RFC 9169
New ASN.1 Modules for the Evidence Record Syntax (ERS)
RFC 9169: New ASN.1 Modules for the Evidence Record Syntax (ERS) 🎀
Okay bestie, let's get into it. This is RFC 9169, from the IETF (Internet Engineering Task Force). The authors are R. Housley (Vigil Security) and C. Wallace (Red Hound Software). It's Informational, not a Standards Track spec, so it's published for info, not as a rule to follow. The ISSN is 2070-1721 and the date is December 2021 📅. The title block doesn't list anything it obsoletes or updates. 🦋
Abstract 🌸
So the Evidence Record Syntax (ERS) and the rules for putting those evidence records into the Server-based Certificate Validation Protocol (SCVP) are both written in ASN.1 💅. This doc gives you new ASN.1 modules that follow the 2002 version of ASN.1 and use the conventions from RFCs 5911, 5912, and 6268. Literally no bits on the wire change 🙈. It's only the ASN.1 syntax that's different, not the actual formats. ✨
Status of This Memo 🧚
This document is not an Internet Standards Track spec. It's published just for info 💜.
It's an IETF product and it reflects IETF community consensus. It got public review and the IESG (Internet Engineering Steering Group) approved it for publication. Not every IESG-approved doc is up for any level of Internet Standard, so check out Section 2 of RFC 7841 if you want the full story 🤓.
For the current status, errata, and where to send feedback, go to https://www.rfc-editor.org/info/rfc9169 🔗.
Copyright Notice 🫶
Copyright (c) 2021 IETF Trust and the people listed as the document authors. All rights reserved 💖.
This doc is covered by BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info), as they stood when it was published. Read those carefully, because they spell out what you can and can't do with this doc 📜. Any Code Components pulled out of this doc have to include the Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions. They come with no warranty, same as the Revised BSD License says 🔥.
Table of Contents 🍓
1. Introduction
2. ASN.1 Module for RFC 4998
3. ASN.1 Module for RFC 5276
4. IANA Considerations
5. Security Considerations
6. References
6.1. Normative References
6.2. Informative References
Authors' Addresses1. Introduction ✨
Some developers want the IETF to use the newest version of ASN.1 in its standards, and honestly, same 🙌. This doc gives you alternative ASN.1 modules to help make that happen 👑.
The Evidence Record Syntax (ERS) [RFC4998] ships with two ASN.1 modules. One uses the 1988 syntax [OLD-ASN1], which the ITU-T has deprecated 💀. The other uses the newer syntax [NEW-ASN1], and that one's still maintained and getting upgrades 🌈. This doc adds another alternative module that follows the conventions in [RFC5911], [RFC5912], and [RFC6268] 💅.
Next, [RFC5276] describes how evidence records get carried inside the Server-based Certificate Validation Protocol (SCVP) [RFC5055] 🦋. That RFC has only one ASN.1 module, and it's in the 1988 syntax [OLD-ASN1]. This doc gives you an alternative using the newer syntax [NEW-ASN1], and it also follows [RFC5911], [RFC5912], and [RFC6268]. Heads up that [RFC5912] already has an alternative ASN.1 module for SCVP [RFC5055] 🎀.
Some of the original ASN.1 modules borrow definitions from outside the RFC series, and those are kinda hard to track down 😭. The alternative modules here are self-contained when you combine them with the modules in [RFC5911], [RFC5912], and [RFC6268] 🫶.
The alternative modules make the same bits on the wire as the originals 🔥.
The alternative modules are informative, and the originals are normative 📚.
2. ASN.1 Module for RFC 4998 💖
<CODE BEGINS>
ERS-2021
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) ltans(11) id-mod(0)
id-mod-ers(1) id-mod-ers-v2(2) }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
EXPORTS ALL;
IMPORTS
ContentInfo
FROM CryptographicMessageSyntax-2010 -- in [RFC6268]
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
pkcs-9(9) smime(16) modules(0) id-mod-cms-2009(58) }
AlgorithmIdentifier{}, DIGEST-ALGORITHM
FROM AlgorithmInformation-2009 -- in [RFC5912]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-algorithmInformation-02(58) }
AttributeSet{}, ATTRIBUTE
FROM PKIX-CommonTypes-2009 -- in [RFC5912]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) }
;
ltans OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) ltans(11) }
EvidenceRecord ::= SEQUENCE {
version INTEGER { v1(1) },
digestAlgorithms SEQUENCE OF AlgorithmIdentifier
{DIGEST-ALGORITHM, {...}},
cryptoInfos [0] CryptoInfos OPTIONAL,
encryptionInfo [1] EncryptionInfo OPTIONAL,
archiveTimeStampSequence ArchiveTimeStampSequence }
CryptoInfos ::= SEQUENCE SIZE (1..MAX) OF Attribute
ArchiveTimeStamp ::= SEQUENCE {
digestAlgorithm [0] AlgorithmIdentifier
{DIGEST-ALGORITHM, {...}} OPTIONAL,
attributes [1] Attributes OPTIONAL,
reducedHashtree [2] SEQUENCE OF PartialHashtree OPTIONAL,
timeStamp ContentInfo }
PartialHashtree ::= SEQUENCE OF OCTET STRING
Attributes ::= SET SIZE (1..MAX) OF Attribute
ArchiveTimeStampChain ::= SEQUENCE OF ArchiveTimeStamp
ArchiveTimeStampSequence ::= SEQUENCE OF ArchiveTimeStampChain
EncryptionInfo ::= SEQUENCE {
encryptionInfoType ENCINFO-TYPE.&id
({SupportedEncryptionAlgorithms}),
encryptionInfoValue ENCINFO-TYPE.&Type
({SupportedEncryptionAlgorithms}{@encryptionInfoType}) }
ENCINFO-TYPE ::= TYPE-IDENTIFIER
SupportedEncryptionAlgorithms ENCINFO-TYPE ::= { ... }
aa-er-internal ATTRIBUTE ::=
{ TYPE EvidenceRecord IDENTIFIED BY id-aa-er-internal }
id-aa-er-internal OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs9(9) smime(16) id-aa(2) 49 }
aa-er-external ATTRIBUTE ::=
{ TYPE EvidenceRecord IDENTIFIED BY id-aa-er-external }
id-aa-er-external OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs9(9) smime(16) id-aa(2) 50 }
ERSAttrSet ATTRIBUTE ::= { aa-er-internal | aa-er-external, ... }
Attribute ::= AttributeSet {{ERSAttrSet}}
END
<CODE ENDS>3. ASN.1 Module for RFC 5276 🧚
<CODE BEGINS>
LTANS-SCVP-EXTENSION-2021
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) ltans(11) id-mod(0)
id-mod-ers-scvp(5) id-mod-ers-scvp-v2(2) }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
EXPORTS ALL;
IMPORTS
id-swb, CertBundle, WANT-BACK, AllWantBacks
FROM SCVP-2009 -- in [RFC5912]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-scvp-02(52) }
EvidenceRecord
FROM ERS-2021 -- in [RFC9169]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) ltans(11) id-mod(0)
id-mod-ers(1) id-mod-ers-v2(2) }
;
EvidenceRecordWantBack ::= SEQUENCE {
targetWantBack WANT-BACK.&id ({ExpandedWantBacks}),
evidenceRecord EvidenceRecord OPTIONAL }
EvidenceRecordWantBacks ::= SEQUENCE SIZE (1..MAX) OF
EvidenceRecordWantBack
EvidenceRecords ::= SEQUENCE SIZE (1..MAX) OF EvidenceRecord
ExpandedWantBacks WANT-BACK ::= { AllWantBacks |
NewWantBacks |
ERSWantBacks, ... }
NewWantBacks WANT-BACK ::= { swb-partial-cert-path, ... }
swb-partial-cert-path WANT-BACK ::=
{ CertBundle IDENTIFIED BY id-swb-partial-cert-path }
id-swb-partial-cert-path OBJECT IDENTIFIER ::= { id-swb 15 }
ERSWantBacks WANT-BACK ::= { swb-ers-pkc-cert |
swb-ers-best-cert-path |
swb-ers-partial-cert-path |
swb-ers-revocation-info |
swb-ers-all, ... }
swb-ers-pkc-cert WANT-BACK ::=
{ EvidenceRecord IDENTIFIED BY id-swb-ers-pkc-cert }
id-swb-ers-pkc-cert OBJECT IDENTIFIER ::= { id-swb 16 }
swb-ers-best-cert-path WANT-BACK ::=
{ EvidenceRecord IDENTIFIED BY id-swb-ers-best-cert-path }
id-swb-ers-best-cert-path OBJECT IDENTIFIER ::= { id-swb 17 }
swb-ers-partial-cert-path WANT-BACK ::=
{ EvidenceRecord IDENTIFIED BY id-swb-ers-partial-cert-path }
id-swb-ers-partial-cert-path OBJECT IDENTIFIER ::= { id-swb 18 }
swb-ers-revocation-info WANT-BACK ::=
{ EvidenceRecords IDENTIFIED BY id-swb-ers-revocation-info }
id-swb-ers-revocation-info OBJECT IDENTIFIER ::= { id-swb 19 }
swb-ers-all WANT-BACK ::=
{ EvidenceRecordWantBacks IDENTIFIED BY id-swb-ers-all }
id-swb-ers-all OBJECT IDENTIFIER ::= { id-swb 20 }
END
<CODE ENDS>6.1. Normative References ✨
okay bestie, these are the must-read docs this spec leans on so hard 📚💜 without them the whole thing is giving confusing, so here they are, fully intact:
[NEW-ASN1] ITU-T, "Information technology -- Abstract Syntax Notation One (ASN.1): Specification of basic notation", ITU-T Recommendation X.680, ISO/IEC 8824-1:2021, February 2021, https://www.itu.int/rec/T-REC-X.680.
[RFC4998] Gondrom, T., Brandner, R., and U. Pordesch, "Evidence Record Syntax (ERS)", RFC 4998, DOI 10.17487/RFC4998, August 2007, https://www.rfc-editor.org/info/rfc4998. 🦋
[RFC5055] Freeman, T., Housley, R., Malpani, A., Cooper, D., and W. Polk, "Server-Based Certificate Validation Protocol (SCVP)", RFC 5055, DOI 10.17487/RFC5055, December 2007, https://www.rfc-editor.org/info/rfc5055. 🌸
[RFC5276] Wallace, C., "Using the Server-Based Certificate Validation Protocol (SCVP) to Convey Long-Term Evidence Records", RFC 5276, DOI 10.17487/RFC5276, August 2008, https://www.rfc-editor.org/info/rfc5276. 💅
[RFC5911] Hoffman, P. and J. Schaad, "New ASN.1 Modules for Cryptographic Message Syntax (CMS) and S/MIME", RFC 5911, DOI 10.17487/RFC5911, June 2010, https://www.rfc-editor.org/info/rfc5911. 🧚
[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)", RFC 5912, DOI 10.17487/RFC5912, June 2010, https://www.rfc-editor.org/info/rfc5912. 🎀
[RFC6268] Schaad, J. and S. Turner, "Additional New ASN.1 Modules for the Cryptographic Message Syntax (CMS) and the Public Key Infrastructure Using X.509 (PKIX)", RFC 6268, DOI 10.17487/RFC6268, July 2011, https://www.rfc-editor.org/info/rfc6268. ✨
6.2. Informative References 🦋
and these ones are the background reading 🌈 not required to follow along, but they're giving context and history, so they're worth a peek 🫶
[OLD-ASN1] CCITT, "Specification of Abstract Syntax Notation One (ASN.1)", CCITT Recommendation X.208, November 1988, https://www.itu.int/rec/T-REC-X.208/en. 🍓
Authors' Addresses 💖
the people who wrote this, and where to find them 💌
Russ Housley
Vigil Security, LLC
516 Dranesville Road
Herndon, VA 20170
United States of America
Email: housley@vigilsec.com
Carl Wallace
Red Hound Software, Inc.
5112 27th St. N
Arlington, VA 22207
United States of America
Email: carl@redhoundsoftware.com📦 where this page comes from
- ietf: rfc9169 2021-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms