Certificate Management Messages over CMS (CMC): Compliance Requirements
RFC 5274

Network Working Group                                          J. Schaad
Request for Comments: 5274                       Soaring Hawk Consulting
Category: Standards Track                                       M. Myers
                                               TraceRoute Security, Inc.
                                                               June 2008

Certificate Management Messages over CMS (CMC): Compliance Requirements

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Abstract

   This document provides a set of compliance statements about the CMC
   (Certificate Management over CMS) enrollment protocol.  The ASN.1
   structures and the transport mechanisms for the CMC enrollment
   protocol are covered in other documents.  This document provides the
   information needed to make a compliant version of CMC.

Table of Contents

   1.  Overview . . . . . . . . . . . . . . . . . . . . . . . . . . .  2
   2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  2
   3.  Requirements Terminology . . . . . . . . . . . . . . . . . . .  3
   4.  Requirements for All Entities  . . . . . . . . . . . . . . . .  3
     4.1.  Cryptographic Algorithm Requirements . . . . . . . . . . .  4
     4.2.  Controls . . . . . . . . . . . . . . . . . . . . . . . . .  6
     4.3.  CRMF Feature Requirements  . . . . . . . . . . . . . . . .  8
     4.4.  Requirements for Clients . . . . . . . . . . . . . . . . .  8
   5.  Requirements for Servers . . . . . . . . . . . . . . . . . . .  8
   6.  Requirements for EEs . . . . . . . . . . . . . . . . . . . . .  8
   7.  Requirements for RAs . . . . . . . . . . . . . . . . . . . . .  8
   8.  Requirements for CAs . . . . . . . . . . . . . . . . . . . . .  9
   9.  Security Considerations  . . . . . . . . . . . . . . . . . . .  9
   10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . .  9
   11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
     11.1. Normative References . . . . . . . . . . . . . . . . . . . 10
     11.2. Informative References . . . . . . . . . . . . . . . . . . 11

Schaad & Myers              Standards Track                     [Page 1]
RFC 5274                    CMC: Compliance                    June 2008

1.  Overview

   The CMC (Certificate Management over CMS) protocol is designed in
   terms of a client/server relationship.  In the simplest case, the
   client is the requestor of the certificate (i.e., the End Entity
   (EE)) and the server is the issuer of the certificate (i.e., the
   Certification Authority (CA)).  The introduction of a Registration
   Authority (RA) into the set of agents complicates the picture only
   slightly.  The RA becomes the server with respect to the certificate
   requestor, and it becomes the client with respect to the certificate
   issuer.  Any number of RAs can be inserted into the picture in this
   manner.

   The RAs may serve specialized purposes that are not currently covered
   by this document.  One such purpose would be a Key Escrow agent.  As
   such, all certificate requests for encryption keys would be directed
   through this RA and it would take appropriate action to do the key
   archival.  Key recovery requests could be defined in the CMC
   methodology allowing for the Key Escrow agent to perform that
   operation acting as the final server in the chain of agents.

   If there are multiple RAs in the system, it is considered normal that
   not all RAs will see all certificate requests.  The routing between
   the RAs may be dependent on the content of the certificate requests
   involved.

   This document is divided into six sections, each section specifying
   the requirements that are specific to a class of agents in the CMC
   model.  These are 1) All agents, 2) all servers, 3) all clients, 4)
   all End-Entities, 5) all Registration Entities, 6) all Certificate
   Authorities.

2.  Terminology

   There are several different terms, abbreviations, and acronyms used
   in this document that we define here for convenience and consistency
   of usage:

   End-Entity  (EE) refers to the entity that owns a key pair and for
      whom a certificate is issued.

   Registration Authority (RA)  or Local RA (LRA) refers to an entity
      that acts as an intermediary between the EE and the CA.  Multiple
      RAs can exist between the End-Entity and the Certification
      Authority.  RAs may perform additional services such as key
      generation or key archival.  This document uses the term RA for