Certificate Management Messages over CMS (CMC): Compliance Requirements
RFC 5274
Document | Type |
RFC - Proposed Standard
(June 2008; No errata)
Updated by RFC 6402
|
|
---|---|---|---|
Authors | Michael Myers , Jim Schaad | ||
Last updated | 2015-10-14 | ||
Stream | IETF | ||
Formats | plain text html pdf htmlized bibtex | ||
Reviews | |||
Stream | WG state | (None) | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 5274 (Proposed Standard) | |
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | Tim Polk | ||
Send notices to | (None) |
Network Working Group J. Schaad Request for Comments: 5274 Soaring Hawk Consulting Category: Standards Track M. Myers TraceRoute Security, Inc. June 2008 Certificate Management Messages over CMS (CMC): Compliance Requirements Status of This Memo This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. Abstract This document provides a set of compliance statements about the CMC (Certificate Management over CMS) enrollment protocol. The ASN.1 structures and the transport mechanisms for the CMC enrollment protocol are covered in other documents. This document provides the information needed to make a compliant version of CMC. Table of Contents 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2 3. Requirements Terminology . . . . . . . . . . . . . . . . . . . 3 4. Requirements for All Entities . . . . . . . . . . . . . . . . 3 4.1. Cryptographic Algorithm Requirements . . . . . . . . . . . 4 4.2. Controls . . . . . . . . . . . . . . . . . . . . . . . . . 6 4.3. CRMF Feature Requirements . . . . . . . . . . . . . . . . 8 4.4. Requirements for Clients . . . . . . . . . . . . . . . . . 8 5. Requirements for Servers . . . . . . . . . . . . . . . . . . . 8 6. Requirements for EEs . . . . . . . . . . . . . . . . . . . . . 8 7. Requirements for RAs . . . . . . . . . . . . . . . . . . . . . 8 8. Requirements for CAs . . . . . . . . . . . . . . . . . . . . . 9 9. Security Considerations . . . . . . . . . . . . . . . . . . . 9 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 9 11. References . . . . . . . . . . . . . . . . . . . . . . . . . . 10 11.1. Normative References . . . . . . . . . . . . . . . . . . . 10 11.2. Informative References . . . . . . . . . . . . . . . . . . 11 Schaad & Myers Standards Track [Page 1] RFC 5274 CMC: Compliance June 2008 1. Overview The CMC (Certificate Management over CMS) protocol is designed in terms of a client/server relationship. In the simplest case, the client is the requestor of the certificate (i.e., the End Entity (EE)) and the server is the issuer of the certificate (i.e., the Certification Authority (CA)). The introduction of a Registration Authority (RA) into the set of agents complicates the picture only slightly. The RA becomes the server with respect to the certificate requestor, and it becomes the client with respect to the certificate issuer. Any number of RAs can be inserted into the picture in this manner. The RAs may serve specialized purposes that are not currently covered by this document. One such purpose would be a Key Escrow agent. As such, all certificate requests for encryption keys would be directed through this RA and it would take appropriate action to do the key archival. Key recovery requests could be defined in the CMC methodology allowing for the Key Escrow agent to perform that operation acting as the final server in the chain of agents. If there are multiple RAs in the system, it is considered normal that not all RAs will see all certificate requests. The routing between the RAs may be dependent on the content of the certificate requests involved. This document is divided into six sections, each section specifying the requirements that are specific to a class of agents in the CMC model. These are 1) All agents, 2) all servers, 3) all clients, 4) all End-Entities, 5) all Registration Entities, 6) all Certificate Authorities. 2. Terminology There are several different terms, abbreviations, and acronyms used in this document that we define here for convenience and consistency of usage: End-Entity (EE) refers to the entity that owns a key pair and for whom a certificate is issued. Registration Authority (RA) or Local RA (LRA) refers to an entity that acts as an intermediary between the EE and the CA. Multiple RAs can exist between the End-Entity and the Certification Authority. RAs may perform additional services such as key generation or key archival. This document uses the term RA for both RA and LRA. Schaad & Myers Standards Track [Page 2] RFC 5274 CMC: Compliance June 2008Show full document text