RFC 7250
Using Raw Public Keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
RFC 7250 🎀 Using Raw Public Keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
Okay bestie, this is RFC 7250, and it's giving real Internet Standard energy ✨. It came out in June 2014 and it's a Standards Track document, which means it's officially part of the Internet's protocol toolkit 👑. It's catalogued under ISSN 2070-1721.
The paper was written by a whole squad 🦋. P. Wouters, Ed. (Red Hat) and H. Tschofenig, Ed. (ARM Ltd.) are the editors, and J. Gilmore (Electronic Frontier Foundation), S. Weiler (Parsons), and T. Kivinen (INSIDE Secure) are the other authors 🫶. The title block doesn't list anything it obsoletes or updates, so it's a standalone glow-up 💜.
Abstract ✨
Okay so the vibe here is: this doc sets up a new certificate type and two TLS extensions for swapping raw public keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) 🔐. The new certificate type is what lets raw public keys be used for authentication, and honestly that's iconic 💅.
Status of This Memo 📜
This is an Internet Standards Track document 🌸.
It's a product of the Internet Engineering Task Force (IETF), so it reflects what the IETF community agreed on 🫶. It also got public review and was approved for publication by the Internet Engineering Steering Group (IESG) 👑. If you want the deets on Internet Standards, check out Section 2 of RFC 5741 🧚.
For the current status of this doc, any errata, and how to send feedback, head to http://www.rfc-editor.org/info/rfc7250 🔥.
Copyright Notice ©️
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved 💖.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Read these carefully, because they spell out your rights and restrictions for this doc 🙈. Any Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, just like the Simplified BSD License says 💀.
Table of Contents 🗺️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Structure of the Raw Public Key Extension . . . . . . . . . . 4
4. TLS Client and Server Handshake Behavior . . . . . . . . . . 7
4.1. Client Hello . . . . . . . . . . . . . . . . . . . . . . 7
4.2. Server Hello . . . . . . . . . . . . . . . . . . . . . . 8
4.3. Client Authentication . . . . . . . . . . . . . . . . . . 9
4.4. Server Authentication . . . . . . . . . . . . . . . . . . 9
5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 10
5.1. TLS Server Uses a Raw Public Key . . . . . . . . . . . . 10
5.2. TLS Client and Server Use Raw Public Keys . . . . . . . . 11
5.3. Combined Usage of Raw Public Keys and X.509 Certificates 12
6. Security Considerations . . . . . . . . . . . . . . . . . . . 13
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 14
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 14
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 15
9.1. Normative References . . . . . . . . . . . . . . . . . . 15
9.2. Informative References . . . . . . . . . . . . . . . . . 15
Appendix A. Example Encoding . . . . . . . . . . . . . . . . . . 171. Introduction ✨
Okay so traditionally, TLS client and server public keys come in PKIX containers, delivered in-band as part of the TLS handshake 🤓. They get validated against trust anchors that sit under a [PKIX] certification authority (CA). This can add a complicated trust relationship that's genuinely hard to validate 😭. You can see examples of that kind of complexity in [Defeating-SSL] 🙈.
TLS also gets used a lot with self-signed certificates in smaller deployments, where those certs are handed to every endpoint out-of-band 🌸. The catch is that you still pay the overhead of generating the certificate, even though none of the info in it is actually used 💀.
There are other ways a TLS client or server can get the other side's public key 🧚:
- The TLS client can grab the TLS server public key from a DNSSEC-secured resource record, using DNS-Based Authentication of Named Entities (DANE) [RFC6698] 🔥.
- The TLS client or server public key comes from a [PKIX] certificate chain, fetched from a Lightweight Directory Access Protocol [LDAP] server or a web page 🫶.
- The TLS client and server public keys get provisioned into the operating system firmware image, and they're updated through software updates 🦋. For example:
Some smart objects use the UDP-based Constrained Application Protocol [CoAP] to talk to a Web server and upload sensor data at regular intervals, like temperature readings 🌡️. CoAP can use DTLS to secure the client-to-server communication 🔐. As part of manufacturing, the embedded device might be set up with the address and public key of a dedicated CoAP server, plus a public/private key pair for the client itself 💜.
This document brings in raw public keys for TLS/DTLS, and honestly it's a whole mood 💖. Raw public keys only use a subset of what's in typical certificates: specifically, the SubjectPublicKeyInfo structure of a PKIX certificate, which carries the parameters needed to describe the public key 🎀. Everything else in PKIX certificates gets left out. Because you drop the certificate-related structures, the raw public key stays pretty small compared to the original certificate, and the code that processes these keys can be simpler ✨. You only need a minimalistic ASN.1 parser. Code for certificate path validation and other PKIX-related processing isn't required 🙅.
Heads up though: the SubjectPublicKeyInfo structure is still in an ASN.1 format 👀. If you want to shrink the exchanged info even more, this spec can be combined with the TLS Cached Info extension [CACHED-INFO], which lets TLS peers swap just fingerprints of their public keys 🍓.
The mechanism defined here only provides authentication when an out-of-band mechanism is also used to bind the public key to the entity presenting the key 🚨.
Here's the roadmap 🗺️. Section 3 defines the structure of the two new TLS extensions, client_certificate_type and server_certificate_type, which you can use as part of an extended TLS handshake when raw public keys are going to be used 🦋. Section 4 defines how the TLS client and TLS server behave 💅. Example exchanges are in Section 5 🌈. Section 6 covers the security considerations for this approach 😭. And finally, Section 7 registers a new value in the IANA "TLS Certificate Types" subregistry for supporting raw public keys 👑.
2. Terminology 📖
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119] 🎀.
We use the terms "TLS server" and "server" interchangeably, and the same goes for "TLS client" and "client" 💖.
3. Structure of the Raw Public Key Extension ✨
okay bestie, this is where the magic happens 🎀 Two TLS extensions, client_certificate_type and server_certificate_type, can be used in an extended TLS handshake when raw public keys are involved. Section 4 explains how the TLS client and TLS server behave when they use these extensions 💅
Raw public keys reuse an encoding that already exists in a PKIX certificate, the SubjectPublicKeyInfo structure 🦋 To carry it inside the TLS handshake, the Certificate payload acts as a container, as shown in Figure 1. Fun fact: that Certificate structure is an adapted version of the original one [RFC5246] 🧚
opaque ASN.1Cert<1..2^24-1>;
struct {
select(certificate_type){
// certificate type defined in this document.
case RawPublicKey:
opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
// X.509 certificate defined in RFC 5246
case X.509:
ASN.1Cert certificate_list<0..2^24-1>;
// Additional certificate type based on
// "TLS Certificate Types" subregistry
};
} Certificate;Figure 1: Certificate Payload as a Container for the Raw Public Key
The SubjectPublicKeyInfo structure is defined in Section 4.1 of RFC 5280 [PKIX]. It holds more than just the raw key stuff, like the public exponent and the modulus of an RSA public key 🔥 It also has an algorithm identifier, and that identifier can include parameters too. The SubjectPublicKeyInfo value in the Certificate payload MUST contain the DER encoding [X.690] of the SubjectPublicKeyInfo. Since the structure in Figure 2 also carries length information, it's super organized 📦 An example is in Appendix A ✨
SubjectPublicKeyInfo ::= SEQUENCE {
algorithm AlgorithmIdentifier,
subjectPublicKey BIT STRING }
AlgorithmIdentifier ::= SEQUENCE {
algorithm OBJECT IDENTIFIER,
parameters ANY DEFINED BY algorithm OPTIONAL }Figure 2: SubjectPublicKeyInfo ASN.1 Structure
The algorithm identifiers are Object Identifiers (OIDs) 🌈 RFC 3279 [RFC3279] and RFC 5480 [RFC5480], for example, define the OIDs in Figure 3. The list isn't exhaustive, so more OIDs may be defined in future RFCs 🌸
Key Type | Document | OID
--------------------+----------------------------+-------------------
RSA | Section 2.3.1 of RFC 3279 | 1.2.840.113549.1.1
....................|............................|...................
Digital Signature | |
Algorithm (DSA) | Section 2.3.2 of RFC 3279 | 1.2.840.10040.4.1
....................|............................|...................
Elliptic Curve | |
Digital Signature | |
Algorithm (ECDSA) | Section 2 of RFC 5480 | 1.2.840.10045.2.1
--------------------+----------------------------+-------------------Figure 3: Example Algorithm Object Identifiers
The extension format for extended client and server hellos uses the "extension_data" field to carry the ClientCertTypeExtension and ServerCertTypeExtension structures 💖 Both are shown in Figure 4. The CertificateType structure is an enum, and its values come from the "TLS Certificate Types" subregistry of the "Transport Layer Security (TLS) Extensions" registry [TLS-Ext-Registry] 🦋
struct {
select(ClientOrServerExtension) {
case client:
CertificateType client_certificate_types<1..2^8-1>;
case server:
CertificateType client_certificate_type;
}
} ClientCertTypeExtension;
struct {
select(ClientOrServerExtension) {
case client:
CertificateType server_certificate_types<1..2^8-1>;
case server:
CertificateType server_certificate_type;
}
} ServerCertTypeExtension;Figure 4: CertTypeExtension Structure
4. TLS Client and Server Handshake Behavior 👑
This specification extends the ClientHello and the ServerHello messages, following the extension procedures defined in [RFC5246]. It doesn't extend or modify any other TLS message 💅
Note: No new cipher suites are required to use raw public keys. All existing cipher suites that support a key exchange method compatible with the defined extension can be used 🫶
The high-level message exchange in Figure 5 shows the client_certificate_type and server_certificate_type extensions added to the client and server hello messages 🧚
client_hello,
client_certificate_type,
server_certificate_type ->
<- server_hello,
client_certificate_type,
server_certificate_type,
certificate,
server_key_exchange,
certificate_request,
server_hello_done
certificate,
client_key_exchange,
certificate_verify,
change_cipher_spec,
finished ->
<- change_cipher_spec,
finished
Application Data <-------> Application DataFigure 5: Basic Raw Public Key TLS Exchange
4.1. Client Hello 🎀
In order to indicate support for raw public keys, clients include the client_certificate_type and/or the server_certificate_type extensions in an extended client hello message. The hello extension mechanism is described in Section 7.4.1.4 of TLS 1.2 [RFC5246] ✨
The client_certificate_type extension in the client hello indicates the certificate types the client is able to provide to the server, when requested using a certificate_request message 🦋
The server_certificate_type extension in the client hello indicates the types of certificates the client is able to process when the server provides them in a subsequent certificate payload 💜
The client_certificate_type and server_certificate_type extensions sent in the client hello each carry a list of supported certificate types, sorted by client preference. When the client supports only one certificate type, the list contains a single element 🌸
The TLS client MUST omit certificate types from the client_certificate_type extension in the client hello if it does not possess the corresponding raw public key or certificate that it can provide to the server when requested using a certificate_request message, or if it is not configured to use one with the given TLS server. If the client has no remaining certificate types to send in the client hello, other than the default X.509 type, it MUST omit the client_certificate_type extension in the client hello 😭
The TLS client MUST omit certificate types from the server_certificate_type extension in the client hello if it is unable to process the corresponding raw public key or other certificate type. If the client has no remaining certificate types to send in the client hello, other than the default X.509 certificate type, it MUST omit the entire server_certificate_type extension from the client hello 💀
4.2. Server Hello 🍓
If the server receives a client hello that contains the client_certificate_type extension and/or the server_certificate_type extension, then three outcomes are possible:
- The server does not support the extension defined in this document. In this case, the server returns the server hello without the extensions defined in this document.
- The server supports the extension defined in this document, but it does not have any certificate type in common with the client. Then, the server terminates the session with a fatal alert of type "unsupported_certificate" 💀
- The server supports the extensions defined in this document and has at least one certificate type in common with the client. In this case, the processing rules described below are followed ✨
The client_certificate_type extension in the client hello indicates the certificate types the client is able to provide to the server, when requested using a certificate_request message. If the TLS server wants to request a certificate from the client (via the certificate_request message), it MUST include the client_certificate_type extension in the server hello. This client_certificate_type extension in the server hello then indicates the type of certificates the client is requested to provide in a subsequent certificate payload. The value conveyed in the client_certificate_type extension MUST be selected from one of the values provided in the client_certificate_type extension sent in the client hello. The server MUST also include a certificate_request payload in the server hello message 🔥
If the server does not send a certificate_request payload (for example, because client authentication happens at the application layer or no client authentication is required) or none of the certificates supported by the client (as indicated in the client_certificate_type extension in the client hello) match the server-supported certificate types, then the client_certificate_type payload in the server hello MUST be omitted 🙈
The server_certificate_type extension in the client hello indicates the types of certificates the client is able to process when the server provides them in a subsequent certificate payload. If the client hello indicates support of raw public keys in the server_certificate_type extension and the server chooses to use raw public keys, then the TLS server MUST place the SubjectPublicKeyInfo structure into the Certificate payload. With the server_certificate_type extension in the server hello, the TLS server indicates the certificate type carried in the Certificate payload. This additional indication enables avoiding parsing ambiguities, since the Certificate payload may contain either the X.509 certificate or a SubjectPublicKeyInfo structure 🧚 Note that only a single value is permitted in the server_certificate_type extension when carried in the server hello 💅
4.3. Client Authentication 🦋
When the TLS server has specified RawPublicKey as the client_certificate_type, authentication of the TLS client to the TLS server is supported only through authentication of the received client SubjectPublicKeyInfo via an out-of-band method 🫶
4.4. Server Authentication 🌈
When the TLS server has specified RawPublicKey as the server_certificate_type, authentication of the TLS server to the TLS client is supported only through authentication of the received client SubjectPublicKeyInfo via an out-of-band method 🔥
5. Examples ✨
Figures 6, 7, and 8 illustrate example exchanges. Note that TLS ciphersuites using a Diffie-Hellman exchange offering forward secrecy can be used with a raw public key, although this document does not show the information exchange at that level with the subsequent message flows 💖
5.1. TLS Server Uses a Raw Public Key 🎀
okay so this one is the example where the TLS client says "hey, I can handle a raw public key from you, and that's literally it" 💅 the client is kind of restricted here bestie, because it can't process any other certificate types the server might send. it also doesn't have any credentials at the TLS layer to send back, so it leaves out the client_certificate_type extension entirely 🙈. so the client only fills in the server_certificate_type extension with the raw public key type, as you can see in (1) ✨
when the TLS server gets the client hello, it processes that extension. since it has a raw public key, it says in (2) that it's going to put the SubjectPublicKeyInfo structure into the Certificate payload (3) 🦋
the client then uses this raw public key in the TLS handshake, and it checks it using an out-of-band validation technique, like DANE 🔥 so the key gets verified outside the handshake itself, which is giving very intentional security vibes 🫶
client_hello,
server_certificate_type=(RawPublicKey) // (1)
->
<- server_hello,
server_certificate_type=RawPublicKey, // (2)
certificate, // (3)
server_key_exchange,
server_hello_done
client_key_exchange,
change_cipher_spec,
finished ->
<- change_cipher_spec,
finished
Application Data <-------> Application DataFigure 6: Example with Raw Public Key Provided by the TLS Server
5.2. TLS Client and Server Use Raw Public Keys 🌈
this next example has the TLS client AND the TLS server both using raw public keys 😭✨ this is one of the main use cases people imagined for smart object networking, and honestly it's so cute. the client here is an embedded device that's been configured with a raw public key for TLS, and it can also process a raw public key that the server sends. so it signals both of those capabilities in (1) 💜
just like the last example, the server goes along with the client's request, says so with the RawPublicKey value in the server_certificate_type payload (2), and sends its raw public key back in the Certificate payload (3). the TLS server also demands client authentication, so it includes a certificate_request (4) 🧚 the client_certificate_type payload in (5) shows that the server accepts a raw public key. and then the TLS client, which already has its raw public key pre-provisioned, sends it back in the Certificate payload (6) to the server 💖
client_hello,
client_certificate_type=(RawPublicKey) // (1)
server_certificate_type=(RawPublicKey) // (1)
->
<- server_hello,
server_certificate_type=RawPublicKey // (2)
certificate, // (3)
client_certificate_type=RawPublicKey // (5)
certificate_request, // (4)
server_key_exchange,
server_hello_done
certificate, // (6)
client_key_exchange,
change_cipher_spec,
finished ->
<- change_cipher_spec,
finished
Application Data <-------> Application DataFigure 7: Example with Raw Public Key provided by the TLS Server and the Client
5.3. Combined Usage of Raw Public Keys and X.509 Certificates 🎀
this one is a mix 💅 it combines a raw public key and an X.509 certificate in the same exchange. the client uses a raw public key for client authentication, and the server gives it an X.509 certificate. so the client starts by saying it can process an X.509 certificate, an OpenPGP certificate, or a raw public key if the server sends one 🍓 it prefers the raw public key, because the RawPublicKey value comes before the other values in the server_certificate_type vector. the client also says it has a raw public key for client-side authentication (see (1)) ✨
the server picks its X.509 certificate for (3) and shows that choice in (2) 🦋 for client authentication, the server says in (4) that it has picked the raw public key format, and it asks for a certificate from the client in (5) 💀 the TLS client then sends a raw public key in (6), after it has received and processed the TLS server hello message 👑
client_hello,
server_certificate_type=(RawPublicKey, X.509, OpenPGP)
client_certificate_type=(RawPublicKey) // (1)
->
<- server_hello,
server_certificate_type=X.509 // (2)
certificate, // (3)
client_certificate_type=RawPublicKey // (4)
certificate_request, // (5)
server_key_exchange,
server_hello_done
certificate, // (6)
client_key_exchange,
change_cipher_spec,
finished ->
<- change_cipher_spec,
finished
Application Data <-------> Application DataFigure 8: Hybrid Certificate Example
6. Security Considerations 💀🔥
this part is serious, bestie, so listen up 🫶 sending raw public keys like this is a win for the over-the-air overhead, because raw public keys are naturally smaller than a whole certificate ✨ there are also code-size perks when it comes to parsing and processing them 🧚 and the cryptographic procedures for tying the public key to possession of a private key just follow standard procedures 💅
BUT the big security challenge is how to bind the public key to a specific entity 😭 without a secure binding between the identifier and the key, the protocol is open to man-in-the-middle attacks 💀 this document assumes that binding can be made out-of-band, and Section 1 lists a few examples 🦋 DANE [RFC6698] is one such approach 🌸 to deal with these vulnerabilities, specifications that use the extension need to say how the identifier and public key are bound 🔥 on top of making sure the binding happens out-of-band, an implementation also needs to check the status of that binding 🎀
if public keys come from DANE, they are authenticated via DNSSEC 💜 pre-configured keys are another out-of-band way to authenticate raw public keys 🌈 they're not suitable for a generic Web-based e-commerce environment, but they're a reasonable approach for lots of smart object deployments where the software on the device and the server-side endpoint are closely related 🧚 whichever out-of-band validation mechanism you pick, you have to assess which approach fits best BEFORE the deployment starts, so the system stays secure 🔒✨
An attacker might try to mess with the handshake so that the parties pick different certificate types than they normally would 💀
For this attack, the attacker has to actively change one or more handshake messages 😱 if that happens, the client and server compute different values for the handshake message hashes 🔥 so they won't accept each other's Finished messages 💅 and without the master_secret, the attacker can't fix the Finished messages, so the attack gets caught 🫶
7. IANA Considerations 🎀
IANA registered a new value in the "TLS Certificate Types" subregistry of the "Transport Layer Security (TLS) Extensions" registry [TLS-Ext-Registry], like this 🦋
Value: 2
Description: Raw Public Key
Reference: RFC 7250IANA also allocated two new TLS extensions, client_certificate_type and server_certificate_type, from the "TLS ExtensionType Values" subregistry defined in [RFC5246] 🌸 both extensions are used in the client hello message AND the server hello message 💖 the new extension types are used for certificate type negotiation 🧚 and the values carried in these extensions come from the "TLS Certificate Types" subregistry of the "Transport Layer Security (TLS) Extensions" registry [TLS-Ext-Registry] ✨
8. Acknowledgements 🫶
the feedback from the TLS working group meeting at IETF 81 really shaped this document, and the authors want to thank everyone who showed up with input 🙌 the support for hashes of public keys moved to [CACHED-INFO] after the discussions at the IETF 82 meeting 🦋
a big thank you to the reviewers: Martin Rex, Bill Frantz, Zach Shelby, Carsten Bormann, Cullen Jennings, Rene Struik, Alper Yegin, Jim Schaad, Barry Leiba, Paul Hoffman, Robert Cragie, Nikos Mavrogiannopoulos, Phil Hunt, John Bradley, Klaus Hartke, Stefan Jucker, Kovatsch Matthias, Daniel Kahn Gillmor, Peter Sylvester, Hauke Mehrtens, Alexey Melnikov, Stephen Farrell, Richard Barnes, and James Manger 💜 Nikos Mavrogiannopoulos contributed the design for reusing the certificate type registry 🎀 Barry Leiba contributed guidance for the IANA Considerations text 🌈 and Stefan Jucker, Kovatsch Matthias, and Klaus Hartke gave implementation feedback about the SubjectPublicKeyInfo structure 🧚
Christer Holmberg provided the General Area (Gen-Art) review, Yaron Sheffer provided the Security Directorate (SecDir) review, Bert Greevenbosch provided the Applications Area Directorate review, and Linda Dunbar provided the Operations Directorate review 🔥
we also want to thank our TLS working group chairs, Eric Rescorla and Joe Salowey, for their guidance and support 💅 and finally, Sean Turner, the responsible Security Area Director for this work, for his review comments and suggestions 👑
9. References 📚
9.1. Normative References 💖
[PKIX] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
Housley, R., and W. Polk, "Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List
(CRL) Profile", RFC 5280, May 2008.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3279] Bassham, L., Polk, W., and R. Housley, "Algorithms and
Identifiers for the Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List
(CRL) Profile", RFC 3279, April 2002.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246, August 2008.
[RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T. Polk,
"Elliptic Curve Cryptography Subject Public Key
Information", RFC 5480, March 2009.
[TLS-Ext-Registry]
IANA, "Transport Layer Security (TLS) Extensions",
<http://www.iana.org/assignments/
tls-extensiontype-values>.
[X.690] ITU-T, "Information technology - ASN.1 encoding rules:
Specification of Basic Encoding Rules (BER), Canonical
Encoding Rules (CER) and Distinguished Encoding Rules
(DER)", ITU-T Recommendation X.690, ISO/IEC 8825-1:2002,
2002.
## 9.2. Informative References 📚
Okay, these are the bonus reads, bestie. They're not required to implement the spec, but they give you the background tea. ✨
- [ASN.1-Dump] Gutmann, P., "ASN.1 Object Dump Program", February 2013, <http://www.cs.auckland.ac.nz/~pgut001/>.
- [CACHED-INFO] Santesson, S. and H. Tschofenig, "Transport Layer Security (TLS) Cached Information Extension", Work in Progress, February 2014.
- [CoAP] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained Application Protocol (CoAP)", RFC 7252, June 2014.
- [Defeating-SSL] Marlinspike, M., "New Tricks for Defeating SSL in Practice", February 2009, <http://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf>.
- [LDAP] Sermersheim, J., "Lightweight Directory Access Protocol (LDAP): The Protocol", RFC 4511, June 2006.
- [RFC6698] Hoffman, P. and J. Schlyter, "The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA", RFC 6698, August 2012.
---
# Appendix A. Example Encoding 🧚
Okay, this is the fun part, the bit where we actually look at the bytes. 🤓 The hex sequence in Figure 9 describes a SubjectPublicKeyInfo structure sitting inside the certificate payload. Iconic. 💅
0 1 2 3 4 5 6 7 8 9 +------+-----+-----+-----+-----+-----+-----+-----+-----+----- 1 | 0x30, 0x81, 0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 2 | 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 3 | 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xcd, 4 | 0xfd, 0x89, 0x48, 0xbe, 0x36, 0xb9, 0x95, 0x76, 0xd4, 0x13, 5 | 0x30, 0x0e, 0xbf, 0xb2, 0xed, 0x67, 0x0a, 0xc0, 0x16, 0x3f, 6 | 0x51, 0x09, 0x9d, 0x29, 0x2f, 0xb2, 0x6d, 0x3f, 0x3e, 0x6c, 7 | 0x2f, 0x90, 0x80, 0xa1, 0x71, 0xdf, 0xbe, 0x38, 0xc5, 0xcb, 8 | 0xa9, 0x9a, 0x40, 0x14, 0x90, 0x0a, 0xf9, 0xb7, 0x07, 0x0b, 9 | 0xe1, 0xda, 0xe7, 0x09, 0xbf, 0x0d, 0x57, 0x41, 0x86, 0x60, 10 | 0xa1, 0xc1, 0x27, 0x91, 0x5b, 0x0a, 0x98, 0x46, 0x1b, 0xf6, 11 | 0xa2, 0x84, 0xf8, 0x65, 0xc7, 0xce, 0x2d, 0x96, 0x17, 0xaa, 12 | 0x91, 0xf8, 0x61, 0x04, 0x50, 0x70, 0xeb, 0xb4, 0x43, 0xb7, 13 | 0xdc, 0x9a, 0xcc, 0x31, 0x01, 0x14, 0xd4, 0xcd, 0xcc, 0xc2, 14 | 0x37, 0x6d, 0x69, 0x82, 0xd6, 0xc6, 0xc4, 0xbe, 0xf2, 0x34, 15 | 0xa5, 0xc9, 0xa6, 0x19, 0x53, 0x32, 0x7a, 0x86, 0x0e, 0x91, 16 | 0x82, 0x0f, 0xa1, 0x42, 0x54, 0xaa, 0x01, 0x02, 0x03, 0x01, 17 | 0x00, 0x01
<lavender>Figure 9: Example SubjectPublicKeyInfo Structure Byte Sequence</lavender>
The decoded byte sequence from Figure 9 is the glow-up version. 🦋 You can get it with Peter Gutmann's ASN.1 decoder [ASN.1-Dump], and it shows the structure the way Figure 10 does. 💖
Offset Length Description
0 3+159: SEQUENCE { 3 2+13: SEQUENCE { 5 2+9: OBJECT IDENTIFIER Value (1 2 840 113549 1 1 1) : PKCS #1, rsaEncryption 16 2+0: NULL : } 18 3+141: BIT STRING, encapsulates { 22 3+137: SEQUENCE { 25 3+129: INTEGER Value (1024 bit) 157 2+3: INTEGER Value (65537) : } : } : }
<lavender>Figure 10: Decoding of Example SubjectPublicKeyInfo Structure</lavender>
---
# Authors' Addresses 🎀
Meet the crew who built this thing. 🫶
Paul Wouters (editor) Red Hat
EMail: pwouters@redhat.com
Hannes Tschofenig (editor) ARM Ltd. 6060 Hall in Tirol Austria
EMail: Hannes.tschofenig@gmx.net URI: http://www.tschofenig.priv.at
John Gilmore Electronic Frontier Foundation PO Box 170608 San Francisco, California 94117 USA
Phone: +1 415 221 6524 EMail: gnu@toad.com URI: https://www.toad.com/
Samuel Weiler Parsons 7110 Samuel Morse Drive Columbia, Maryland 21046 US
EMail: weiler@tislabs.com
Tero Kivinen INSIDE Secure Eerikinkatu 28 Helsinki FI-00180 FI
EMail: kivinen@iki.fi
<rainbow>That's the whole thing, bestie! 🌈👑 You made it through the entire spec. Periodt. 💅✨</rainbow>
📦 where this page comes from
- ietf: rfc7250 2014-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms