENCE (SIZE (1..MAX)) OF ECParameters
scap-pk-ecDH SMIME-CAPS ::= {
TYPE EC-SMimeCaps
IDENTIFIED BY pk-ecDH.&id
}
scap-pk-ecMQV SMIME-CAPS ::= {
TYPE EC-SMimeCaps
IDENTIFIED BY pk-ecMQV.&id
}
ENDAppendix B. 1988 ASN.1 Module
This appendix contains the normative ASN.1 module for this document 📜
PUBLIC-KEY-SMIME-CAPABILITIES-88
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pubKeySMIMECaps-88(77) }
DEFINITIONS ::=
BEGIN
IMPORTS
ECParameters
FROM PKIX1Algorithms2008
{ iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
45 }
id-mgf1
FROM PKIX1-PSS-OAEP-Algorithms
{ iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkix1-rsa-pkalgs(33) }
AlgorithmIdentifier
FROM PKIX1Explicit88
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-explicit(18) }
;
--
-- We define RSA keys from the modules in RFC 3279 and RFC 4055.
--
RSAKeyCapabilities ::= SEQUENCE {
minKeySize RSAKeySize,
maxKeySize RSAKeySize OPTIONAL
}
RSAKeySize ::= INTEGER (1024 | 2048 | 3072 | 4096 | 7680 |
8192 | 15360, ...)
RsaSsa-Pss-sig-caps ::= SEQUENCE {
hashAlg AlgorithmIdentifier,
maskAlg AlgorithmIdentifier OPTIONAL,
trailerField INTEGER DEFAULT 1
}
--
-- We define DH/DSA keys from the module in RFC 3279.
--
DSAKeyCapabilities ::= CHOICE {
keySizes [0] SEQUENCE {
minKeySize DSAKeySize,
maxKeySize DSAKeySize OPTIONAL,
maxSizeP [1] INTEGER OPTIONAL,
maxSizeQ [2] INTEGER OPTIONAL,
maxSizeG [3] INTEGER OPTIONAL
},
keyParams [1] pk-dsa.&Params
}
DSAKeySize ::= INTEGER (1024 | 2048 | 3072 | 7680 | 15360 )
--
-- We define Elliptic Curve keys from the module in RFC 3279.
--
EC-SMimeCaps ::= SEQUENCE (SIZE (1..MAX)) OF ECParameters
ENDAppendix C. Future Work
A future revision of [RFC5912] should be done at some point to expand the definition of the PUBLIC-KEY class and allow for an SMIMECapability to be included in the class definition. This would encourage people to think about this as an issue when defining new public key structures in the future 🔮
Author's Address
Jim Schaad Soaring Hawk Consulting
EMail: ietf@augustcellars.com
📦 where this page comes from
- ietf: rfc6664 2012-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms