RFC 9509

X.509 Certificate Extended Key Usage (EKU) for 5G Network Functions

📅 published March 2024, from ietf

RFC 9509: X.509 Certificate Extended Key Usage (EKU) for 5G Network Functions ✨

Okay bestie, here's the header info 🎀

RFC number: 9509
Authors: T. Reddy.K and J. Ekman (both Nokia), and D. Migault (Ericsson) 🫶
Category: Standards Track
ISSN: 2070-1721
Date: March 2024
Obsoletes / Updates: the header has no obsoletes or updates line, so it doesn't list any RFCs it replaces or changes 🌸

Abstract 🦋

Okay so [RFC5280] defines a bunch of extended key purpose identifiers (KeyPurposeIds) for X.509 certificates. This doc adds new ones for three jobs: encrypting JSON objects in HTTP messages with JSON Web Encryption (JWE), signing JSON Web Token (JWT) claims with JSON Web Signature (JWS), and signing OAuth 2.0 access tokens. You put them in the Extended Key Usage (EKU) extension of X.509 v3 public key certificates that Network Functions (NFs) use in the 5G System. The vibe is "label your certs so nobody uses them for the wrong thing" 💅

Status of This Memo 📜

This is an Internet Standards Track document. 🔥

It's a product of the Internet Engineering Task Force (IETF), which means it has the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 7841 ✨

You can find the current status, any errata, and feedback info at https://www.rfc-editor.org/info/rfc9509 💜

Copyright Notice 🌈

The IETF Trust and the people listed as document authors own the copyright for 2024, and all rights are reserved 🎀

This document is covered by BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can read at https://trustee.ietf.org/license-info as they stood on the publication date. Read them carefully, because they spell out what you can and can't do with this document 🙈 Any code pulled out of this document needs to include the Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions. That code also comes with no warranty, same as the Revised BSD License says 🫶

Table of Contents 🗺️

1.  Introduction
2.  Terminology
3.  Extended Key Purpose for Network Functions
4.  Including the Extended Key Purpose in Certificates
5.  Implications for a Certification Authority
6.  Security Considerations
7.  Privacy Considerations
8.  IANA Considerations
9.  References
  9.1.  Normative References
  9.2.  Informative References
Appendix A.  ASN.1 Module
Acknowledgments
Contributor
Authors' Addresses

1. Introduction 🧚

Okay so the operators of 5G ("fifth generation") systems, as defined by 3GPP, run their own internal PKI to make X.509 certificates for the Network Functions (NFs) in a 5G System (Section 6 of [TS23.501]) 💖 These certs get used for a few things:

Client and Server certificates for NFs in 5G Core (5GC) Service Based Architecture (SBA) (see Section 6.1.3c of [TS33.310] and Section 6.7.2 of [TS29.500]) 🌸
Client Credentials Assertion (CCA) uses JSON Web Tokens (JWTs) [RFC7519] and gets secured with digital signatures based on the JSON Web Signature (JWS) [RFC7515] (see Section 13.3.8.2 of [TS33.501], and Section 6.7.5 of [TS29.500]) 🦋
Certificates for encrypting JSON objects in HTTP messages between Security Edge Protection Proxies (SEPPs) using JSON Web Encryption (JWE) [RFC7516] (see Section 13.2.4.4 of [TS33.501], Section 6.3.2 of [TS33.210], Section 6.7.4 of [TS29.500], and Section 5.3.2.1 of [TS29.573]) 🫧
Certificates for signing OAuth 2.0 access tokens for service authorization, so they can grant temporary access to resources provided by NF producers using JWS (see Section 13.4.1 of [TS33.501] and Section 6.7.3 of [TS29.500]) 👑

Now [RFC5280] specifies several key usage extensions, defined through KeyPurposeIds, for X.509 certificates. The whole point of those extensions is to show what a certificate is for, both to humans and to libraries that follow the rules 🍓 On top of that, the IANA registry "SMI Security for PKIX Extended Key Purpose" [RFC7299] has even more KeyPurposeIds. Using the anyExtendedKeyUsage KeyPurposeId (Section 4.2.1.12 of [RFC5280]) is generally seen as bad practice 🙈 That's especially true for publicly trusted certificates, whether they're multi-purpose or single-purpose, once you're inside 5G Systems and the 5GC Service Based Architecture.

Here's why it matters. If nobody restricts what a certificate is for, meaning the operations its public key can be used for are never specified, then it could get used for something other than what it was meant for. That raises the risk of cross-protocol attacks 💀 Segregation of duties is also a big deal. Say an NF generates its own public/private keys and then asks the operator certification authority for a certificate. That NF could end up with one that can be misused for tasks it isn't allowed to do. For instance, an NF service consumer could pretend to be an NF service producer using its certificate. And if the certificate is meant to be a client certificate for the NF service consumer, you have to make sure that NF and its private key can't sign the Client Credentials Assertion (CCA). When an NF service producer gets a signed CCA from the NF service consumer, the NF should only accept the token if the CCA was signed with a certificate that was explicitly issued for that purpose ✨

The KeyPurposeId id-kp-serverAuth (Section 4.2.1.12 of [RFC5280]) can show that a certificate is for a server (like an NF service producer). The KeyPurposeId id-kp-clientAuth (Section 4.2.1.12 of [RFC5280]) can show that it's for a client (like an NF service consumer). But right now there aren't any KeyPurposeIds for the other certificate uses in a 5G System 😭 This document fixes that gap by defining EKU values for X.509 public key certificates used to sign the JWT Claims Set with JWS, encrypt JSON objects in HTTP messages with JWE, and sign OAuth 2.0 access tokens with JWS 💅

Vendor-defined KeyPurposeIds that a vendor or group of vendors controls inside their own PKI usually don't cause interoperability problems, since non-critical extensions can be safely ignored when they're not recognised 🌈 But using or misusing KeyPurposeIds outside that vendor-controlled space can definitely cause interop issues. So it's advisable not to rely on vendor-defined KeyPurposeIds. Instead, this spec defines standard KeyPurposeIds so implementations work together across the board 🫶

This spec focuses on a 5G use case, but the standard KeyPurposeIds defined here can also be used in other deployments 🦋

2. Terminology 🎀

Here's the official keyword bit, so you know exactly what's a requirement 🧐 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

3. Extended Key Purpose for Network Functions 👑

This spec defines the KeyPurposeIds id-kp-jwt, id-kp-httpContentEncrypt, and id-kp-oauthAccessTokenSigning, and uses them for three things. id-kp-jwt is for signing the JWT Claims Set of a CCA with JWS. id-kp-httpContentEncrypt is for encrypting JSON objects in HTTP messages between Security Edge Protection Proxies (SEPPs) with JWE. id-kp-oauthAccessTokenSigning is for signing OAuth 2.0 access tokens for service authorization, which grant temporary access to resources provided by NF producers, using JWS 🦋

As [RFC5280] says, "[i]f the [Extended Key Usage] extension is present, then the certificate MUST only be used for one of the purposes indicated." It also notes that "[i]f multiple [key] purposes are indicated the application need not recognize all purposes indicated, as long as the intended purpose is present." 🫧

Now here's the part that matters for security 🔥 Network Functions that verify the signature on a CCA represented as a JWT, decrypt JSON objects in HTTP messages between SEPPs with JWE, or verify the signature on OAuth 2.0 access tokens (for service authorization, granting temporary access to NF producer resources) using JWS SHOULD require that the matching KeyPurposeIds are set in the EKU extension. If the certificate requester knows the certificate users are required to use these KeyPurposeIds, the requester MUST enforce their inclusion. On top of that, that same certificate requester MUST make sure the KeyUsage extension is set to digitalSignature or nonRepudiation (also called contentCommitment) for signature calculation, and/or to keyEncipherment for secret key encryption 💖

Heads up: if the KeyUsage and EKU values don't match up, you're basically inviting a certificate to be misused. Keep these in sync 💀

That's the end of part 1! 🌈 Part 2 picks up with Section 4, so stay tuned, bestie 💜

6. Security Considerations ✨

Okay bestie, security is where we get serious for a sec 🫶. The Security Considerations of [RFC5280] are applicable to this document. This extended key purpose doesn't add new security risks. It actually reduces existing ones 💅 because it gives you a way to tell whether a certificate was made to sign the JWT Claims Set, to sign OAuth 2.0 access tokens using JWS, or to encrypt the CEK in JWE for encrypting JSON objects in HTTP messages. That's iconic behaviour 👑

Now the cross-protocol attack stuff 👀. To lower the risk of specific cross-protocol attacks, the relying party or the relying party software may also prohibit using certain combinations of KeyPurposeIds. The procedure for allowing or disallowing those combinations using Excluded KeyPurposeId and Permitted KeyPurposeId, as carried out by a relying party, is defined in Section 4 of [RFC9336]. Examples of Excluded KeyPurposeIds are the presence of the anyExtendedKeyUsage KeyPurposeId, or the complete absence of the EKU extension in a certificate. Examples of Permitted KeyPurposeIds are the presence of id-kp-jwt, id-kp-httpContentEncrypt, or id-kp-oauthAccessTokenSigning KeyPurposeIds. Lowkey the most important vibe check in this whole doc 🔥

7. Privacy Considerations 🙈

Privacy time, and it's a little bit tea ☕. In some security protocols, like TLS 1.2 [RFC5246], certificates get exchanged in the clear. In others, like TLS 1.3 [RFC8446], the certificates are encrypted. The EKU extension can help an observer figure out what a certificate is for 👀. And if the certificate is issued by a public certification authority, including an EKU extension can help an attacker monitor the Certificate Transparency logs [RFC9162] to figure out the purpose of the certificate. Not me noticing the metadata leaking 💀

8. IANA Considerations 🧚

IANA has registered the following OIDs in the "SMI Security for PKIX Extended Key Purpose" registry (1.3.6.1.5.5.7.3). These OIDs are defined in Section 4. Bestie, here's the table 🍓

+=========+===============================+============+
| Decimal | Description                   | References |
+=========+===============================+============+
| 37      | id-kp-jwt                     | RFC 9509   |
+---------+-------------------------------+------------+
| 38      | id-kp-httpContentEncrypt      | RFC 9509   |
+---------+-------------------------------+------------+
| 39      | id-kp-oauthAccessTokenSigning | RFC 9509   |
+---------+-------------------------------+------------+

Table 1

IANA has also registered the following ASN.1[X.680] module OID in the "SMI Security for PKIX Module Identifier" registry (1.3.6.1.5.5.7.0). This OID is defined in Appendix A. Here's that one too 🌸

+=========+===============+============+
| Decimal | Description   | References |
+=========+===============+============+
| 108     | id-mod-nf-eku | RFC 9509   |
+---------+---------------+------------+

Table 2

9. References 📚

9.1. Normative References

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.

[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, https://www.rfc-editor.org/info/rfc5280.

[RFC7515] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May 2015, https://www.rfc-editor.org/info/rfc7515.

[RFC7516] Jones, M. and J. Hildebrand, "JSON Web Encryption (JWE)", RFC 7516, DOI 10.17487/RFC7516, May 2015, https://www.rfc-editor.org/info/rfc7516.

[RFC7519] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015, https://www.rfc-editor.org/info/rfc7519.

[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.

[X.680] ITU-T, "Information technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation", ITU-T Recommendation X.680, February 2021, https://www.itu.int/rec/T-REC-X.680.

[X.690] ITU-T, "Information technology - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)", ITU-T Recommendation X.690, February 2021, https://www.itu.int/rec/T-REC-X.690.

9.2. Informative References

[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/RFC5246, August 2008, https://www.rfc-editor.org/info/rfc5246.

[RFC7299] Housley, R., "Object Identifier Registry for the PKIX Working Group", RFC 7299, DOI 10.17487/RFC7299, July 2014, https://www.rfc-editor.org/info/rfc7299.

[RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, https://www.rfc-editor.org/info/rfc8446.

[RFC9162] Laurie, B., Messeri, E., and R. Stradling, "Certificate Transparency Version 2.0", RFC 9162, DOI 10.17487/RFC9162, December 2021, https://www.rfc-editor.org/info/rfc9162.

[RFC9336] Ito, T., Okubo, T., and S. Turner, "X.509 Certificate General-Purpose Extended Key Usage (EKU) for Document Signing", RFC 9336, DOI 10.17487/RFC9336, December 2022, https://www.rfc-editor.org/info/rfc9336.

[TS23.501] 3GPP, "System architecture for the 5G System (5GS)", Release 18.4.0, 3GPP TS 23.501, December 2023, https://www.3gpp.org/ftp/Specs/archive/23_series/23.501/23501-i40.zip.

[TS29.500] 3GPP, "5G System; Technical Realization of Service Based Architecture; Stage 3", Release 18.4.0, 3GPP TS 29.500, December 2023, https://www.3gpp.org/ftp/Specs/archive/29_series/29.500/29500-i40.zip.

[TS29.573] 3GPP, "5G System; Public Land Mobile Network (PLMN) Interconnection; Stage 3", Release 18.5.0, 3GPP TS 29.573, December 2023, https://www.3gpp.org/ftp/Specs/archive/29_series/29.573/29573-i50.zip.

[TS33.210] 3GPP, "Network Domain Security (NDS); IP network layer security", Release 17.1.0, 3GPP TS 33.210, September 2022, https://www.3gpp.org/ftp/Specs/archive/33_series/33.210/33210-h10.zip.

[TS33.310] 3GPP, "Network Domain Security (NDS); Authentication Framework (AF)", Release 18.2.0, 3GPP TS 33.310, December 2023, https://www.3gpp.org/ftp/Specs/archive/33_series/33.310/33310-i20.zip.

[TS33.501] 3GPP, "Security architecture and procedures for 5G system", Release 18.4.0, 3GPP TS 33.501, December 2023, https://www.3gpp.org/ftp/Specs/archive/33_series/33.501/33501-i40.zip.

Appendix A. ASN.1 Module 💖

The following module follows the ASN.1 specifications [X.680] and [X.690]. Here it is, verbatim 🫶

<CODE BEGINS>
NF-EKU
  { iso(1) identified-organization(3) dod(6) internet(1)
  security(5) mechanisms(5) pkix(7) id-mod(0)
  id-mod-nf-eku (108) }

DEFINITIONS IMPLICIT TAGS ::=
BEGIN

-- OID Arc

id-kp OBJECT IDENTIFIER ::=
  { iso(1) identified-organization(3) dod(6) internet(1)
    security(5) mechanisms(5) pkix(7) kp(3) }

-- Extended Key Usage Values

id-kp-jwt OBJECT IDENTIFIER ::= { id-kp 37 }
id-kp-httpContentEncrypt OBJECT IDENTIFIER ::= { id-kp 38 }
id-kp-oauthAccessTokenSigning OBJECT IDENTIFIER ::= { id-kp 39 }

END
<CODE ENDS>

Acknowledgments 🎀

We'd like to thank Corey Bonnell, Ilari Liusvaara, Carl Wallace, and Russ Housley for their useful feedback. Thanks to Yoav Nir for the secdir review, Elwyn Davies for the genart review, and Benson Muite for the intdir review. Thanks also to Paul Wouters, Lars Eggert, and Éric Vyncke for the IESG review. The squad really showed up 🥹✨

Contributor 🌈

The following individual has contributed to this document:

German Peinado Nokia Email: german.peinado@nokia.com

Authors' Addresses 🦋

Tirumaleswar Reddy.K Nokia India Email: kondtir@gmail.com

Jani Ekman Nokia Finland Email: jani.ekman@nokia.com

Daniel Migault Ericsson Canada Email: daniel.migault@ericsson.com

📦 where this page comes from

ietf: rfc9509 2024-03
💖 girlified by claude-haiku-5-5 on 2026-10-19: a language model's rewrite of the original, under its terms