Public-Key Infrastructure (X.509) (pkix)

Last Modified: 2007-03-22

Additional information is available at tools.ietf.org/wg/pkix

Chair(s):

  • Stephen Kent <kent@bbn.com>

  • Stefan Santesson <stefans@microsoft.com>

    Security Area Director(s):

  • William Polk <wpolk@nist.gov>
  • Sam Hartman <hartmans-ietf@mit.edu>

    Security Area Advisor:

  • TBD <noreply@ietf.org>

    Mailing Lists:

    General Discussion: ietf-pkix@imc.org
    To Subscribe: ietf-pkix-request@imc.org
    In Body: subscribe (In Body)
    Archive: http://www.imc.org/ietf-pkix

    Description of Working Group:

    The PKIX Working Group was established in the Fall of 1995 with the
    intent of developing Internet standards needed to support an
    X.509-based PKI. The scope of PKIX work has expanded beyond this
    initial goal. PKIX not only profiles ITU PKI standards, but also
    develops new standards apropos to the use of X.509-based PKIs in the
    Internet.

    PKIX has produced several informational and standards track documents
    in support of the original and revised scope of the WG. The first of
    these standards, RFC 2459, profiled X.509 version 3 certificates and
    version 2 CRLs for use in the Internet. Profiles for the use of
    Attribute Certificates (RFC XXXX [pending]), LDAP v2 for certificate
    and CRL storage (RFC 2587), the Internet X.509 Public Key
    Infrastructure Qualified Certificates Profile (RFC 3039), and the
    Internet X.509 Public Key Infrastructure Certificate Policy and
    certification Practices Framework (RFC 2527 - Informational) are in
    line with the initial scope.

    The Certificate Management Protocol (CMP) (RFC 2510), the Online
    Certificate Status Protocol (OCSP) (RFC 2560), Certificate Management
    Request Format (CRMF) (RFC 2511), Time-Stamp Protocol (RFC 3161),
    Certificate Management Messages over CMS (RFC 2797), Internet X.509
    Public Key Infrastructure Time Stamp Protocols (RFC 3161), and the use
    of FTP and HTTP for transport of PKI operations (RFC 2585) are
    representative of the expanded scope of PKIX, as these are new
    protocols developed in the working group, not profiles of ITU PKI
    standards.

    A roadmap, providing a guide to the growing set of PKIX document, also
    has been developed as an informational RFC.

    Ongoing PKIX Work items

    An ongoing PKIX task is the progression of existing, standards track
    RFCs from PROPOSED to DRAFT. Also, to the extent that PKIX work
    relates to protocols from other areas, e.g., LDAP, it is necessary to
    track the evolution of the other protocols and produce updated
    RFCs. For example, the LDAP v2 documents from PKIX are evolving to
    address LDAP v3. Finally, since the profiling of X.509 standards for
    use in the Internet remains a major focus, the WG will continue to
    track the evolution of these standards and incorporate changes and
    additions as appropriate.

    New Work items for PKIX

    - production of a requirements RFC for delegated path discovery and
      path validation protocols (DPD/DPV) and subsequent production of
      RFCs for protocols that satisfy the requirements

    - development of a logotype extension for certificates

    - development of a proxy certificate extension and associated
      processing rules

    - development of an informational document on PKI disaster recovery

    These work items may become standards track, INFORMATIONAL or
    EXPERIMENTAL RFCs, or may not even be published as RFCs.

    Other deliverables may be agreed upon as extensions are proposed.
    New deliverables must be approved by the Security Area Directors
    before inclusion on the charter or IETF meeting agendas.

    Goals and Milestones:

    Done  Complete approval of CMC, and qualified certificates documents
    Done  Complete time stamping document
    Done  Continue attribute certificate profile work
    Done  Complete data certification document
    Done  Complete work on attribute certificate profile
    Done  Standard RFCs for public key and attribute certificate profiles, CMP, OCSP, CMC, CRMF, TSP, Qualified Certificates, LDAP v2 schema, use of FTP/HTTP, Diffie-Hellman POP
    Done  INFORMATIONAL RFCs for X.509 PKI policies and practices, use of KEA
    Done  Experimental RFC for Data Validation and Certification Server Protocols
    Done  Production of revised certificate and CRL syntax and processing RFC (son-of-2459)
    Done  DPD/DVP Requirements RFC
    Done  Certificate Policy & CPS Informational RFC (revision)
    Done  Logotype Extension RFC
    Done  Proxy Certificate RFC
    Done  Cert Path Building approved as Informational RFC
    Done  CRMFbis approved as PROPOSED Standard RFC
    Done  CMPbis approved as PROPOSED Standard RFC
    Done  Principal Identifier approved as PROPOSED Standard RFC
    Done  Warranty Extensions approved as Informational RFC
    Done  Certificate Store approved as Informational RFC
    Done  PKIX Repository approved as Informational RFC
    Done  Subject Identification Method as Informational RFC
    Done  GOST Cryptographic Algorithms (RFC 4491)
    Done  Update to DirectoryString Processing for RFC 3280
    Done  Attribute Certificate Policies approved as PROPOSED Standard (RFC 4476)
    Jul 2007  Update to CMC approved as PROPOSED Standard
    Sep 2007  Progression of CRMF, CMP, and CMP Transport to DRAFT Standard
    Sep 2007  Progression of Qualified Certificates Profile RFC to DRAFT Standard
    Sep 2007  Progression of Certificate & CRL Profile RFC to DRAFT Standard
    Sep 2007  Progression of Time Stamp Protocols RFC to DRAFT Standard
    Sep 2007  Progression of Logotype RFC to DRAFT Standard
    Nov 2007  Progression of Proxy Certificate RFC to DRAFT Standard
    Nov 2007  Progression of Attribute Certificate Profile RFC to DRAFT standard
    Nov 2007  ECC Algorithms approved as PROPOSED Standard RFC
    Mar 2008  Progression of CMC RFCs to DRAFT Standard
    Mar 2008  SCVP approved as PROPOSED Standard RFC

    Internet-Drafts:

    Server-based Certificate Validation Protocol (SCVP) (199763 bytes)
    Certificate Management Messages over CMS (147503 bytes)
    Certificate Management over CMS (CMC) Transport Protocols (11586 bytes)
    CMC Complience Document (21102 bytes)
    Additional Algorithms and Identifiers for use of Elliptic Curve Cryptography with PKIX (36159 bytes)
    Lightweight OCSP Profile for High Volume Environments (47998 bytes)
    Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile (345688 bytes)
    Internet X.509 Public Key Infrastructure Subject Alternative Name for expression of service name (16570 bytes)

    Request For Comments:

    Internet X.509 Public Key Infrastructure Certificate and CRL Profile (RFC 2459) (278438 bytes) obsoleted by RFC 3280
    Internet X.509 Public Key Infrastructure Certificate Management Protocols (RFC 2510) (158178 bytes) obsoleted by RFC 4210
    Internet X.509 Certificate Request Message Format (RFC 2511) (48278 bytes) obsoleted by RFC 4211
    Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework (RFC 2527) (91860 bytes) obsoleted by RFC 3647
    Internet X.509 Public Key Infrastructure Representation of Key Exchange Algorithm (KEA) Keys in Internet X.509 Public Key Infrastructure Certificates (RFC 2528) (18273 bytes)
    Internet X.509 Public Key Infrastructure Operational Protocols - LDAPv2 (RFC 2559) (22894 bytes) obsoleted by RFC 3494/ updates RFC 1778
    Internet X.509 Public Key Infrastructure Operational Protocols: FTP and HTTP (RFC 2585) (14813 bytes)
    Internet X.509 Public Key Infrastructure LDAPv2 Schema (RFC 2587) (15102 bytes) obsoleted by RFC 4523
    X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP (RFC 2560) (43243 bytes)
    Certificate Management Messages over CMS (RFC 2797) (103357 bytes)
    Diffie-Hellman Proof-of-Possession Algorithms (RFC 2875) (45231 bytes)
    Internet X.509 Public Key Infrastructure Qualified Certificates Profile (RFC 3039) (67619 bytes) obsoleted by RFC 3739
    Internet X.509 Public Key Infrastructure Data Validation and Certification Server Protocols (RFC 3029) (107347 bytes)
    Internet X.509 Public Key Infrastructure Time Stamp Protocols (TSP) (RFC 3161) (54585 bytes)
    Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and CRI Profile (RFC 3279) (53833 bytes) updated by RFC 4491
    Internet X.509 Public Key Infrastructure Certificate and CRL Profile (RFC 3280) (295556 bytes) obsoletes RFC 2459/ updated by RFC 4325,RFC 4630
    An Internet Attribute Certificate Profile for Authorization (RFC 3281) (90580 bytes)
    Delegated Path Validation and Delegated Path Discovery Protocol Requirements (RFC 3379) (32455 bytes)
    Policy Requirements for Time-Stamping Authorities (RFC 3628) (92941 bytes)
    Internet X.509 Public Key Infrastructure Certificate Policy and Certification Practices Framework (RFC 3647) (228124 bytes) obsoletes RFC 2527
    Internet X.509 Public Key Infrastructure: Logotypes in X.509 certificates (RFC 3709) (46453 bytes)
    Internet X.509 Public Key Infrastructure: Qualified Certificates Profile (RFC 3739) (67436 bytes) obsoletes RFC 3039
    Certificate Extensions and Attributes Supporting Authentication in PPP and Wireless LAN (RFC 3770) (18635 bytes) obsoleted by RFC 4334
    X.509 Extensions for IP Addresses and AS Identifiers (RFC 3779) (60732 bytes)
    Internet X.509 Public Key Infrastructure Proxy Certificate Profile (RFC 3820) (86374 bytes)
    A 224-bit One-way Hash Function: SHA-224 (RFC 3874) (11600 bytes)
    Internet X.509 Public Key Infrastructure Warranty Certificate Extension (RFC 4059) (17904 bytes)
    Internet X.509 Public Key Infrastructure Permanent Identifier (RFC 4043) (30092 bytes)
    Additional Algorithms and Identifiers for RSA Cryptography for use in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile (RFC 4055) (57479 bytes)
    Internet X.509 Public Key Infrastructure: Certification Path Building (RFC 4158) (199297 bytes)
    Internet X.509 Public Key Infrastructure Certificate Management Protocols (RFC 4210) (212013 bytes) obsoletes RFC 2510
    Internet X.509 Public Key Infrastructure Certificate Request Message Format (CRMF) (RFC 4211) (86136 bytes) obsoletes RFC 2511
    Internet X.509 Public Key Infrastructure Authority Information Access Certificate Revocation List (CRL) Extension (RFC 4325) (14449 bytes) updates RFC 3280
    Certificate Extensions and Attributes Supporting Authentication in Point-to-Point Protocol (PPP) and Wireless Local Area Networks (WLAN) (RFC 4334) (20739 bytes) obsoletes RFC 3770
    Internet X.509 Public Key Infrastructure Repository Locator Service (RFC 4386) (11330 bytes)
    Internet X.509 Public Key Infrastructure Operational Protocols: Certificate Store Access via HTTP (RFC 4387) (63182 bytes)
    Attribute Certificate (AC) Policies Extension (RFC 4476) (20229 bytes)
    Using the GOST R 34.10-94, GOST R 34.10-2001 and GOST R 34.11-94 algorithms with the Internet X.509 Public Key Infrastructure Certificate and CRL Profile. (RFC 4491) (39095 bytes) updates RFC 3279
    Update to DirectoryString Processing in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile (RFC 4630) (12539 bytes) updates RFC 3280
    Internet X.509 Public Key Infrastructure Subject Identification Method (SIM) (RFC 4683) (41285 bytes)
    IETF Secretariat - Please send questions, comments, and/or suggestions to ietf-web@ietf.org.

    Return to working group directory.

    Return to IETF home page.