RFC 9158

Update to the Object Identifier Registry for the PKIX Working Group

📅 published November 2021, from ietf

RFC 9158: Update to the Object Identifier Registry for the PKIX Working Group 💖

Internet Engineering Task Force (IETF) 🌸 Request for Comments: 9158 Author: Russ Housley, Vigil Security 🎀 Updates: RFC 7299 ✨ Obsoletes: nothing listed in this document 🙈 Category: Informational 🦋 Date: November 2021 🍓 ISSN: 2070-1721 💅

Abstract ✨

okay so RFC 7299 lists the object identifiers that the PKIX Working Group got from IANA in its own arc (1.3.6.1.5.5.7). a few of the object identifiers from RFC 4212 got left out of RFC 7299 by accident 😭, so this document updates RFC 7299 to fix that. slay. 💅

Status of This Memo 🌈

this document is not an Internet Standards Track specification. it's published for information only 💜

it's an IETF product 🫶 and it represents the consensus of the IETF community. it got public review and was approved for publication by the Internet Engineering Steering Group (IESG). not every IESG-approved document is a candidate for any level of Internet Standard, so see Section 2 of RFC 7841 for that 🔥

for the current status, any errata, and how to give feedback, check https://www.rfc-editor.org/info/rfc9158 ✨

Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved. 🌸

this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they're in effect on the publication date. please actually read those, they spell out your rights and restrictions for this document 🙈

any Code Components pulled out of this document have to include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Revised BSD License describes 💅

Table of Contents 🧚

  • 1. Introduction
  • 2. IANA Considerations
    • 2.1. "SMI Security for PKIX CRMF Registration Controls for Alternate Certificate Formats" Registry
  • 3. Security Considerations
  • 4. References
    • 4.1. Normative References
    • 4.2. Informative References
  • Author's Address

1. Introduction 🦋

okay so back when the PKIX Working Group got chartered, IANA gave it an object identifier arc to use 🌈 after the group closed up shop, RFC 7299 [RFC7299] came out to describe the object identifiers assigned in that arc. but a few object identifiers from RFC 4212 [RFC4212] weren't included in RFC 7299, and this document fixes that oversight ✨

the PKIX Certificate Management Protocol (CMP) [RFC4210] allocated id-regCtrl-altCertTemplate (1.3.6.1.5.5.7.5.1.7). then two object identifiers were assigned inside that arc [RFC4212], meant to be used with either PKIX CMP [RFC4210] or PKIX Certificate Management over CMS (CMC) [RFC5272] [RFC5273] [RFC5274] [RFC6402] 💜

this document describes the object identifiers assigned in that arc, sets up an IANA registry for that arc, and sets up IANA allocation policies for any future assignments in it. main character energy 👑

2. IANA Considerations 🌸

IANA has created a new subregistry. 🎀

2.1. "SMI Security for PKIX CRMF Registration Controls for Alternate Certificate Formats" Registry 💖

inside the "Structure of Management Information (SMI) Numbers (MIB Module Registrations)" registry, IANA made the "SMI Security for PKIX CRMF Registration Controls for Alternate Certificate Formats" subregistry (1.3.6.1.5.5.7.5.1.7). here's what it starts with 🧚

+=========+===========================+============+
| Decimal | Description               | References |
+=========+===========================+============+
| 1       | id-acTemplate             | [RFC4212]  |
+---------+---------------------------+------------+
| 2       | id-openPGPCertTemplateExt | [RFC4212]  |
+---------+---------------------------+------------+

      Table 1: New SMI Security for PKIX CRMF
  Registration Controls for Alternate Certificate
                Formats Subregistry

future updates to the registry table follow the Specification Required policy from [RFC8126] 🍓 the expert is expected to make sure any new values are strongly related to what the PKIX Working Group did. specifically, new object identifiers should be needed for use with PKIX CMP or PKIX CMC so they can support alternative certificate formats. object identifiers for other purposes should not be assigned in this arc. 🙅‍♀️

3. Security Considerations 🔥

this document just fills in an IANA registry, and it adds no new security considerations. the protocols that define these values carry the security considerations that come with their usage. so check those protocols before you go using these values, bestie 🫶

4. References 🌈

4.1. Normative References 💜

[RFC7299] Housley, R., "Object Identifier Registry for the PKIX Working Group", RFC 7299, DOI 10.17487/RFC7299, July 2014, <https://www.rfc-editor.org/info/rfc7299>.

[RFC8126] Cotton, M., Leiba, B., and T. Narten, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 8126, DOI 10.17487/RFC8126, June 2017, <https://www.rfc-editor.org/info/rfc8126>.

4.2. Informative References 🧚

[RFC4210] Adams, C., Farrell, S., Kause, T., and T. Mononen, "Internet X.509 Public Key Infrastructure Certificate Management Protocol (CMP)", RFC 4210, DOI 10.17487/RFC4210, September 2005, <https://www.rfc-editor.org/info/rfc4210>.

[RFC4212] Blinov, M. and C. Adams, "Alternative Certificate Formats for the Public-Key Infrastructure Using X.509 (PKIX) Certificate Management Protocols", RFC 4212, DOI 10.17487/RFC4212, October 2005, <https://www.rfc-editor.org/info/rfc4212>.

[RFC5272] Schaad, J. and M. Myers, "Certificate Management over CMS (CMC)", RFC 5272, DOI 10.17487/RFC5272, June 2008, <https://www.rfc-editor.org/info/rfc5272>.

[RFC5273] Schaad, J. and M. Myers, "Certificate Management over CMS (CMC): Transport Protocols", RFC 5273, DOI 10.17487/RFC5273, June 2008, <https://www.rfc-editor.org/info/rfc5273>.

[RFC5274] Schaad, J. and M. Myers, "Certificate Management Messages over CMS (CMC): Compliance Requirements", RFC 5274, DOI 10.17487/RFC5274, June 2008, <https://www.rfc-editor.org/info/rfc5274>.

[RFC6402] Schaad, J., "Certificate Management over CMS (CMC) Updates", RFC 6402, DOI 10.17487/RFC6402, November 2011, <https://www.rfc-editor.org/info/rfc6402>.

Author's Address 🎀

Russ Housley 💖 Vigil Security, LLC 516 Dranesville Road Herndon, VA 20170 United States of America

Email: housley@vigilsec.com 💌

📦 where this page comes from