New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)

Abstract

The Public Key Infrastructure using X.509 (PKIX) certificate format, and many associated formats, are expressed using ASN

NSA's Cryptographic Message Syntax (CMS) Key Management Attributes

“…The syntax is taken from [X.509] but redefined using the ATTRIBUTE CLASS from [RFC5912]. The pki-path attribute has the following syntax:…”

S/MIME Capabilities for Public Key Definitions

“…When reading this document, it is assumed that you will have a degree of familiarity with the basic object module that is presented in Section 3 of RFC 5912 [RFC5912]. We use the SMIME-CAPS object in this document; it associates two fields together in a single object.…”

“…This object associates the existing object identifier (id-RSASSA-PSS) used for the public key certificates (defined in [RFC4055] and [RFC5912]) with type RSAKeyCapabilities.…”

“…--scap-pk-ec SMIME-CAPS ::= { TYPE EC-SMimeCaps IDENTIFIED BY pk-ec.&id } EC-SMimeCaps ::= SEQUENCE (SIZE (1..MAX)) OF ECParameters scap-pk-ecDH SMIME-CAPS ::= { TYPE EC-SMimeCaps IDENTIFIED BY pk-ecDH.&id } scap-pk-ecMQV SMIME-CAPS ::= { TYPE EC-SMimeCaps IDENTIFIED BY pk-ecMQV.&id } [RFC5912] should be done at some point to expand the definition of the PUBLIC-KEY class and allow for an SMIMECapability to be included in the class definition. This would encourage people to think about this as an issue when defining new public key structures in the future.…”

Trust Anchor Format

“…internet (1) security (5) mechanisms (5) pkix (7) id-mod(0) id-mod-pkix1-explicit-02(51)} CertificatePolicies, KeyIdentifier, NameConstraints FROM PKIX1Implicit-2009 --from [RFC5912] {iso(1) identified-organization(3) dod(6) internet(1) security (5) mechanisms (5) pkix (7) id-mod(0) id-mod-pkix1-implicit-02(59)} Extensions{} FROM PKIX-CommonTypes-2009 --from [RFC5912] { iso(1) identified-organization(3) dod(6) internet(1) security (5) mechanisms (5) …”