keyprov P. Hoyer Internet-Draft ActivIdentity Intended status: Informational M. Pei Expires: November 3, 2010 VeriSign S. Machani Diversinet A. Doherty RSA, The Security Division of EMC May 2, 2010 Additional Portable Symmetric Key Container (PSKC) Algorithm Profiles draft-hoyer-keyprov-pskc-algorithm-profiles-01.txt Abstract The Portable Symmetric Key Container (PSKC) contains a number of XML elements and XML attributes carrying keys and related information. Not all algorithms, however, are able to use all elements and for other algorithm certain information is mandatory. This lead to the introduction of PSKC algorithm profiles that provide further description about the mandatory and optional information elements and their semantic, including extensions that may be needed. The main PSKC specification defines two PSKC algorithm profiles, namely "HOTP" and "PIN". This document extends the initial set and specifies nine further algorithm profiles for PKSC. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on November 3, 2010. Copyright Notice Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved. Hoyer, et al. Expires November 3, 2010 [Page 1] Internet-Draft Additional PSKC Algorithm Profiles May 2010 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. OCRA (OATH Challenge Response Algorithm) . . . . . . . . . . . 5 4. TOTP (OATH Time based OTP) . . . . . . . . . . . . . . . . . . 7 5. SecurID-AES . . . . . . . . . . . . . . . . . . . . . . . . . 9 6. SecurID-AES-Counter . . . . . . . . . . . . . . . . . . . . . 11 7. SecurID-ALGOR . . . . . . . . . . . . . . . . . . . . . . . . 13 8. ActivIdentity-3DES . . . . . . . . . . . . . . . . . . . . . . 15 9. ActivIdentity-AES . . . . . . . . . . . . . . . . . . . . . . 18 10. ActivIdentity-DES . . . . . . . . . . . . . . . . . . . . . . 21 11. ActivIdentity-EVENT . . . . . . . . . . . . . . . . . . . . . 24 12. Security Considerations . . . . . . . . . . . . . . . . . . . 26 13. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 27 14. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 28 15. References . . . . . . . . . . . . . . . . . . . . . . . . . . 29 15.1. Normative References . . . . . . . . . . . . . . . . . . 29 15.2. Informative References . . . . . . . . . . . . . . . . . 29 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 30 Hoyer, et al. Expires November 3, 2010 [Page 2] Internet-Draft Additional PSKC Algorithm Profiles May 2010 1. Introduction This document specifies a set of algorithm profiles for PKSC, namely OCRA (OATH Challenge Response Algorithm) TOTP (OATH Time based OTP) SecurID-AES SecurID-AES-Counter SecurID-ALGOR ActivIdentity-3DES ActivIdentity-AES ActivIdentity-DES ActivIdentity-EVENT [Editor's Note: The content of this document was created by moving a number of PSKC algorithm profiles from draft-ietf-keyprov-portable-symmetric-key-container-06.txt into this document. Since draft-ietf-keyprov-portable-symmetric-key-container-07.txt had experienced a number of changes the description and the examples in this document are likely to be out-of-sync. Re-alignment will be provided in a future version.] Hoyer, et al. Expires November 3, 2010 [Page 3] Internet-Draft Additional PSKC Algorithm Profiles May 2010 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. Hoyer, et al. Expires November 3, 2010 [Page 4] Internet-Draft Additional PSKC Algorithm Profiles May 2010 3. OCRA (OATH Challenge Response Algorithm) Common Name: OCRA Class: OTP URI: urn:ietf:params:xml:ns:keyprov:pskc#OCRA-1:(ocra_suite_parameters) - e.g. urn:ietf:params:xml:ns:keyprov:pskc#OCRA-1:HOTP-SHA512-8:C-QN08 Algorithm Definition: http://tools.ietf.org/id/ draft-mraihi-mutual-oath-hotp-variants-11.txt Identifier Definition (this RFC) Registrant Contact: IESG Profile of XML attributes and subelements of the entity: For a of this algorithm, the subelements MUST be present. The "CR" attribute of the MUST be set "true" and it MUST be the only attribute set. The element and of the MUST be present. For the elements of a of this algorithm, the following subelements MUST be present in either the element itself or an commonly shared element. * Counter * Time If the element