PKIX Working Group R. Housley
Internet-Draft RSA Laboratories
December 2002 T. Moore
Expires: June 2003 Microsoft
Certificate Extensions and Attributes Supporting
Authentication in PPP and Wireless LAN
<draft-ietf-pkix-wlan-extns-04.txt>
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
Abstract
This document defines two EAP extended key usage values and a public
key certificate extension to carry Wireless LAN (WLAN) System Service
identifiers (SSIDs).
Housley & Moore [Page 1]
Internet-Draft December 2002
1. Introduction
Several Extensible Authentication Protocol (EAP) [EAP] authentication
methods employ X.509 public key certificates. For example, EAP-TLS
[EAP-TLS] can be used with PPP [PPP] as well as IEEE 802.1X [802.1X].
PPP is used for dial-up and VPN environments. IEEE 802.1X defines
port-based, network access control, and it is used to provide
authenticated network access for Ethernet, Token Ring, and Wireless
LANs (WLANs) [802.11].
Automated selection of certificates for PPP and IEEE 802.1X clients
is highly desirable. By using certificate extensions to identify the
intended environment for a particular certificate, the need for user
input is minimized. Further, the certificate extensions facilitate
the separation of administrative functions associated with
certificates used for different environments.
IEEE 802.1X can be used for authentication with multiple networks.
For example, the same wireless station might use IEEE 802.1X to
authenticate to a corporate IEEE 802.11 WLAN and a public IEEE 802.11
"hotspot." Each of these IEEE 802.11 WLANs has a different network
name, called Service Set Identifier (SSID). If the network operators
have a roaming agreement, then cross realm authentication allows the
same certificate to be used on both networks. However, if the
networks do not have a roaming agreement, then the IEEE 802.1X client
needs select a certificate for the current network environment.
Including a list of SSIDs in a certificate extension facilitates
automated selection of an appropriate X.509 public key certificate
without human user input. Alternatively, a companion attribute
certificate could contain the list of SSIDs.
1.1. Conventions Used In This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [STDWORDS].
1.2. Abstract Syntax Notation
All X.509 certificate [X.509] extensions are defined using ASN.1
[X.208, X.209].
2. EAP Extended Key Usage Values
RFC 3280 [PROFILE] specifies the extended key usage X.509 certificate
extension. The extension indicates one or more purposes for which
the certified public key may be used. The extended key usage
extension can be used in conjunction with key usage extension, which
Housley & Moore [Page 2]
Internet-Draft December 2002
indicates the intended purpose of the certified public key. For
example, the key usage extension might indicate that the certified
public key ought to be used only for validating digital signatures.
The extended key usage extension definition is repeated here for
convenience:
id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
KeyPurposeId ::= OBJECT IDENTIFIER
This specification defines two KeyPurposeId values: one for EAP over
PPP, and one for EAP over LAN (EAPOL). Inclusion of the EAP over PPP
value indicates that the certified public key is appropriate for use
with EAP in the PPP environment, and the inclusion of the EAPOL value
indicates that the certified public key is appropriate for use with
the EAP in the LAN environment. Inclusion of both values indicates
that the certified public key is appropriate for use in either of the
environments.
id-kp OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7) 3 }
id-kp-eapOverPPP OBJECT IDENTIFIER ::= { id-kp 13 }
id-kp-eapOverLAN OBJECT IDENTIFIER ::= { id-kp 14 }
The extended key usage extension may, at the option of the
certificate issuer, be either critical or non-critical. If the
extension is marked as critical, then the certified public key MUST
be used only for the purposes indicated. However, if the extension
is marked as non-critical, then extended key usage extension MAY be
used to support the location of an appropriate certified public key.
If a certificate contains both a critical key usage extension and a
critical extended key usage extension, then both extensions MUST be
processed independently, and the certificate MUST only be used for a
purpose consistent with both extensions. If there is no purpose
consistent with both critical extensions, then the certificate MUST
NOT be used for any purpose.
3. WLAN SSID Public Key Certificate Extension
The Wireless LAN (WLAN) System Service identifiers (SSIDs) public key
certificate extension is always non-critical. It contains a list of
SSIDs. When more than one certificate includes an extended key usage
Housley & Moore [Page 3]
Internet-Draft December 2002
extension indicating that the certified public key is appropriate for
use with the EAP in the LAN environment, the list of SSIDs MAY be
used to select the correct certificate for authentication in a
particular WLAN.
The WLAN SSID extension is identified by id-pe-wlanSSID.
id-pe OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7) 1 }
id-pe-wlanSSID OBJECT IDENTIFIER ::= { id-pe 13 }
The syntax for the WLAN SSID extension is:
SSIDList ::= SEQUENCE SIZE (1..MAX) OF SSID
SSID ::= OCTET STRING (SIZE (1..32))
4. WLAN SSID Attribute Certificate Attribute
When the public key certificate does not include the WLAN SSID
certificate extension, then an attribute certificate [ACPROFILE] can
be used to associate a list of SSIDs with the public key certificate.
The WLAN SSIDs attribute certificate attribute contains a list of
SSIDs, and the list of SSIDs MAY be used to select the correct
certificate for authentication in a particular WLAN environment.
The WLAN SSID attribute certificate attribute is identified by
id-aca-wlanSSID.
id-aca OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7) 10 }
id-aca-wlanSSID OBJECT IDENTIFIER ::= { id-aca 6 }
The syntax for the WLAN SSID attribute certificate attribute is
exactly the same as the WLAN SSID extension:
SSIDList ::= SEQUENCE SIZE (1..MAX) OF SSID
SSID ::= OCTET STRING (SIZE (1..32))
5. Security Considerations
The procedures and practices employed by the certification authority
(CA) MUST ensure that the correct values for the extended key usage
extension and SSID extension are inserted in each certificate that is
issued. Relying parties may accept or reject a particular
Housley & Moore [Page 4]
Internet-Draft December 2002
certificate for an intended use based on the information provided in
these extensions. Incorrect representation of the information in
either extension could cause the relying party to reject an otherwise
appropriate certificate or accept a certificate that ought to be
rejected.
6. IANA Considerations
Certificate extensions and extended key usage values are identified
by object identifiers (OIDs). Some of the OIDs used in this document
are copied from X.509 [X.509]. Other OIDs were assigned from an arc
delegated by the IANA. No further action by the IANA is necessary
for this document or any anticipated updates.
7. References
Normative and informative references are provided.
7.1. Normative References
[ACPROFILE] Farrell, S., and R. Housley, "An Internet Attribute
Certificate Profile for Authorization", RFC 3281,
April 2002.
[PROFILE] Housley, R., Polk, W., Ford, W. and D. Solo, "Internet
X.509 Public Key Infrastructure: Certificate and
Certificate Revocation List (CRL) Profile", RFC 3280,
April 2002.
[STDWORDS] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[X.208] CCITT. Recommendation X.208: Specification of Abstract
Syntax Notation One (ASN.1). 1988.
[X.209] CCITT. Recommendation X.209: Specification of Basic
Encoding Rules for Abstract Syntax Notation One (ASN.1).
1988.
[X.509] ITU-T. Recommendation X.509: The Directory -
Authentication Framework. 2000.
7.2. Informative References
[802.11] IEEE Std 802.11, "Wireless LAN Medium Access
Control (MAC) and Physical Layer (PHY) Specifications",
1999.
Housley & Moore [Page 5]
Internet-Draft December 2002
[802.1X] IEEE Std 802.1X, "Port-based Network Access Control",
2001.
[EAP] Blunk, L. and J. Vollbrecht, "PPP Extensible
Authentication Protocol (EAP)", RFC2284, March 1998.
[EAPTLS] Aboba, B. and D. Simon, "PPP EAP TLS Authentication
Protocol", RFC2716, October 1999.
[PPP] Simpson, W., Editor, "The Point-to-Point Protocol (PPP)",
STD 51, RFC 1661, July 1994.
8. ASN.1 Module
WLANCertExtn
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-wlan-extns(24) }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
-- OID Arcs
id-pe OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) 1 }
id-kp OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) 3 }
id-aca OBJECT IDENTIFIER ::=
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) 10 }
-- Extended Key Usage Values
id-kp-eapOverPPP OBJECT IDENTIFIER ::= { id-kp 13 }
id-kp-eapOverLAN OBJECT IDENTIFIER ::= { id-kp 14 }
-- Wireless LAN SSID Extension
id-pe-wlanSSID OBJECT IDENTIFIER ::= { id-pe 13 }
Housley & Moore [Page 6]
Internet-Draft December 2002
SSIDList ::= SEQUENCE SIZE (1..MAX) OF SSID
SSID ::= OCTET STRING (SIZE (1..32))
-- Wireless LAN SSID Attribute Certificate Attribute
-- Uses same syntax as the certificate extension: SSIDList
id-aca-wlanSSID OBJECT IDENTIFIER ::= { id-aca 6 }
END
9. Author's Address
Russell Housley
RSA Laboratories
918 Spring Knoll Drive
Herndon, VA 20170
USA
rhousley@rsasecurity.com
Tim Moore
Microsoft Corporation
One Microsoft Way
Redmond, WA 98052
USA
timmoore@microsoft.com
Housley & Moore [Page 7]
Internet-Draft December 2002
10. Full Copyright Statement
Copyright (C) The Internet Society 2002. All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Housley & Moore [Page 8]
