Additional Cryptographic Message Syntax (CMS) Revocation Information Choices
RFC 5940

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 06

Internet Engineering Task Force (IETF)                         S. Turner
Request for Comments: 5940                                          IECA
Category: Standards Track                                     R. Housley
ISSN: 2070-1721                                           Vigil Security
                                                             August 2010

             Additional Cryptographic Message Syntax (CMS)
                     Revocation Information Choices

Abstract

   The Cryptographic Message Syntax (CMS) allows revocation information
   to be conveyed as part of the SignedData, EnvelopedData,
   AuthenticatedData, and AuthEnvelopedData content types.  The
   preferred format for revocation information is the Certificate
   Revocation List (CRL), but an extension mechanism supports other
   revocation information formats.  This document defines two additional
   revocation information formats for Online Certificate Status Protocol
   (OCSP) responses and Server-Based Certificate Validation Protocol
   (SCVP) requests and responses.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc5940.

Turner & Housley             Standards Track                    [Page 1]
RFC 5940      Additional CMS Revocation Information Choices  August 2010

Copyright Notice

   Copyright (c) 2010 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

1.  Introduction

   The RevocationInfoChoices type defined in [CMS] provides a set of
   revocation status information alternatives, which allows revocation
   information to be conveyed as part of the SignedData, EnvelopedData,
   AuthenticatedData, and AuthEnvelopedData content types.  The intent
   is to provide information sufficient to determine whether the
   certificates and attribute certificates carried elsewhere in the CMS-
   protected content have been revoked.  There may be more revocation
   status information than necessary or there may be less revocation
   status information than necessary.

   X.509 Certificate Revocation Lists (CRLs) [PROFILE] are the primary
   source of revocation status information, but any other revocation
   information format can be supported.  This document specifies two
   other formats: Online Certificate Status Protocol (OCSP) responses
   [OCSP] and Server-Based Certificate Validation Protocol (SCVP)
   requests and responses [SCVP].

   Section 2 discusses the RevocationInformation structure.  Section 3
   defines a mechanism to carry OCSP responses.  Section 4 defines a
   mechanism to carry SCVP requests and responses.  Appendix A provides
   the normative ASN.1 syntax for the two mechanisms.

1.1.  Requirements Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [WORDS].

Turner & Housley             Standards Track                    [Page 2]
RFC 5940      Additional CMS Revocation Information Choices  August 2010

2.  Revocation Information

   For convenience, the ASN.1 definition of the RevocationInfoChoices
   type from [CMS] is repeated here:

   RevocationInfoChoices ::= SET OF RevocationInfoChoice

   RevocationInfoChoice ::= CHOICE {
     crl        CertificateList,
     other  [1] IMPLICIT OtherRevocationInfoFormat }

   OtherRevocationInfoFormat ::= SEQUENCE {
     otherRevInfoFormat  OBJECT IDENTIFIER,
     otherRevInfo        ANY DEFINED BY otherRevInfoFormat }

   The other CHOICE MUST be used to convey OCSP responses, SCVP
   requests, and SCVP responses.

   This document defines the id-ri arc under which the revocation
   information formats are defined.  The id-ri object identifier is:

   id-ri OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
     dod(6) internet(1) security(5) mechanisms(5) pkix(7) ri(16) }