RFC 7894

Alternative Challenge Password Attributes for Enrollment over Secure Transport

📅 published June 2016, from ietf

Internet Engineering Task Force (IETF) 🎀

okay so this is RFC 7894 💖, called Alternative Challenge Password Attributes for Enrollment over Secure Transport ✨. It's an IETF doc with the category Standards Track 🔥, which means it's the real deal and not just a vibe. It came out in June 2016 and the ISSN is 2070-1721. The authors are M. Pritikin from Cisco Systems, Inc. and C. Wallace from Red Hound Software, Inc. 🫶 The header doesn't list anything it obsoletes or updates, so there's no other RFC it replaces or changes.

Abstract ✨

okay bestie, the big idea here is that this doc makes some brand new Certificate Signing Request attributes for the Enrollment over Secure Transport (EST) protocol 🧚. They exist to fix a mess. The challengePassword attribute from "PKCS #9: Selected Object Classes and Attribute Types Version 2.0" [RFC2985] has been getting used for a bunch of different things at once, and nobody could tell which one was meant 😭. The three uses called out are the original certificate revocation password, common authentication passwords, and the EST-defined linking of the transport security identity. The new attributes split those apart so each one gets its own name 💅.

Status of This Memo 📜

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc7894.

Copyright Notice 🌈

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents 🗂️

   1. Introduction ....................................................3
   2. Terminology .....................................................4
   3. Alternative Challenge Password Attributes .......................4
      3.1. OTP Challenge Attribute ....................................4
      3.2. Revocation Challenge Attribute .............................5
      3.3. EST Identity Linking Attribute .............................5
   4. Indicating Support for the Alternative Challenge Attributes .....6
   5. Security Considerations .........................................6
   6. IANA Considerations .............................................7
   7. References ......................................................7
      7.1. Normative References .......................................7
      7.2. Informative References .....................................8
   Appendix A.  ASN.1 Module ..........................................9
   Acknowledgements ..................................................10
   Authors' Addresses ................................................10

1. Introduction 🦋

okay so the challengePassword attribute was first defined in "PKCS #9: Selected Object Classes and Attribute Types Version 2.0" [RFC2985] 📖. Modern protocols have totally overloaded it, and what it means now depends on the context rather than on its OID 🙈. PKCS #9 says it's "a password by which an entity may request certificate revocation". Parsing and embedding it in Certificate Signing Requests is well supported by common PKI toolsets, but a lot of workflows use that same field as a one-time password for authentication 🔐. For example, plenty of Simple Certificate Enrollment Protocol (SCEP) implementations do this, as [SCEP] shows 💜. Then Enrollment over Secure Transport (EST) [RFC7030] adds yet another meaning for challengePassword in its Section 3.5, which is to link the Certificate Signing Request (CSR) to the secure transport 🔗.

Overloading one field is fine when the protocol context makes the meaning obvious and only one use is needed at a time 👌. The problem is that EST implementers have run into this limit. There are real situations where someone wants to use one of the existing methods alone or use several together 🍓. Picture an EST server that needs the client to prove itself with its existing client X.509 certificate, plus the user's username and password, and also wants a one-time password inside the CSR, all while still linking identity to the secure transport 😳. A single overloaded attribute type shouldn't be what gets in the way of admins trying to meet their security requirements 👑.

This document defines the otpChallenge attribute for when a one-time password (OTP) value inside the CSR is required 🎀. The revocationChallenge attribute lets the original challenge password semantics for certificate revocation be used without the mix-up ✨. The estIdentityLinking attribute points to the existing EST challenge password semantics, with no chance of getting confused with the legacy challenge password practices 🌸.

These attributes add to the current EST mechanisms and aren't meant to replace any existing EST authentication mechanisms 💅. Sending the authentication value as an attribute may be better than using an HTTP or Transport Layer Security (TLS) password or some other TLS authentication mechanism. This is especially true when the component that processes certificate requests isn't at the HTTP/TLS termination point, like when a web application firewall is in the picture 🛡️.

2. Terminology 📝

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].

3. Alternative Challenge Password Attributes 💖

The next sections describe three alternative challenge password attributes for use with EST [RFC7030] ✨. Appendix A has the ASN.1 module with all the new definitions 🧚.

Each attribute here is defined as a DirectoryString with a maximum length of 255, and DirectoryString has several possible encodings 🌈. Attribute values made under this document SHOULD use the PrintableString encoding whenever possible. If internationalization issues make that impossible, the UTF8String alternative SHOULD be used. Attribute processing systems MUST be able to recognize and process the PrintableString and UTF8String string types in DirectoryString values. Support for other string types is OPTIONAL 🫶.

3.1. OTP Challenge Attribute 🔑

The otpChallenge attribute is a DirectoryString with a maximum length of 255 🎀. That matches the challengePassword attribute as it was first defined in PKCS #9 [RFC2985] 💅. The attribute is identified by the id-aa-otpChallenge object identifier. Reusing the OID trick means the existing challengePassword parsing and generation code can be used with the new OIDs 🙌. This attribute gives you a way to carry a one-time password value inside a CSR request ✨. How the value is generated, verified, stored, and so on is not covered by this specification 🙈. [RFC4226] and [RFC6238] define one-time password mechanisms that MAY be used with this attribute 🦋.

      ub-aa-otpChallenge INTEGER ::= 255
      id-aa-otpChallenge OBJECT IDENTIFIER ::= {
          id-smime 56
      }
      otpChallenge ATTRIBUTE ::= {
          WITH SYNTAX DirectoryString {ub-aa-otpChallenge}
          EQUALITY MATCHING RULE caseExactMatch
          SINGLE VALUE TRUE
          ID id-aa-otpChallenge
      }

3.2. Revocation Challenge Attribute 🔥

The original PKCS #9 challengePassword field got overloaded, and nobody's totally sure what it's used for anymore 😭. The revocationChallenge attribute gives a clear way to say "this is the original PKCS #9 intent" 👑. It's identified by the id-aa-revocationChallenge object identifier. [RFC2985] covers the original semantics of the PKCS #9 challenge password attribute, so go check that if you want the full story 📖.

      ub-aa-revocationChallenge INTEGER ::= 255
      id-aa-revocationChallenge OBJECT IDENTIFIER ::= {
          id-smime 57
      }
      revocationChallenge ATTRIBUTE ::= {
          WITH SYNTAX DirectoryString {ub-aa-revocationChallenge}
          EQUALITY MATCHING RULE caseExactMatch
          SINGLE VALUE TRUE
          ID id-aa-revocationChallenge
      }

3.3. EST Identity Linking Attribute 🔗

EST has a mechanism that ties identity info from an authenticated TLS session to proof-of-possession info in a certificate request 🤝. That mechanism was labeled with the pkcs-9-at-challengePassword identifier from [RFC2985] 🙃. To avoid any confusion with the semantics in [RFC2985], or with any other spec that used the PKCS #9 challenge password attribute for its own purposes, this doc defines a brand new object identifier 💖. It's tied to the semantics described in Section 3.5 of [RFC7030] ✨.

      ub-aa-est-identity-linking INTEGER ::= 255
      id-aa-estIdentityLinking OBJECT IDENTIFIER ::= {
          id-smime 58
      }
      estIdentityLinking ATTRIBUTE ::= {
          WITH SYNTAX DirectoryString {ub-aa-est-identity-linking}
          EQUALITY MATCHING RULE caseExactMatch
          SINGLE VALUE TRUE
          ID id-aa-estIdentityLinking
      }

4. Indicating Support for the Alternative Challenge Attributes 🎀

The EST server MUST indicate these attributes, as the particular use case requires, in every CSR Attributes Response 📣. An EST server MAY send both the estIdentityLinking attribute and the challengePassword attribute [RFC7030] in a CSR Attributes Response, so legacy clients still get support 🫶.

The client MUST include every indicated attribute it has values for in the CSR it sends next 💅. If a client sees an estIdentityLinking attribute in a CSR Attributes Response, it SHOULD prefer that and leave the challengePassword attribute [RFC7030] out of the resulting CSR ✨. EST clients that include an unsolicited estIdentityLinking attribute MAY also include the challengePassword attribute [RFC7030] so legacy servers are covered too 🌸.

EST servers MUST evaluate each challenge attribute independently 🔍. Every challenge attribute an EST client includes MUST be processed successfully by the EST server for the request to count as valid 🙌. The EST server MAY ignore challenge attributes according to local policy. For instance, if the EST client is an authenticated Registration Authority, the EST server may ignore the estIdentityLinking attribute within a CSR (see Section 3.7 of [RFC7030]) 👑. The EST server MAY refuse enrollment requests that are not encoded according to the policy of the Certification Authority (CA) 🛡️.

5. Security Considerations 💀🔐

Okay bestie, this part is SERIOUS, so no skipping. 🫶 EST has its own security considerations in [RFC7030], and they all still apply here. 💖

The way the otpChallenge value gets generated and verified can bring extra security considerations of its own. 🙈 If a one-time password is being used, the security considerations in "HOTP: An HMAC-Based One-Time Password Algorithm" [RFC4226] or "TOTP: Time-Based One-Time Password Algorithm" [RFC6238] may be relevant. ✨ The security considerations from [RFC2985] that cover the challenge attribute are relevant too, so go read those as well. 📚

6. IANA Considerations 🎀

Section 3 defines three attributes that got object identifiers in the "SMI Security for S/MIME Attributes (1.2.840.113549.1.9.16.2)" registry [RFC7107]. Here's the tea:

     Value     Description                        Reference
     --------  ---------------------------------  ----------
     56        id-aa-otpChallenge                 RFC 7894
     57        id-aa-revocationChallenge          RFC 7894
     58        id-aa-estIdentityLinking           RFC 7894

Appendix A holds an ASN.1 module. It got a module identifier in the "SMI Security for PKIX Module Identifier" registry [RFC7299], so that's sorted too. 🦋

     Value     Description                        Reference
     --------  ---------------------------------  ----------
     87        id-mod-EST-Alt-Challenge           RFC 7894

7. References 📚

7.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

[RFC2985]  Nystrom, M. and B. Kaliski, "PKCS #9: Selected Object
           Classes and Attribute Types Version 2.0", RFC 2985,
           DOI 10.17487/RFC2985, November 2000,
           <http://www.rfc-editor.org/info/rfc2985>.

[RFC5272]  Schaad, J. and M. Myers, "Certificate Management over CMS
           (CMC)", RFC 5272, DOI 10.17487/RFC5272, June 2008,
           <http://www.rfc-editor.org/info/rfc5272>.

[RFC5280]  Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
           Housley, R., and W. Polk, "Internet X.509 Public Key
           Infrastructure Certificate and Certificate Revocation List
           (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
           <http://www.rfc-editor.org/info/rfc5280>.

[RFC5912]  Hoffman, P. and J. Schaad, "New ASN.1 Modules for the
           Public Key Infrastructure Using X.509 (PKIX)", RFC 5912,
           DOI 10.17487/RFC5912, June 2010,
           <http://www.rfc-editor.org/info/rfc5912>.

[RFC7030]  Pritikin, M., Ed., Yee, P., Ed., and D. Harkins, Ed.,
           "Enrollment over Secure Transport", RFC 7030,
           DOI 10.17487/RFC7030, October 2013,
           <http://www.rfc-editor.org/info/rfc7030>.

7.2. Informative References

[RFC4226]  M'Raihi, D., Bellare, M., Hoornaert, F., Naccache, D., and
           O. Ranen, "HOTP: An HMAC-Based One-Time Password
           Algorithm", RFC 4226, DOI 10.17487/RFC4226, December 2005,
           <http://www.rfc-editor.org/info/rfc4226>.

[RFC6238]  M'Raihi, D., Machani, S., Pei, M., and J. Rydell, "TOTP:
           Time-Based One-Time Password Algorithm", RFC 6238,
           DOI 10.17487/RFC6238, May 2011,
           <http://www.rfc-editor.org/info/rfc6238>.

[RFC7107]  Housley, R., "Object Identifier Registry for the S/MIME
           Mail Security Working Group", RFC 7107,
           DOI 10.17487/RFC7107, January 2014,
           <http://www.rfc-editor.org/info/rfc7107>.

[RFC7299]  Housley, R., "Object Identifier Registry for the PKIX
           Working Group", RFC 7299, DOI 10.17487/RFC7299, July 2014,
           <http://www.rfc-editor.org/info/rfc7299>.

[SCEP]     Gutmann, P. and M. Pritikin, "Simple Certificate Enrolment
           Protocol", Work in Progress, draft-gutmann-scep-02, March
           2016.

Appendix A. ASN.1 Module 💜

This ASN.1 module has all the definitions you need to use the attributes from this spec. 🧚 It imports modules from [RFC5912], and the original Standards Track sources for the imported structures are [RFC5280] and [RFC5272].

   Mod-EST-Alt-Challenge {
      iso(1) identified-organization(3) dod(6) internet(1) security(5)
         mechanisms(5) pkix(7) id-mod(0) 87
   }

   DEFINITIONS IMPLICIT TAGS ::=
   BEGIN
   IMPORTS

   DirectoryString{}
   FROM PKIX1Explicit-2009 {
      iso(1) identified-organization(3) dod(6) internet(1) security(5)
      mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)
   }

   ATTRIBUTE
   FROM PKIX-CommonTypes-2009 {
      iso(1) identified-organization(3) dod(6) internet(1) security(5)
      mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)
   };

   ub-aa-otpChallenge INTEGER ::= 255
   id-aa-otpChallenge OBJECT IDENTIFIER ::= {
      iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
      smime(16) aa(2) 56
   }
   otpChallenge ATTRIBUTE ::= {
      TYPE DirectoryString {ub-aa-otpChallenge}
      COUNTS MIN 1 MAX 1
      IDENTIFIED BY id-aa-otpChallenge
   }
   ub-aa-revocationChallenge INTEGER ::= 255
   id-aa-revocationChallenge OBJECT IDENTIFIER ::= {
      iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
      smime(16) aa(2) 57
   }
   revocationChallenge ATTRIBUTE ::= {
      TYPE DirectoryString {ub-aa-revocationChallenge}
      COUNTS MIN 1 MAX 1
      IDENTIFIED BY id-aa-revocationChallenge
   }
   ub-aa-est-identity-linking INTEGER ::= 255
   id-aa-estIdentityLinking OBJECT IDENTIFIER ::= {
      iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
      smime(16) aa(2) 58
   }
   estIdentityLinking ATTRIBUTE ::= {
      TYPE DirectoryString {ub-aa-est-identity-linking}
      COUNTS MIN 1 MAX 1
      IDENTIFIED BY id-aa-estIdentityLinking
   }
   END

Acknowledgements 🫶

Huge thanks to Jim Schaad, Dan Harkins, Phil Scheffler, Geoff Beier, Mike Jenkins, and Deb Cooley for their feedback. You all are literal angels. 👼✨

Authors' Addresses 🌸

Max Pritikin
Cisco Systems, Inc.
510 McCarthy Drive
Milpitas, CA  95035
United States

Email: pritikin@cisco.com


Carl Wallace
Red Hound Software, Inc.

Email: carl@redhoundsoftware.com

📦 where this page comes from

ietf: rfc7894 2016-06
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms