Certificate Management Messages over CMS (CMC): Compliance Requirements
RFC 5274
| Document | Type |
RFC - Proposed Standard
(June 2008; No errata)
Updated by RFC 6402
|
|
|---|---|---|---|
| Last updated | 2015-10-14 | ||
| Stream | IETF | ||
| Formats | plain text pdf html bibtex | ||
| Stream | WG state | (None) | |
| Document shepherd | No shepherd assigned | ||
| IESG | IESG state | RFC 5274 (Proposed Standard) | |
| Consensus Boilerplate | Unknown | ||
| Telechat date | |||
| Responsible AD | Tim Polk | ||
| Send notices to | (None) | ||
Network Working Group J. Schaad
Request for Comments: 5274 Soaring Hawk Consulting
Category: Standards Track M. Myers
TraceRoute Security, Inc.
June 2008
Certificate Management Messages over CMS (CMC): Compliance Requirements
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Abstract
This document provides a set of compliance statements about the CMC
(Certificate Management over CMS) enrollment protocol. The ASN.1
structures and the transport mechanisms for the CMC enrollment
protocol are covered in other documents. This document provides the
information needed to make a compliant version of CMC.
Table of Contents
1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2
3. Requirements Terminology . . . . . . . . . . . . . . . . . . . 3
4. Requirements for All Entities . . . . . . . . . . . . . . . . 3
4.1. Cryptographic Algorithm Requirements . . . . . . . . . . . 4
4.2. Controls . . . . . . . . . . . . . . . . . . . . . . . . . 6
4.3. CRMF Feature Requirements . . . . . . . . . . . . . . . . 8
4.4. Requirements for Clients . . . . . . . . . . . . . . . . . 8
5. Requirements for Servers . . . . . . . . . . . . . . . . . . . 8
6. Requirements for EEs . . . . . . . . . . . . . . . . . . . . . 8
7. Requirements for RAs . . . . . . . . . . . . . . . . . . . . . 8
8. Requirements for CAs . . . . . . . . . . . . . . . . . . . . . 9
9. Security Considerations . . . . . . . . . . . . . . . . . . . 9
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 9
11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 10
11.1. Normative References . . . . . . . . . . . . . . . . . . . 10
11.2. Informative References . . . . . . . . . . . . . . . . . . 11
Schaad & Myers Standards Track [Page 1]
RFC 5274 CMC: Compliance June 2008
1. Overview
The CMC (Certificate Management over CMS) protocol is designed in
terms of a client/server relationship. In the simplest case, the
client is the requestor of the certificate (i.e., the End Entity
(EE)) and the server is the issuer of the certificate (i.e., the
Certification Authority (CA)). The introduction of a Registration
Authority (RA) into the set of agents complicates the picture only
slightly. The RA becomes the server with respect to the certificate
requestor, and it becomes the client with respect to the certificate
issuer. Any number of RAs can be inserted into the picture in this
manner.
The RAs may serve specialized purposes that are not currently covered
by this document. One such purpose would be a Key Escrow agent. As
such, all certificate requests for encryption keys would be directed
through this RA and it would take appropriate action to do the key
archival. Key recovery requests could be defined in the CMC
methodology allowing for the Key Escrow agent to perform that
operation acting as the final server in the chain of agents.
If there are multiple RAs in the system, it is considered normal that
not all RAs will see all certificate requests. The routing between
the RAs may be dependent on the content of the certificate requests
involved.
This document is divided into six sections, each section specifying
the requirements that are specific to a class of agents in the CMC
model. These are 1) All agents, 2) all servers, 3) all clients, 4)
all End-Entities, 5) all Registration Entities, 6) all Certificate
Authorities.
2. Terminology
There are several different terms, abbreviations, and acronyms used
in this document that we define here for convenience and consistency
of usage:
End-Entity (EE) refers to the entity that owns a key pair and for
whom a certificate is issued.
Registration Authority (RA) or Local RA (LRA) refers to an entity
that acts as an intermediary between the EE and the CA. Multiple
RAs can exist between the End-Entity and the Certification
Authority. RAs may perform additional services such as key
generation or key archival. This document uses the term RA for
Show full document text