Update to the Cryptographic Message Syntax (CMS) Algorithm Identifier Protection Attribute
draft-ietf-lamps-rfc6211-update-01

LAMPS                                                         R. Housley
Internet-Draft                                            Vigil Security
Updates: 6211 (if approved)                                    S. Turner
Intended status: Standards Track                                   sn3rd
Expires: 13 March 2027                                  9 September 2026

 Update to the Cryptographic Message Syntax (CMS) Algorithm Identifier
                          Protection Attribute
                   draft-ietf-lamps-rfc6211-update-01

Abstract

   This document updates RFC 6211.  It corrects an error in the
   definition of the id-aa-CMSAlgorithmProtect ASN.1 object identifier.
   The IANA registry entry has always been correct.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 13 March 2027.

Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Housley & Turner          Expires 13 March 2027                 [Page 1]
Internet-Draft             Update to RFC 6211             September 2026

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Update to Section 2 of RFC 6211 . . . . . . . . . . . . . . .   2
   3.  Update to Appendix A of RFC 6211  . . . . . . . . . . . . . .   3
   4.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   4
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
   6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   4
     6.1.  Normative References  . . . . . . . . . . . . . . . . . .   4
     6.2.  Informative References  . . . . . . . . . . . . . . . . .   4
   Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .   4
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   5

1.  Introduction

   This document corrects a mistake in [RFC6211].  It corrects an error
   in definition of the id-aa-CMSAlgorithmProtection ASN.1 object
   identifier.

   The IANA registry entry for this ASN.1 object identifier does not
   need to be updated; it has always been correct.

   The authors are aware of two implementations of RFC 6211, but they
   did not interoperate because one used the ASN.1 object identifier
   from RFC 6211 and the other used the ASN.1 object identifier from the
   IANA registry.

   The mistakes were reported in [Err9144] and [Err9145].

   In addition, the body of the document says that the set of attributes
   will "include only one instance of the algorithm protection
   attribute."  This requirement can be included in the ASN.1 defintion.

   This update to RFC 6211 will hopefully resolve future
   interoperability troubles.

2.  Update to Section 2 of RFC 6211

   OLD:

Housley & Turner          Expires 13 March 2027                 [Page 2]
Internet-Draft             Update to RFC 6211             September 2026

        aa-cmsAlgorithmProtection ATTRIBUTE ::= {
            TYPE CMSAlgorithmProtection
            IDENTIFIED BY { id-aa-CMSAlgorithmProtection }
        }

    The following object identifier identifies the algorithm protection
    attribute:

        id-aa-CMSAlgorithmProtection OBJECT IDENTIFIER ::= { iso(1)
             member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9) 52 }

   NEW:

         aa-cmsAlgorithmProtection ATTRIBUTE ::= {
             TYPE CMSAlgorithmProtection
             COUNTS MAX 1
             IDENTIFIED BY id-aa-CMSAlgorithmProtect
         }

     The following object identifier identifies the algorithm protection
     attribute:

         id-aa-CMSAlgorithmProtect OBJECT IDENTIFIER ::= { iso(1)
              member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
              smime(16) aa(2) 52 }

3.  Update to Appendix A of RFC 6211

   OLD:

        aa-cmsAlgorithmProtection ATTRIBUTE ::= {
           TYPE CMSAlgorithmProtection
           IDENTIFIED BY { id-aa-cmsAlgorithmProtect }
        }

        id-aa-cmsAlgorithmProtect OBJECT IDENTIFIER ::= {
           iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
           pkcs9(9) 52 }

   NEW:

Housley & Turner          Expires 13 March 2027                 [Page 3]
Internet-Draft             Update to RFC 6211             September 2026

        aa-cmsAlgorithmProtection ATTRIBUTE ::= {
              TYPE CMSAlgorithmProtection
              COUNTS MAX 1
              IDENTIFIED BY id-aa-CMSAlgorithmProtect
        }

        id-aa-cmsAlgorithmProtect OBJECT IDENTIFIER ::= {
           iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
           pkcs9(9) smime(16) aa(2) 52 }

4.  IANA Considerations

   No IANA registry updates are needed.  The IANA registry is correct.

5.  Security Considerations

   The CMS attribute specified in [RFC6211] is designed to address the
   security issue of algorithm substitutions.  That is, the originator
   uses one algorithm, an attacker modifies the message, and then the
   validator uses a different algorithm.  The specified protection is
   not successful unless all implementers use the same ASN.1 object
   identifier for the attribute.

6.  References

6.1.  Normative References

   [RFC6211]  Schaad, J., "Cryptographic Message Syntax (CMS) Algorithm
              Identifier Protection Attribute", RFC 6211,
              DOI 10.17487/RFC6211, April 2011,
              <https://www.rfc-editor.org/rfc/rfc6211>.

6.2.  Informative References

   [Err9144]  RFC Editor, "RFC 6211 Errata Report ID 9144", 19 August
              2026, <https://errata.rfc-editor.org/eid9144/>.

   [Err9145]  RFC Editor, "RFC 6211 Errata Report ID 9145", 19 August
              2026, <https://errata.rfc-editor.org/eid9145/>.

Acknowledgments

   Thanks to Paul Timmel for being the first person to spot the error in
   [RFC6211].

   Thanks to Corey Bonnell and Mike StJohns for their careful review and
   constructive comments.  The document is much better because of their
   review.

Housley & Turner          Expires 13 March 2027                 [Page 4]
Internet-Draft             Update to RFC 6211             September 2026

Authors' Addresses

   Russ Housley
   Vigil Security, LLC
   Herndon, VA,
   United States of America
   Email: housley@vigilsec.com

   Sean Turner
   sn3rd llc
   Washington, DC,
   United States of America
   Email: sean@sn3rd.com

Housley & Turner          Expires 13 March 2027                 [Page 5]