Internet Engineering Task Force M. Jenkins Internet-Draft L. Zieglar Intended status: Informational NSA Expires: October 12, 2018 April 10, 2018 Commercial National Security Algorithm (CNSA) Suite Certificate and Certificate Revocation List (CRL) Profile draft-jenkins-cnsa-cert-crl-profile-02 Abstract This document specifies a base profile for X.509 v3 Certificates and X.509 v2 Certificate Revocation Lists (CRLs) for use with the United States National Security Agency's Commercial National Security Algorithm (CNSA) Suite. The reader is assumed to have familiarity with RFC 5280, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile". Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on October 12, 2018. Copyright Notice Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of Jenkins & Zieglar Expires October 12, 2018 [Page 1] Internet-Draft CNSA Suite Certificate and CRL Profile April 2018 the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. General Requirements and Assumptions . . . . . . . . . . . . 3 3.1. Implementing the CNSA Suite . . . . . . . . . . . . . . . 3 3.2. CNSA Suite Object Identifiers . . . . . . . . . . . . . . 4 4. CNSA Suite Base Certificate Required Values . . . . . . . . . 5 4.1. signatureAlgorithm . . . . . . . . . . . . . . . . . . . 6 4.2. signatureValue . . . . . . . . . . . . . . . . . . . . . 6 4.3. Version . . . . . . . . . . . . . . . . . . . . . . . . . 7 4.4. SubjectPublicKeyInfo . . . . . . . . . . . . . . . . . . 7 5. Certificate Extensions for Particular Types of Certificates . 8 5.1. CNSA Suite Self-Signed CA Certificates . . . . . . . . . 8 5.2. CNSA Suite Non-Self-Signed CA Certificates . . . . . . . 8 5.3. CNSA Suite End Entity Signature and Key Establishment Certificates . . . . . . . . . . . . . . . . . . . . . . 9 6. CNSA Suite CRL Requirements . . . . . . . . . . . . . . . . . 9 7. Security Considerations . . . . . . . . . . . . . . . . . . . 9 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 10 9.1. Normative References . . . . . . . . . . . . . . . . . . 10 9.2. Informative References . . . . . . . . . . . . . . . . . 11 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 11 1. Introduction This document specifies a base profile for X.509 v3 Certificates and X.509 v2 Certificate Revocation Lists (CRLs) for use by applications that support the United States National Security Agency's Commercial National Security Algorithm (CNSA) Suite [CNSA]. This profile of [RFC5280] applies to all CNSA Suite solutions that make use of X.509 v3 Certificates or X.509 v2 CRLs. The reader is assumed to have familiarity with RFC 5280. All MUST-level requirements of RFC 5280 apply throughout this profile and are generally not repeated here. In cases where a MUST-level requirement is repeated for emphasis, the text notes the requirement is "in adherence with RFC 5280". This profile contains changes that elevate some SHOULD-level options in RFC 5280 to MUST-level for this profile; this profile also contains changes that elevate some MAY-level options in RFC 5280 to SHOULD-level or MUST-level in this profile. All options from RFC 5280 that are not listed in this profile remain at the requirement level of RFC 5280. Jenkins & Zieglar Expires October 12, 2018 [Page 2] Internet-Draft CNSA Suite Certificate and CRL Profile April 2018 The reader is also assumed to have familiarity with these documents: o [RFC5480] for the syntax and semantics for the Subject Public Key Information field in certificates that support Elliptic Curve Cryptography; o [RFC5758] for the algorithm identifiers for Elliptic Curve Digital Signature Algorithm (ECDSA); o [RFC3279] for the syntax and semantics for the Subject Public Key Information field in certificates that support RSA Cryptography; and o [RFC4055] for the algorithm identifiers for RSA Cryptography with the SHA-384 hash function. 2. Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 3. General Requirements and Assumptions The goal of this document is to define a base set of requirements for certificates and CRLs to support interoperability among CNSA Suite solutions. Specific communities, such as the US National Security Systems, may define community profiles that further restrict certificate and CRL contents by mandating the presence of extensions that are optional in this base profile, defining new optional or critical extension types, or restricting the values and/or presence of fields within existing extensions. However, communications between distinct communities MUST conform to the requirements specified in this document when interoperability is desired. Applications may add requirements for additional non-critical extensions but they MUST NOT assume that a remote peer will be able to process them. 3.1. Implementing the CNSA Suite Every CNSA Suite certificate MUST use the X.509 v3 format, and contain either: o An ECDSA-capable signature verification key using curve P-384; or Jenkins & Zieglar Expires October 12, 2018 [Page 3] Internet-Draft CNSA Suite Certificate and CRL Profile April 2018 o An ECDH-capable (Elliptic Curve Diffie-Hellman) key establishment key using curve P-384; or o An RSA-capable signature verification key using RSA-3072 or RSA- 4096; or o An RSA-capable key transport key using RSA-3072 or RSA-4096. The signature algorithm applied to all CNSA Suite certificates and CRLs MUST use the SHA-384 hashing algorithm. The signing Certification Authority's (CA) key MUST conform to the following: o for certificates containing key generated on the curve P-384, or CRLs citing such certificates, the CA's certificate signing key MUST also have been generated on the curve P-384. o for certificates containing an RSA-3072 key, or CRLs citing such certificates, the CA's certificate signing key MUST be either an RSA-3072 key or RSA-4096 key. o for certificates containing an RSA-4096 key, or CRLs citing such certificates, the CA's certificate signing key MUST also be an RSA-4096 key. As a result, a community that uses both ECC and RSA cryptographic key primatives will need a separate trust points for each. RSA exponents e MUST satisfy 2^16. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC3279] Bassham, L., Polk, W., and R. Housley, "Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 3279, DOI 10.17487/RFC3279, April 2002, . [RFC4055] Schaad, J., Kaliski, B., and R. Housley, "Additional Algorithms and Identifiers for RSA Cryptography for use in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 4055, DOI 10.17487/RFC4055, June 2005, . [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, . [RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T. Polk, "Elliptic Curve Cryptography Subject Public Key Information", RFC 5480, DOI 10.17487/RFC5480, March 2009, . [RFC5758] Dang, Q., Santesson, S., Moriarty, K., Brown, D., and T. Polk, "Internet X.509 Public Key Infrastructure: Additional Algorithms and Identifiers for DSA and ECDSA", RFC 5758, DOI 10.17487/RFC5758, January 2010, . Jenkins & Zieglar Expires October 12, 2018 [Page 10] Internet-Draft CNSA Suite Certificate and CRL Profile April 2018 [RFC8017] Moriarty, K., Ed., Kaliski, B., Jonsson, J., and A. Rusch, "PKCS #1: RSA Cryptography Specifications Version 2.2", RFC 8017, DOI 10.17487/RFC8017, November 2016, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . 9.2. Informative References [CNSA] Committee for National Security Systems, "Commercial National Security Algorithm (CNSA) Suite", 2015, . [SEC1] Standards for Efficient Cryptography Group, "SEC1: Elliptic Curve Cryptography", September 2000. [SEC2] Standards for Efficient Cryptography Group, "SEC 2: Recommended Elliptic Curve Domain Parameters", September 2000. [SP-800-57] Barker, E., "Recommendation for Key Management-Part 1 Revision 4: General", Special Publication 800-57, January 2016, . [X9.62] American National Standards Institute, "Public Key Cryptography for the Financial Services Industry; The Elliptic Curve Digital Signature Algorithm (ECDSA)", ANS X9.62, December 2005. [X9.63] American National Standards Institute, "Public Key Cryptography for the Financial Services Industry; Key Agreement and Key Transport Using Elliptic Curve Cryptography", ANS X9.63, December 2001. Authors' Addresses Michael Jenkins National Security Agency Email: mjjenki@tycho.ncsc.mil Jenkins & Zieglar Expires October 12, 2018 [Page 11] Internet-Draft CNSA Suite Certificate and CRL Profile April 2018 Lydia Zieglar National Security Agency Email: llziegl@nsa.gov Jenkins & Zieglar Expires October 12, 2018 [Page 12]