< draft-housley-spasm-eku-constraints-01.txt		draft-housley-spasm-eku-constraints-02.txt >
	INTERNET-DRAFT R. Housley		INTERNET-DRAFT R. Housley
	Intended Status: Standards Track Vigil Security		Intended Status: Standards Track Vigil Security
	Updates: RFC 5280 (if approved)		Updates: RFC 5280 (if approved)
	Expires: 18 November 2016 17 May 2016		Expires: 26 November 2016 25 May 2016
	Extended Key Usage Constraints		Extended Key Usage Constraints
	draft-housley-spasm-eku-constraints-01		draft-housley-spasm-eku-constraints-02
	Abstract		Abstract
	This document specifies the extended key usage constraints		This document specifies the extended key usage constraints
	certificate extension, which is used to place restrictions on the key		certificate extension, which is used to place restrictions on the key
	purpose identifiers that are authorized to appear in the end-entity		purpose identifiers that are authorized to appear in the end-entity
	certificate in a certification path. Restrictions apply to the		certificate in a certification path. Restrictions apply to the
	extended key usage certificate extension, which is described in		extended key usage certificate extension, which is described in
	RFC 5280.		RFC 5280.
	skipping to change at page 3, line 30 ¶		skipping to change at page 3, line 30 ¶
	The special key purpose identifier anyExtendedKeyUsage is not treated		The special key purpose identifier anyExtendedKeyUsage is not treated
	differently than any other key purpose identifier in processing the		differently than any other key purpose identifier in processing the
	constraints. If the anyExtendedKeyUsage key purpose identifier		constraints. If the anyExtendedKeyUsage key purpose identifier
	appears in the extended key usage extension of the end-entity		appears in the extended key usage extension of the end-entity
	certificate, then the anyExtendedKeyUsage key purpose identifier MUST		certificate, then the anyExtendedKeyUsage key purpose identifier MUST
	appear in the permitted key purpose identifiers set and the		appear in the permitted key purpose identifiers set and the
	anyExtendedKeyUsage key purpose identifier MUST NOT appear in the		anyExtendedKeyUsage key purpose identifier MUST NOT appear in the
	excluded key purpose identifiers set.		excluded key purpose identifiers set.
	Conforming CAs MUST mark this extension as critical, and conforming		This extension MAY, at the option of the certificate issuer, be
	CAs MUST NOT issue certificates where this extension is an empty		either critical or non-critical.
	sequence. That is, at least one of the permittedKeyPurposeIds field
	or the excludedKeyPurposeIds field MUST be present.
	Conforming applications MUST be able to process this extension. If		Conforming applications MUST be able to process this extension. If
	any CA certificate in the certification path includes an extended key		any CA certificate in the certification path includes an extended key
	usage constraints extension and the end-entity certificate includes		usage constraints extension and the end-entity certificate includes
	an extended key usage certificate extension, then the application		an extended key usage certificate extension, then the application
	MUST either process the extended key usage extension constraint or		MUST either process the extended key usage extension constraint or
	reject the certificate.		reject the certificate.
	ext-ExtKeyUsageConstraints EXTENSION ::= {		ext-ExtKeyUsageConstraints EXTENSION ::= {
	SYNTAX EKUConstraints		SYNTAX EKUConstraints
	IDENTIFIED BY id-ce-ekuConstraints }		IDENTIFIED BY id-ce-ekuConstraints }
	id-ce-ekuConstraints OBJECT IDENTIFIER ::= { id-pe TBD }		id-ce-ekuConstraints OBJECT IDENTIFIER ::= { id-pe TBD }
	EKUConstraints ::= SEQUENCE {		EKUConstraints ::= CHOICE {
	permittedKeyPurposeIds [0] KeyPurposeIds OPTIONAL,		permittedKeyPurposeIds [0] KeyPurposeIds OPTIONAL,
	excludedKeyPurposeIds [1] KeyPurposeIds OPTIONAL }		excludedKeyPurposeIds [1] KeyPurposeIds OPTIONAL }
	( WITH COMPONENTS { ..., permittedKeyPurposeIds PRESENT } |
	WITH COMPONENTS { ..., excludedKeyPurposeIds PRESENT } )
	KeyPurposeIds ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId		KeyPurposeIds ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
	3. Basic Path Validation		3. Basic Path Validation
	Certification path validation is described in Section 6.1 of RFC 5280		Certification path validation is described in Section 6.1 of RFC 5280
	[RFC5280]. Certification path processing verifies the binding		[RFC5280]. Certification path processing verifies the binding
	between the subject name and the subject public key. The binding is		between the subject name and the subject public key. The binding is
	limited by constraints that are specified in the certificates that		limited by constraints that are specified in the certificates that
	comprise the path and inputs that are specified by the relying party.		comprise the path and inputs that are specified by the relying party.
			Certification path processing requires the name and public key for a
			trust anchor.
	This section extends to path processing to include EKU constraints.		This section extends certification path processing to include EKU
			constraints.
			The resulting certification path validation processing is compatible
			with the trust anchor constrainsts processing described in RFC 5937
			[RFC5937].
	3.1. Inputs		3.1. Inputs
	No additional inputs are needed.		No additional inputs are needed.
	3.2. Initialization		3.2. Initialization
	Two additional values are initialized.		Two additional values are initialized.
	(l) permitted_key_purpose_ids: a set of key purpose identifiers;		(l) permitted_key_purpose_ids: a set of key purpose identifiers;
	all of the key purpose identifiers in the end-entity certificate		all of the key purpose identifiers in the end-entity certificate
	MUST be included in this set. If the set is empty, then the		MUST be included in this set. If the set is empty, then the
	certification path will be considered invalid if the end-entity		certification path will be considered invalid if the end-entity
	certificate includes an extended key usage extension. The		certificate includes an extended key usage extension. The
	initial value is a special value that represents the universal		initial value is the special value that represents the universal
	set.		set.
	(m) excluded_key_purpose_ids: a set of key purpose identifiers; the		(m) excluded_key_purpose_ids: a set of key purpose identifiers; the
	key purpose identifiers in the end-entity certificate MUST NOT		key purpose identifiers in the end-entity certificate MUST NOT
	be included in this set. If the set is empty, then no key		be included in this set. If the set is empty, then no key
	purpose identifiers are excluded. The initial value is the		purpose identifiers are excluded. The initial value is the
	empty set.		empty set.
	3.3. Basic Certificate Processing		3.3. Basic Certificate Processing
	skipping to change at page 5, line 25 ¶		skipping to change at page 5, line 25 ¶
	intersection of its previous value and the value indicated		intersection of its previous value and the value indicated
	in the extension field.		in the extension field.
	(2) If excludedKeyPurposeIds is present in the certificate, set		(2) If excludedKeyPurposeIds is present in the certificate, set
	the excluded_key_purpose_ids state variable to the union of		the excluded_key_purpose_ids state variable to the union of
	its previous value and the value indicated in the extension		its previous value and the value indicated in the extension
	field.		field.
	3.5. Wrap-Up Procedure		3.5. Wrap-Up Procedure
	One additional processing step is needed.		Two additional processing steps are needed.
	(h) If the EKU extension is included in the end-entity certificate,		(h) If the EKU extension is included in the end-entity certificate,
	then confirm that the values meet the restrictions in the		then confirm that the values meet the restrictions in the
	permitted_key_purpose_ids and excluded_key_purpose_ids state		permitted_key_purpose_ids and excluded_key_purpose_ids state
	variables as follows:		variables as follows:
	(1) If permitted_key_purpose_ids state variable is empty, then		(1) If permitted_key_purpose_ids state variable is empty, then
	return a failure indication and an appropriate reason.		return a failure indication and an appropriate reason.
	(2) If excluded_key_purpose_ids state variable is not empty,		(2) If excluded_key_purpose_ids state variable is not empty,
	skipping to change at page 5, line 48 ¶		skipping to change at page 6, line 5 ¶
	certificate. If any are present, then return a failure		certificate. If any are present, then return a failure
	indication and an appropriate reason.		indication and an appropriate reason.
	(3) If permitted_key_purpose_ids state variable is not the		(3) If permitted_key_purpose_ids state variable is not the
	special value that represents the universal set, then		special value that represents the universal set, then
	confirm that all of the key purpose identifiers in the end-		confirm that all of the key purpose identifiers in the end-
	entity certificate are present in the state variable. If		entity certificate are present in the state variable. If
	any are missing, then return a failure indication and an		any are missing, then return a failure indication and an
	appropriate reason.		appropriate reason.
			(i) If the EKU extension is not present in the end-entity
			certificate, then confirm that the permitted_key_purpose_ids
			state variable is the special value that represents the
			universal set and the excluded_key_purpose_ids state variable is
			the empty set. Otherwise, return a failure indication and an
			appropriate reason.
	3.6. Outputs		3.6. Outputs
	No additional output values are returned.		No additional output values are returned.
	4. IANA Considerations		4. IANA Considerations
	Please assign an object identifier for the certificate extension		Please assign an object identifier for the certificate extension
	specified in this document. Once the ASN.1 module is added, then an		specified in this document.
	object identifier for that will be needed too.
			Please assign an object identifier for the ASN.1 module in the
			Appendix.
	5. Security Considerations		5. Security Considerations
	When a CA includes the extended key usage constraints certificate		When a CA includes the extended key usage constraints certificate
			extension marked as non-critical, a relying party that does not
			understand this extension will ignore it. As a result, the relying
			party might accept some key purpose identifiers in the end-entity
			certificate that would have been unauthorized. If it would be
			preferable for the certification path to be rejected, then the CA
			SHOULD mark the extended key usage constraints certificate extension
			as critical.
			When a CA includes the extended key usage constraints certificate
	extension for a subordinate CA, the OCSPSigning key purpose		extension for a subordinate CA, the OCSPSigning key purpose
	identifier SHOULD be included in the permittedKeyPurposeIds field to		identifier SHOULD be included in the permittedKeyPurposeIds field to
	enable the issuance of delegated OCSP Responder certificates.		enable the issuance of delegated OCSP Responder certificates.
	6. Normative References		6. Normative References
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, DOI		Requirement Levels", BCP 14, RFC 2119, DOI
	10.17487/RFC2119, March 1997, <http://www.rfc-		10.17487/RFC2119, March 1997,
	editor.org/info/rfc2119>.		<http://www.rfc-editor.org/info/rfc2119>.
	[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,		[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
	Housley, R., and W. Polk, "Internet X.509 Public Key		Housley, R., and W. Polk, "Internet X.509 Public Key
	Infrastructure Certificate and Certificate Revocation List		Infrastructure Certificate and Certificate Revocation List
	(CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,		(CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
	<http://www.rfc-editor.org/info/rfc5280>.		<http://www.rfc-editor.org/info/rfc5280>.
	[X680] ITU-T, "Information technology -- Abstract Syntax Notation		[X680] ITU-T, "Information technology -- Abstract Syntax Notation
	One (ASN.1): Specification of basic notation", ITU-T		One (ASN.1): Specification of basic notation", ITU-T
	Recommendation X.680, 2002.		Recommendation X.680, 2002.
	[X690] ITU-T, "Information technology -- ASN.1 encoding rules:		[X690] ITU-T, "Information technology -- ASN.1 encoding rules:
	Specification of Basic Encoding Rules (BER), Canonical		Specification of Basic Encoding Rules (BER), Canonical
	Encoding Rules (CER) and Distinguished Encoding Rules		Encoding Rules (CER) and Distinguished Encoding Rules
	(DER)", ITU-T Recommendation X.690, 2002.		(DER)", ITU-T Recommendation X.690, 2002.
	7. Informative References		7. Informative References
	[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the		[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the
	Public Key Infrastructure Using X.509 (PKIX)", RFC 5912,		Public Key Infrastructure Using X.509 (PKIX)", RFC 5912,
	DOI 10.17487/RFC5912, June 2010, <http://www.rfc-		DOI 10.17487/RFC5912, June 2010,
	editor.org/info/rfc5912>.		<http://www.rfc-editor.org/info/rfc5912>.
			[RFC5937] Ashmore, S. and C. Wallace, "Using Trust Anchor
			Constraints during Certification Path Processing",
			RFC 5937, DOI 10.17487/RFC5937, August 2010,
			<http://www.rfc-editor.org/info/rfc5937>.
	Appendix: ASN.1 Module		Appendix: ASN.1 Module
	EKUConstraints2016 { iso(1) identified-organization(3) dod(6)		EKUConstraints2016 { iso(1) identified-organization(3) dod(6)
	internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)		internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
	id-mod-ekuConstraints2016(TBD) }		id-mod-ekuConstraints2016(TBD) }
	DEFINITIONS IMPLICIT TAGS ::= BEGIN		DEFINITIONS IMPLICIT TAGS ::= BEGIN
	-- EXPORTS ALL --		-- EXPORTS ALL --
	skipping to change at page 7, line 43 ¶		skipping to change at page 8, line 43 ¶
	MoreCertExtensions EXTENSION ::= {		MoreCertExtensions EXTENSION ::= {
	ext-ExtKeyUsageConstraints, ... }		ext-ExtKeyUsageConstraints, ... }
	ext-ExtKeyUsageConstraints EXTENSION ::= {		ext-ExtKeyUsageConstraints EXTENSION ::= {
	SYNTAX EKUConstraints		SYNTAX EKUConstraints
	IDENTIFIED BY id-ce-ekuConstraints }		IDENTIFIED BY id-ce-ekuConstraints }
	id-ce-ekuConstraints OBJECT IDENTIFIER ::= { id-pe TBD }		id-ce-ekuConstraints OBJECT IDENTIFIER ::= { id-pe TBD }
	EKUConstraints ::= SEQUENCE {		EKUConstraints ::= CHOICE {
	permittedKeyPurposeIds [0] KeyPurposeIds OPTIONAL,		permittedKeyPurposeIds [0] KeyPurposeIds OPTIONAL,
	excludedKeyPurposeIds [1] KeyPurposeIds OPTIONAL }		excludedKeyPurposeIds [1] KeyPurposeIds OPTIONAL }
	( WITH COMPONENTS { ..., permittedKeyPurposeIds PRESENT } |
	WITH COMPONENTS { ..., excludedKeyPurposeIds PRESENT } )
	KeyPurposeIds ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId		KeyPurposeIds ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
	END		END
	Acknowledgements		Acknowledgements
	Many thanks to review and insightful comments from Santosh Chokhani,		Many thanks to review and insightful comments from Santosh Chokhani,
	Stephen Farrell, Tom Gindin, Sean Leonard, Michael Richardson, Jim		Stephen Farrell, Tom Gindin, Sean Leonard, Michael Richardson, Stefan
	Schaad, and Mike St.Johns.		Santesson, Jim Schaad, and Mike St.Johns.
	Author's Address		Author's Address
	Russell Housley		Russell Housley
	Vigil Security, LLC		Vigil Security, LLC
	918 Spring Knoll Drive		918 Spring Knoll Drive
	Herndon, VA 20170		Herndon, VA 20170
	USA		USA
	EMail: housley@vigilsec.com		EMail: housley@vigilsec.com
End of changes. 17 change blocks.
	23 lines changed or deleted		47 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/