RFC 9310
X.509 Certificate Extension for 5G Network Function Types
Abstract ✨
bestie, this one is the spec for a certificate extension that carries NF Types (Network Function Types) for the 5G System. It goes inside X.509 v3 public key certificates, the way [RFC5280] profiles them 🔐
Title Block 🎀
Okay, the vibes first. This is RFC 9310, and the title is "X.509 Certificate Extension for 5G Network Function Types" 💖
It's an IETF document on the Standards Track, which means it's an Internet Standards Track document. It's dated January 2023, and its ISSN is 2070-1721 🧚
The authors are R. Housley (Vigil Security), S. Turner (sn3rd), J. Preuß Mattsson (Ericsson), and D. Migault (Ericsson) 👑
The title block doesn't list anything that this RFC obsoletes or updates 🌸
Status of This Memo
This is an Internet Standards Track document 🌈
It's a product of the Internet Engineering Task Force (IETF), and it reflects the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 7841 💅
For the current status, any errata, and how to give feedback, check https://www.rfc-editor.org/info/rfc9310 🦋
Copyright Notice
Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved 💜
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they were in effect on the publication date. Read these carefully, because they cover your rights and restrictions for this document ⭐
Code Components pulled out of this document have to include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions. They come without warranty, as the Revised BSD License describes 🫶
Table of Contents 🍓
1. Introduction
2. Terminology
3. Network Function Types Certificate Extension
4. ASN.1 Module
5. Security Considerations
6. Privacy Considerations
7. IANA Considerations
8. References
8.1. Normative References
8.2. Informative References
Appendix A. NFType Strings
Appendix B. Example Certificate Containing a NFTypes Extension
Acknowledgements
Authors' Addresses1. Introduction 🌸
The 3rd Generation Partnership Project (3GPP) has specified several Network Functions (NFs) as part of the service-based architecture in the 5G System. There are 56 NF Types defined for 3GPP Release 17. They're listed in Table 6.1.6.3.3-1 of [TS29.510], and each NF type is identified by a short ASCII string ✨
Operators of 5G Systems use an internal PKI to identify interface instances in the NFs. They use X.509 v3 public key certificates [RFC5280], and the main job of a certificate is to bind a public key to the identity of the entity that holds the matching private key, which is called the certificate subject 🔐 The certificate subject and the SubjectAltName certificate extension can be used to support identity-based access control decisions 💖
This document specifies the NFTypes certificate extension to support role-based access control decisions. It does this by giving a list of NF Types associated with the certificate subject 🧚 The NFTypes certificate extension can be used by operators of 5G Systems or later 🦋
2. Terminology 💅
Okay so, here's how the key words work. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are read as described in BCP 14 [RFC2119] [RFC8174], but only when they show up in all capitals, exactly like this 🤓
3. Network Function Types Certificate Extension 🎀
This section specifies the NFTypes certificate extension. It gives a list of NF Types associated with the certificate subject, so this is the main event 👑
The NFTypes certificate extension MAY be included in public key certificates [RFC5280] 🌈
The NFTypes certificate extension MUST be identified by the following object identifier (OID) 🔥
id-pe-nftype OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-pe(1) 34 }This extension MUST NOT be marked critical 🙈
The NFTypes extension MUST have the following syntax 💜
NFTypes ::= SEQUENCE SIZE (1..MAX) OF NFType
NFType ::= IA5String (SIZE (1..32))The NFTypes MUST contain at least one NFType 🍓
Each NFType MUST contain only an ASCII string. The string MUST NOT include control characters (values 0 through 31), the space character (value 32), or the delete character (value 127) ⭐
Each NFType MUST contain at least one ASCII character, and it MUST NOT contain more than 32 ASCII characters 🦋
The NFTypes MUST NOT contain the same NFType more than once 💀
If the NFTypes contain more than one NFType, the NFTypes MUST appear in ascending lexicographic order using the ASCII values 🫶
The NFType uses the IA5String type so it can include the underscore character ('_'). The underscore isn't part of the PrintableString character set, which is why IA5String is used 🧚
4. ASN.1 Module 🧚
This section gives an ASN.1 Module [X.680] for the NFTypes certificate extension. It follows the conventions established in [RFC5912] and [RFC6268] 📜
<CODE BEGINS>
NFTypeCertExtn
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-nftype(106) }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
IMPORTS
EXTENSION
FROM PKIX-CommonTypes-2009 -- RFC 5912
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) } ;
-- NFTypes Certificate Extension
ext-NFType EXTENSION ::= {
SYNTAX NFTypes
IDENTIFIED BY id-pe-nftype }
-- NFTypes Certificate Extension OID
id-pe-nftype OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-pe(1) 34 }
-- NFTypes Certificate Extension Syntax
NFTypes ::= SEQUENCE SIZE (1..MAX) OF NFType
NFType ::= IA5String (SIZE (1..32))
END
<CODE ENDS>Part 1 is done, bestie 🎀 Next up is part 2, where we get into Security Considerations, Privacy Considerations, IANA, and the References. The security section is the spicy one 👀🔥
8.2. Informative References ✨
Okay, these are the "for your background reading" ones, bestie 📚 They're not required to build this, but they're the receipts for the stuff the doc leans on:
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/RFC5246, August 2008, <https://www.rfc-editor.org/info/rfc5246>. 🔐
[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)", RFC 5912, DOI 10.17487/RFC5912, June 2010, <https://www.rfc-editor.org/info/rfc5912>. 🧩
[RFC6268] Schaad, J. and S. Turner, "Additional New ASN.1 Modules for the Cryptographic Message Syntax (CMS) and the Public Key Infrastructure Using X.509 (PKIX)", RFC 6268, DOI 10.17487/RFC6268, July 2011, <https://www.rfc-editor.org/info/rfc6268>. 💌
[RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, <https://www.rfc-editor.org/info/rfc8446>. 🌟
[TS29.571] 3rd Generation Partnership Project, "Technical Specification Group Core Network and Terminals; 5G System; Common Data Types for Service Based Interfaces; Stage 3 (Release 17)", 3GPP TS:29.571 V17.8.0, December 2022, <https://www.3gpp.org/ftp/Specs/archive/29_series/29.571/29571-h80.zip>. 📡
Appendix A. NFType Strings 🎀
Okay so, [TS29.510] has a table (Table 6.1.6.3.3-1) with the ASCII strings for every NF Type in 3GPP documents. 🫶 The list below is the Release 17 enum values, sorted in ascending lexicographic order. ngl, it's not the full list, so don't treat it as the final word 💅
"5G_DDNMF" "LMF" "PKMF"
"5G_EIR" "MBSF" "SCEF"
"AANF" "MBSTF" "SCP"
"ADRF" "MB_SMF" "SCSAS"
"AF" "MB_UPF" "SCSCF"
"AMF" "MFAF" "SEPP"
"AUSF" "MME" "SMF"
"BSF" "MNPF" "SMSF"
"CBCF" "N3IWF" "SMS_GMSC"
"CEF" "NEF" "SMS_IWMSC"
"CHF" "NRF" "SOR_AF"
"DCCF" "NSACF" "SPAF"
"DRA" "NSSAAF" "TSCTSF"
"EASDF" "NSSF" "UCMF"
"GBA_BSF" "NSWOF" "UDM"
"GMLC" "NWDAF" "UDR"
"HSS" "PANF" "UDSF"
"ICSCF" "PCF" "UPF"
"IMS_AS" "PCSCF"Appendix B. Example Certificate Containing a NFTypes Extension 🦋
Okay, this is the glow-up moment 🌸 The example cert follows the certificate profile in Table 6.1.3c.3-1 of [TS33.310]. The NFTypes extension in it only has one NFType, and that NFType is "AMF" 👑 The SubjectAltName extension has a fully qualified domain name (FQDN) and a uniformResourceIdentifier, and that URI carries the NF Instance ID, as described in Clause 5.3.2 of [TS29.571] 💜
Here's the certificate itself:
-----BEGIN CERTIFICATE-----
MIIC0DCCAlagAwIBAgIUDD5o44zEdfSghT2hMK+P/EjGHlowCgYIKoZIzj0EAwMw
FTETMBEGA1UECgwKRXhhbXBsZSBDQTAeFw0yMjExMjkxODE0NThaFw0yMzExMjkx
ODE0NThaMDkxCzAJBgNVBAYTAlVTMSowKAYDVQQKEyE1Z2MubW5jNDAwLm1jYzMx
MS4zZ3BwbmV0d29yay5vcmcwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATJ6IFHI683
q/JJjsJUfEiRFqGQ6uKDGJ0oqDP6wEhRAuvyEyz5pgRmz/7Mze1+s1qcnPU9mo1v
rIW9rjKhb/Hm8H9TPvnMQwCRCtKvCD90MkWvc/G8qyCBpCms3zNOJOijggFBMIIB
PTATBggrBgEFBQcBIgQHMAUWA0FNRjAXBgNVHSAEEDAOMAwGCmCGSAFlAwIBMDAw
DgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBRM
Z5KgwYlYn885mKID55ZcEznIBzAfBgNVHSMEGDAWgBSIf6IE6QtqjXR2+p/xCtRh
4PqzNTAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vZXhhbXBsZS5jb20vZXhhbXBs
ZWNhLmNybDB1BgNVHREBAf8EazBpgjhhbWYxLmNsdXN0ZXIxLm5ldDIuYW1mLjVn
Yy5tbmM0MDAubWNjMzExLjNncHBuZXR3b3JrLm9yZ4YtdXJuOnV1aWQ6ZjgxZDRm
YWUtN2RlYy0xMWQwLWE3NjUtMDBhMGM5MWU2YmY2MAoGCCqGSM49BAMDA2gAMGUC
MEtQEut9kelkiMIMR+QzkSNGIuR30Lr23ftarLi9wMp3ZRIJYQgaAWc6gmf3MVAp
7QIxAKMoYAtw5srkNjE+Zg6CqEkf9f2banFltRuPbTp4B0Xraz5z/jn3NDPM9ata
SHUxOQ==
-----END CERTIFICATE-----Now the fun part, the decoded version 🔍 The numbers on the left are the ASN.1 tag (in hex) and the length (in decimal) ✨
30 720: SEQUENCE {
30 598: SEQUENCE {
A0 3: [0] {
02 1: INTEGER 2
: }
02 20: INTEGER
: 0C 3E 68 E3 8C C4 75 F4 A0 85 3D A1 30 AF 8F FC
: 48 C6 1E 5A
30 10: SEQUENCE {
06 8: OBJECT IDENTIFIER ecdsaWithSHA384 (1 2 840 10045 4 3 3)
: }
30 21: SEQUENCE {
31 19: SET {
30 17: SEQUENCE {
06 3: OBJECT IDENTIFIER organizationName (2 5 4 10)
0C 10: UTF8String 'Example CA'
: }
: }
: }
30 30: SEQUENCE {
17 13: UTCTime 29/11/2022 18:14:58 GMT
17 13: UTCTime 29/11/2023 18:14:58 GMT
: }
30 57: SEQUENCE {
31 11: SET {
30 9: SEQUENCE {
06 3: OBJECT IDENTIFIER countryName (2 5 4 6)
13 2: PrintableString 'US'
: }
: }
31 42: SET {
30 40: SEQUENCE {
06 3: OBJECT IDENTIFIER organizationName (2 5 4 10)
13 33: PrintableString '5gc.mnc400.mcc311.3gppnetwork.org'
: }
: }
: }
30 118: SEQUENCE {
30 16: SEQUENCE {
06 7: OBJECT IDENTIFIER ecPublicKey (1 2 840 10045 2 1)
06 5: OBJECT IDENTIFIER secp384r1 (1 3 132 0 34)
: }
03 98: BIT STRING
: 04 C9 E8 81 47 23 AF 37 AB F2 49 8E C2 54 7C 48
: 91 16 A1 90 EA E2 83 18 9D 28 A8 33 FA C0 48 51
: 02 EB F2 13 2C F9 A6 04 66 CF FE CC CD ED 7E B3
: 5A 9C 9C F5 3D 9A 8D 6F AC 85 BD AE 32 A1 6F F1
: E6 F0 7F 53 3E F9 CC 43 00 91 0A D2 AF 08 3F 74
: 32 45 AF 73 F1 BC AB 20 81 A4 29 AC DF 33 4E 24
: E8
: }
A3 321: [3] {
30 317: SEQUENCE {
30 19: SEQUENCE {
06 8: OBJECT IDENTIFIER nfTypes (1 3 6 1 5 5 7 1 34)
04 7: OCTET STRING, encapsulates {
30 5: SEQUENCE {
16 3: IA5String 'AMF'
: }
: }
: }
30 23: SEQUENCE {
06 3: OBJECT IDENTIFIER certificatePolicies (2 5 29 32)
04 16: OCTET STRING, encapsulates {
30 14: SEQUENCE {
30 12: SEQUENCE {
06 10: OBJECT IDENTIFIER '2 16 840 1 101 3 2 1 48 48'
: }
: }
: }
: }
30 14: SEQUENCE {
06 3: OBJECT IDENTIFIER keyUsage (2 5 29 15)
01 1: BOOLEAN TRUE
04 4: OCTET STRING, encapsulates {
03 2: BIT STRING 7 unused bits
: '1'B (bit 0)
: }
: }
30 19: SEQUENCE {
06 3: OBJECT IDENTIFIER extKeyUsage (2 5 29 37)
04 12: OCTET STRING, encapsulates {
30 10: SEQUENCE {
06 8: OBJECT IDENTIFIER clientAuth (1 3 6 1 5 5 7 3 2)
: }
: }
: }
30 29: SEQUENCE {
06 3: OBJECT IDENTIFIER subjectKeyIdentifier (2 5 29 14)
04 22: OCTET STRING, encapsulates {
04 20: OCTET STRING
: 4C 67 92 A0 C1 89 58 9F CF 39 98 A2 03 E7 96 5C
: 13 39 C8 07
: }
: }
30 31: SEQUENCE {
06 3: OBJECT IDENTIFIER authorityKeyIdentifier (2 5 29 35)
04 24: OCTET STRING, encapsulates {
30 22: SEQUENCE {
80 20: [0]
: 88 7F A2 04 E9 0B 6A 8D 74 76 FA 9F F1 0A D4 61
: E0 FA B3 35
: }
: }
: }
30 49: SEQUENCE {
06 3: OBJECT IDENTIFIER cRLDistributionPoints (2 5 29 31)
04 42: OCTET STRING, encapsulates {
30 40: SEQUENCE {
30 38: SEQUENCE {
A0 36: [0] {
A0 34: [0] {
86 32: [6] 'http://example.com/exampleca.crl'
: }
: }
: }
: }
: }
: }
30 117: SEQUENCE {
06 3: OBJECT IDENTIFIER subjectAltName (2 5 29 17)
01 1: BOOLEAN TRUE
04 107: OCTET STRING, encapsulates {
30 105: SEQUENCE {
82 56: [2]
: 'amf1.cluster1.net2.amf.5gc.mnc400.mcc311.3gppnet'
: 'work.org'
86 45: [6]
: 'urn:uuid:f81d4fae-7dec-11d0-a765-00a0c91e6bf6'
: }
: }
: }
: }
: }
: }
30 10: SEQUENCE {
06 8: OBJECT IDENTIFIER ecdsaWithSHA384 (1 2 840 10045 4 3 3)
: }
03 104: BIT STRING, encapsulates {
30 101: SEQUENCE {
02 48: INTEGER
: 4B 50 12 EB 7D 91 E9 64 88 C2 0C 47 E4 33 91 23
: 46 22 E4 77 D0 BA F6 DD FB 5A AC B8 BD C0 CA 77
: 65 12 09 61 08 1A 01 67 3A 82 67 F7 31 50 29 ED
02 49: INTEGER
: 00 A3 28 60 0B 70 E6 CA E4 36 31 3E 66 0E 82 A8
: 49 1F F5 FD 9B 6A 71 65 B5 1B 8F 6D 3A 78 07 45
: EB 6B 3E 73 FE 39 F7 34 33 CC F5 AB 5A 48 75 31
: 39
: }
: }
: }Acknowledgements 🫶
Huge thank-yous to Ben Smeets, Michael Li, Tim Hollebeek, Roman Danyliw, Bernie Volz, and Éric Vyncke for reviewing, commenting, and helping out. You all are literally the MVPs 🏆💖
Authors' Addresses 💌
Russ Housley Vigil Security, LLC Herndon, VA United States of America Email: housley@vigilsec.com
Sean Turner sn3rd Washington, DC United States of America Email: sean@sn3rd.com
John Preuß Mattsson Ericsson Kista Sweden Email: john.mattsson@ericsson.com
Daniel Migault Ericsson Saint Laurent, QC Canada Email: daniel.migault@ericsson.com
📦 where this page comes from
- ietf: rfc9310 2023-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms