idnits 2.17.1 draft-ietf-lamps-samples-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- == There are 5 instances of lines with non-RFC2606-compliant FQDNs in the document. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (8 May 2021) is 1074 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- No issues found here. Summary: 0 errors (**), 0 flaws (~~), 2 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 lamps D.K. Gillmor, Ed. 3 Internet-Draft ACLU 4 Intended status: Informational 8 May 2021 5 Expires: 9 November 2021 7 S/MIME Example Keys and Certificates 8 draft-ietf-lamps-samples-01 10 Abstract 12 The S/MIME development community benefits from sharing samples of 13 signed or encrypted data. This document facilitates such 14 collaboration by defining a small set of X.509v3 certificates and 15 keys for use when generating such samples. 17 Status of This Memo 19 This Internet-Draft is submitted in full conformance with the 20 provisions of BCP 78 and BCP 79. 22 Internet-Drafts are working documents of the Internet Engineering 23 Task Force (IETF). Note that other groups may also distribute 24 working documents as Internet-Drafts. The list of current Internet- 25 Drafts is at https://datatracker.ietf.org/drafts/current/. 27 Internet-Drafts are draft documents valid for a maximum of six months 28 and may be updated, replaced, or obsoleted by other documents at any 29 time. It is inappropriate to use Internet-Drafts as reference 30 material or to cite them other than as "work in progress." 32 This Internet-Draft will expire on 9 November 2021. 34 Copyright Notice 36 Copyright (c) 2021 IETF Trust and the persons identified as the 37 document authors. All rights reserved. 39 This document is subject to BCP 78 and the IETF Trust's Legal 40 Provisions Relating to IETF Documents (https://trustee.ietf.org/ 41 license-info) in effect on the date of publication of this document. 42 Please review these documents carefully, as they describe your rights 43 and restrictions with respect to this document. Code Components 44 extracted from this document must include Simplified BSD License text 45 as described in Section 4.e of the Trust Legal Provisions and are 46 provided without warranty as described in the Simplified BSD License. 48 Table of Contents 50 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 51 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 4 52 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 4 53 1.3. Prior Work . . . . . . . . . . . . . . . . . . . . . . . 4 54 2. Background . . . . . . . . . . . . . . . . . . . . . . . . . 4 55 2.1. Certificate Usage . . . . . . . . . . . . . . . . . . . . 4 56 2.2. Certificate Expiration . . . . . . . . . . . . . . . . . 5 57 2.3. Certificate Revocation . . . . . . . . . . . . . . . . . 5 58 2.4. Using the CA in Test Suites . . . . . . . . . . . . . . . 5 59 2.5. Certificate Chains . . . . . . . . . . . . . . . . . . . 5 60 2.6. Passwords . . . . . . . . . . . . . . . . . . . . . . . . 6 61 2.7. Secret key origins . . . . . . . . . . . . . . . . . . . 6 62 3. Example Certificate Authority . . . . . . . . . . . . . . . . 6 63 3.1. Certificate Authority Certificate . . . . . . . . . . . . 6 64 3.2. Certificate Authority Secret Key . . . . . . . . . . . . 7 65 4. Alice's Sample Certificates . . . . . . . . . . . . . . . . . 8 66 4.1. Alice's Signature Verification End-Entity Certificate . . 8 67 4.2. Alice's Signing Private Key Material . . . . . . . . . . 9 68 4.3. Alice's Encryption End-Entity Certificate . . . . . . . . 10 69 4.4. Alice's Decryption Private Key Material . . . . . . . . . 11 70 4.5. PKCS12 Object for Alice . . . . . . . . . . . . . . . . . 12 71 5. Bob's Sample . . . . . . . . . . . . . . . . . . . . . . . . 15 72 5.1. Bob's Signature Verification End-Entity Certificate . . . 15 73 5.2. Bob's Signing Private Key Material . . . . . . . . . . . 16 74 5.3. Bob's Encryption End-Entity Certificate . . . . . . . . . 17 75 5.4. Bob's Decryption Private Key Material . . . . . . . . . . 18 76 5.5. PKCS12 Object for Bob . . . . . . . . . . . . . . . . . . 19 77 6. Example Ed25519 Certificate Authority . . . . . . . . . . . . 22 78 6.1. Certificate Authority Certificate . . . . . . . . . . . . 22 79 6.2. Ed25519 Certificate Authority Secret Key . . . . . . . . 23 80 7. Carlos's Sample Certificates . . . . . . . . . . . . . . . . 23 81 7.1. Carlos's Signature Verification End-Entity Certificate . 23 82 7.2. Carlos's Signing Private Key Material . . . . . . . . . . 24 83 7.3. Carlos's Encryption End-Entity Certificate . . . . . . . 24 84 7.4. Carlos's Decryption Private Key Material . . . . . . . . 24 85 7.5. PKCS12 Object for Carlos . . . . . . . . . . . . . . . . 24 86 8. Dana's Sample Certificates . . . . . . . . . . . . . . . . . 26 87 8.1. Dana's Signature Verification End-Entity Certificate . . 26 88 8.2. Dana's Signing Private Key Material . . . . . . . . . . . 26 89 8.3. Dana's Encryption End-Entity Certificate . . . . . . . . 26 90 8.4. Dana's Decryption Private Key Material . . . . . . . . . 27 91 8.5. PKCS12 Object for Dana . . . . . . . . . . . . . . . . . 27 92 9. Security Considerations . . . . . . . . . . . . . . . . . . . 28 93 10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 28 94 11. Document Considerations . . . . . . . . . . . . . . . . . . . 29 95 11.1. Outstanding Changes . . . . . . . . . . . . . . . . . . 29 96 11.2. Document History . . . . . . . . . . . . . . . . . . . . 29 97 11.2.1. Substantive Changes from draft-ietf-*-00 to 98 draft-ietf-*-01 . . . . . . . . . . . . . . . . . . . 29 99 11.2.2. Substantive Changes from draft-dkg-*-05 to 100 draft-ietf-*-00 . . . . . . . . . . . . . . . . . . . 29 101 11.2.3. Substantive Changes from draft-dkg-*-04 to 102 draft-dkg-*-05 . . . . . . . . . . . . . . . . . . . 29 103 11.2.4. Substantive Changes from draft-dkg-*-03 to 104 draft-dkg-*-04 . . . . . . . . . . . . . . . . . . . 29 105 11.2.5. Substantive Changes from draft-dkg-*-02 to 106 draft-dkg-*-03 . . . . . . . . . . . . . . . . . . . 29 107 11.2.6. Substantive Changes from draft-dkg-*-01 to 108 draft-dkg-*-02 . . . . . . . . . . . . . . . . . . . 29 109 11.2.7. Substantive Changes from draft-dkg-*-00 to 110 draft-dkg-*-01 . . . . . . . . . . . . . . . . . . . 29 111 12. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 30 112 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 30 113 13.1. Normative References . . . . . . . . . . . . . . . . . . 30 114 13.2. Informative References . . . . . . . . . . . . . . . . . 31 115 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 32 117 1. Introduction 119 The S/MIME ([RFC8551]) development community, in particular the 120 e-mail development community, benefits from sharing samples of signed 121 and/or encrypted data. Often the exact key material used does not 122 matter because the properties being tested pertain to implementation 123 correctness, completeness or interoperability of the overall system. 124 However, without access to the relevant secret key material, a sample 125 is useless. 127 This document defines a small set of X.509v3 certificates ([RFC5280]) 128 and secret keys for use when generating or operating on such samples. 130 An example RSA certificate authority is supplied, and sample RSA 131 certificates are provided for two "personas", Alice and Bob. 133 Additionally, an Ed25519 ([RFC8032]) certificate authority is 134 supplied, along with sample Ed25519 certificates for two more 135 "personas", Carlos and Dana. 137 This document focuses narrowly on functional, well-formed identity 138 and key material. It is a starting point that other documents can 139 use to develop sample signed or encrypted messages, test vectors, or 140 other artifacts for improved interoperability. 142 1.1. Requirements Language 144 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 145 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 146 "OPTIONAL" in this document are to be interpreted as described in BCP 147 14 [RFC2119] [RFC8174] when, and only when, they appear in all 148 capitals, as shown here. 150 1.2. Terminology 152 * "Certificate Authority" (or "CA") is a party capable of issuing 153 X.509 certificates 155 * "End-Entity" is a party that is capable of using X.509 156 certificates (and their corresponding secret key material) 158 * "Mail User Agent" (or "MUA") is a program that generates or 159 handles [RFC5322] e-mail messages. 161 1.3. Prior Work 163 [RFC4134] contains some sample certificates, as well as messages of 164 various S/MIME formats. That older work has unacceptably old 165 algorithm choices that may introduce failures when testing modern 166 systems: in 2019, some tools explicitly mark 1024-bit RSA and 167 1024-bit DSS as weak. 169 This earlier document also does not use the now widely-accepted PEM 170 encoding for the objects, and instead embeds runnable perl code to 171 extract them from the document. 173 It also includes examples of messages and other structures which are 174 greater in ambition than this document intends to be. 176 [RFC8410] includes an example X25519 certificate that is certified 177 with Ed25519, but it appears to be self-issued, and it is not 178 directly useful in testing an S/MIME-capable MUA. 180 2. Background 182 2.1. Certificate Usage 184 These X.509 certificates ([RFC5280]) are designed for use with S/MIME 185 protections ([RFC8551]) for e-mail ([RFC5322]). 187 In particular, they should be usable with signed and encrypted 188 messages. 190 2.2. Certificate Expiration 192 The certificates included in this draft expire in 2052. This should 193 be sufficiently far in the future that they will be useful for a few 194 decades. However, when testing tools in the far future (or when 195 playing with clock skew scenarios), care should be taken to consider 196 the certificate validity window. 198 Due to this lengthy expiration window, these certificates will not be 199 particularly useful to test or evaluate the interaction between 200 certificate expiration and protected messages. 202 2.3. Certificate Revocation 204 Because these are expected to be used in test suites or examples, and 205 we do not expect there to be online network services in these use 206 cases, we do not expect these certificates to produce any revocation 207 artifacts. 209 As a result, there are no OCSP or CRL indicators in any of the 210 certificates. 212 2.4. Using the CA in Test Suites 214 To use these end-entity certificates in a piece of software (for 215 example, in a test suite or an interoperability matrix), most tools 216 will need to accept the example CA (Section 3) as a legitimate root 217 authority. 219 Note that some tooling behaves differently for certificates validated 220 by "locally-installed root CAs" than for pre-installed "system-level" 221 root CAs). For example, many common implementations of HPKP 222 ([RFC7469]) only applied the designed protections when dealing with a 223 certificate issued by a pre-installed "system-level" root CA, and 224 were disabled when dealing with a certificate issued by a "locally- 225 installed root CA". 227 To test some tooling specifically, it may be necessary to install the 228 root CA as a "system-level" root CA. 230 2.5. Certificate Chains 232 In most real-world examples, X.509 certificates are deployed with a 233 chain of more than one X.509 certificate. In particular, there is 234 typically a long-lived root CA that users' software knows about upon 235 installation, and the end-entity certificate is issued by an 236 intermediate CA, which is in turn issued by the root CA. 238 The examples presented in this document use a simple two-link 239 certificate chain, and therefore may be unsuitable for simulating 240 some real-world deployments. 242 In particular, testing the use of a "transvalid" certificate (an end- 243 entity certificate that is supplied without its intermediate 244 certificate) is not possible with the configuration here. 246 2.6. Passwords 248 Each secret key presented in this draft is unprotected (it has no 249 password). 251 As such, the secret key objects are not suitable for verifying 252 interoperable password protection schemes. 254 However, the PKCS#12 [RFC7292] objects do have simple textual 255 passwords, because tooling for dealing with passwordless PKCS#12 256 objects is underdeveloped at the time of this draft. 258 2.7. Secret key origins 260 The secret RSA keys in this document are all deterministically 261 derived using provable prime generation as found in [FIPS186-4], 262 based on known seeds derived via [SHA256] from simple strings. The 263 secret Ed25519 and X25519 keys in this document are all derived by 264 hashing a simple string. The seeds and their derivation are included 265 in the document for informational purposes, and to allow re-creation 266 of the objects from appropriate tooling. 268 All RSA seeds used are 224 bits long (the first 224 bits of the 269 SHA-256 digest of the origin string), and are represented in 270 hexadecimal. 272 3. Example Certificate Authority 274 The example Certificate Authority has the following information: 276 * Name: "Sample LAMPS Certificate Authority" 278 3.1. Certificate Authority Certificate 280 This cerificate is used to verify certificates issued by the example 281 Certificate Authority. 283 -----BEGIN CERTIFICATE----- 284 MIIDLDCCAhSgAwIBAgITD5FARp09T2LXr/FPQiI+8ZsGAjANBgkqhkiG9w0BAQ0F 285 ADAtMSswKQYDVQQDEyJTYW1wbGUgTEFNUFMgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 286 MCAXDTE5MTEyMDA2NTQxOFoYDzIwNTIwOTI3MDY1NDE4WjAtMSswKQYDVQQDEyJT 287 YW1wbGUgTEFNUFMgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0B 288 AQEFAAOCAQ8AMIIBCgKCAQEAnFB71AsptFyqxG4qPtbt2VLJVctHyNXtlIUWve4q 289 PSo/+Oi9s3sf+t7krrosxlv626L+Wm05t99ZVKWKn7y2uYyO7/IToRpTwHN1sXga 290 Uz/u2gjPfS69R20ZNSKL9EiB78hgCr1UvY5elQoW2Y4zqQGR729pQYI5obT15V8n 291 wdyHCTvecvvvMGBiaAk66VlMQCZLG+nVU8wYVCl6fE37Z1qAs12XlUJr3DGgVKGf 292 ZpMz55xiV8q11Aobhmx4aPPyE4GWshDDt4DbtYJMGLEeik1AmNHBsmyaQCLBxVE3 293 3ZW1UrhK5Pb9qSL4gizDZ7ZaGZNudwjJu20HHVIGQT7nDwIDAQABo0MwQTAPBgNV 294 HRMBAf8EBTADAQH/MA8GA1UdDwEB/wQFAwMHBgAwHQYDVR0OBBYEFHhfDlp42Gvk 295 VHA9s93s9/Hy+sBHMA0GCSqGSIb3DQEBDQUAA4IBAQAMqotfBm1fUs18JqiTgZhW 296 LUo/Oo+l/rVEIMUPN8+uZgxfOwA0u9cE0IAgMdVELfyHuEt5ld+xyS300z1/Z3X0 297 w1NpEaLmgBNB70kmjNZkvT/aWDlKE3JVUITYkkLOm10U5J1dF3DjGH+kK+/nbeF2 298 mHTquWfm7420fJJNvCWgvylBHCFheFHt450G/2t5b8+0a4Qj6/QPsqGwiD6NjLrA 299 gD0oKIyQP6HNQ8fGpYekiLcq8NQ3sFBYsNUmfAy/Zfjo9/5o5qc+2UwRPTv+QUZx 300 0bBs2gH3LVOuvgkHXm5EFyfjCInWTOg0PBlsjvHjrROQHSsuL/Bd3uuqG02bJbbj 301 -----END CERTIFICATE----- 303 3.2. Certificate Authority Secret Key 305 This secret key material is used by the example Certificate Authority 306 to issue new certificates. 308 -----BEGIN PRIVATE KEY----- 309 MIIE/AIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCcUHvUCym0XKrE 310 bio+1u3ZUslVy0fI1e2UhRa97io9Kj/46L2zex/63uSuuizGW/rbov5abTm331lU 311 pYqfvLa5jI7v8hOhGlPAc3WxeBpTP+7aCM99Lr1HbRk1Iov0SIHvyGAKvVS9jl6V 312 ChbZjjOpAZHvb2lBgjmhtPXlXyfB3IcJO95y++8wYGJoCTrpWUxAJksb6dVTzBhU 313 KXp8TftnWoCzXZeVQmvcMaBUoZ9mkzPnnGJXyrXUChuGbHho8/ITgZayEMO3gNu1 314 gkwYsR6KTUCY0cGybJpAIsHFUTfdlbVSuErk9v2pIviCLMNntloZk253CMm7bQcd 315 UgZBPucPAgMBAAECggEAJ56StD0cFfYC5oTRulm5sYK1O0Sp7jKi5CkTiZJrLFOg 316 IVPEeVB0255RMiRIIwK/Q5o9g+f5YCyBNN48k54+ZitFM3YVGZlVrwrUwuWhLoae 317 4K6pAJ6vJQJ3CCu4c3NJU+Biz3YLm3wRZw9GmV/cojKeraR8djkuqFj4lmmW5yC7 318 mj8XLnl1snOAEZEHhi/10zibru5GoCjwFrmJT8qbmYX89gbua24wcVlmqImzV48z 319 lQJ0nJDJ8VPNjwvyX27DjefBw2FgUiT8J/iEmS7BZ+1laF/UyEsxqsZ4odJIVfPT 320 /JbGl+VkAoM1R2Qrv6ZFisDVfGZkIpWtSaBlknh+CQKBgQC82Y7gYnG3wiotvTKC 321 L5BWMWoknCM4LTM5AqYSZjfpnMsOEfOgzpyABUyK+3zKrzoqxokVfuvHlj2Hzw8Y 322 EUQ2gqJdU5iObl3dH0C7K5J/9Kua12VEcv5NFiBs5paMXTub6SdG0CyeUUfDW133 323 UfdW0rgCuPvPpya7lQa4k2T8XQKBgQDT5VHzRJMXRKTaI6nHw5RI2F88b89nvkib 324 BRvnDm2N7bxVfLiKSf2hQUhdLppIm0J8it/ksjJ/zQ197UA6DfilAjQB+mKi/fB8 325 h7pmElFElhy71/93T/uv2CA1RaIGSWhTMu+7Z9+/5cb1zRsorgrB2s0tTpDkDnuX 326 A1wRbBraWwKBgQCyNUsSi1NsaJmM2AEVwPSfobncGktR87Vmkw1MR5FzrjYfbOlO 327 Uip01ItKi89TJM/rFba+xiqRCUG/KrG/sGuCVPwKvZw0rAl/ZMKc3Z09ihF16NTz 328 JuC6taqbmW1vv3tEwVwDAudX7rOdslaV0I9rKyXhy9Y0OjPex96zxsOBMQKBgQCt 329 Wj7hNojf0FjN3b9YnrkBn4LKfu6/gP0FVfit3y/hnU0m4xJWkJHfCvmYwjeWju6l 330 1Te2cdK+m5MeIqsY07VHybWiqKVpkzbbqm7kcrfp1KVNSDjH87eE9NvkuUMEwamH 331 53QZbbGv3NwY2+QMM9a5IbgaCNygtviFY0o/NqIBYQKBgQCyki2Y/sKDolNBbjwf 332 nFMsdYb+nRmbJMSvLHbJSVhypB6aX3qjHhBlPrTW6WT5KIjumCtSadsDceUtr9tT 333 2ofP0ZOXP9IDIF2v1X3165LPsieGZv4VzhLivJrfMYfI4p4GkiK44RSUWcxrBAmq 334 9SGCNQ8nx1AsXLZn57U52Oji8KA7MDkGCisGAQQBkggSCAExKzApBglghkgBZQME 335 AgIEHPBUYbjdNRelyUPep86pkRfIdEPM9N+yPctTfB0= 336 -----END PRIVATE KEY----- 338 This secret key was generated using provable prime generation found 339 in [FIPS186-4] using the seed 340 "f05461b8dd3517a5c943dea7cea99117c87443ccf4dfb23dcb537c1d". This 341 seed is the first 224 bits of the [SHA256] digest of the string 342 "draft-lamps-sample-certs-keygen.ca.seed". 344 4. Alice's Sample Certificates 346 Alice has the following information: 348 * Name: "Alice Lovelace" 350 * E-mail Address: "alice@smime.example" 352 4.1. Alice's Signature Verification End-Entity Certificate 354 This certificate is used for verification of signatures made by 355 Alice. 357 -----BEGIN CERTIFICATE----- 358 MIIDbTCCAlWgAwIBAgIToTV4Z0iuK08vZP20oTh//hC8BDANBgkqhkiG9w0BAQ0F 359 ADAtMSswKQYDVQQDEyJTYW1wbGUgTEFNUFMgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 360 MCAXDTE5MTEyMDA2NTQxOFoYDzIwNTIwOTI3MDY1NDE4WjAZMRcwFQYDVQQDEw5B 361 bGljZSBMb3ZlbGFjZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALT0 362 iehYOBY+TZp/T5K2KNI05Hwr+E3wP6XTvyi6WWyTgBK9LCOwI2juwdRrjFBSXkk7 363 pWpjXwsA3A5GOtz0FpfgyC7OxsVcF7q4WHWZWleYXFKlQHJD73nQwXP968+A/3rB 364 X7PhO0DBbZnfitOLPgPEwjTtdg0VQQ6Wz+CRQ/YbHPKaw7aRphZO63dKvIKp4cQV 365 tkWQHi6syTjGsgkLcLNau5LZDQUdsGV+SAo3nBdWCRYV+I65x8Kf4hCxqqmjV3d/ 366 2NKRu0BXnDe/N+iDz3X0zEoj0fqXgq4SWcC0nsG1lyyXt1TL270I6ATKRGJWiQVC 367 CpDtc0NT6vdJ45bCSzsCAwEAAaOBlzCBlDAMBgNVHRMBAf8EAjAAMB4GA1UdEQQX 368 MBWBE2FsaWNlQHNtaW1lLmV4YW1wbGUwEwYDVR0lBAwwCgYIKwYBBQUHAwQwDwYD 369 VR0PAQH/BAUDAwfAADAdBgNVHQ4EFgQUu/bMsi0dBhIcl64papAQ0yBmZnMwHwYD 370 VR0jBBgwFoAUeF8OWnjYa+RUcD2z3ez38fL6wEcwDQYJKoZIhvcNAQENBQADggEB 371 ABbWeonR6TMTckehDKNOabwaCIcekahAIL6l9tTzUX5ew6ufiAPlC6I/zQlmUaU0 372 iSyFDG1NW14kNbFt5CAokyLhMtE4ASHBIHbiOp/ZSbUBTVYJZB61ot7w1/ol5QEC 373 Ss08b8zrxIncf+t2DHGuVEy/Qq1drBz8d4ay8zpqAE1tUyL5DcqZiKUfWwZQXSI/ 374 JlbjQFzYQqTRDnzHWrg1xPeMTO1P2/cplFaseTivyk4cYwOp/W9UAWymOZXF8WcJ 375 YCIUXkdcG/nEZxr057KlScrJmFXOoh7Y+8ON4iWYYcAfiNgpUFo/j8BAwrKKaFvd 376 lZS9k1Ypb2+UQY75mKJE9Bg= 377 -----END CERTIFICATE----- 379 4.2. Alice's Signing Private Key Material 381 This private key material is used by Alice to create signatures. 383 -----BEGIN PRIVATE KEY----- 384 MIIE+gIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC09InoWDgWPk2a 385 f0+StijSNOR8K/hN8D+l078oullsk4ASvSwjsCNo7sHUa4xQUl5JO6VqY18LANwO 386 Rjrc9BaX4MguzsbFXBe6uFh1mVpXmFxSpUByQ+950MFz/evPgP96wV+z4TtAwW2Z 387 34rTiz4DxMI07XYNFUEOls/gkUP2GxzymsO2kaYWTut3SryCqeHEFbZFkB4urMk4 388 xrIJC3CzWruS2Q0FHbBlfkgKN5wXVgkWFfiOucfCn+IQsaqpo1d3f9jSkbtAV5w3 389 vzfog8919MxKI9H6l4KuElnAtJ7BtZcsl7dUy9u9COgEykRiVokFQgqQ7XNDU+r3 390 SeOWwks7AgMBAAECggEAFKD2DG9A1u77q3u3p2WDH3zueTtiqgaT8u8XO+jhOI/+ 391 HzoX9eo8DIJ/b/G3brwHyfh17JFvLH1zbgsn5bghJTz3r+JcZZ5l3srqMV8t8zjI 392 JEHOKC3szH8gYVKWrIgBAqOt1H9Ti8J2oKk2aymqBFr3ZXpBUCTWpEz2s3FMBUUI 393 qCEsAJqsdEch+kt43X5kvAom7LC1DHiE6RKfhMEub/LGNHSwY4dmzhaG6p95FJ1h 394 s8HoURI2ReVpsTadaKd3KoYNc1lcffmwdZs/hFs7xmmwXKMmlonh1mzHqD1/BqeJ 395 Hc8MP4ueDdyVgIe/uVtlQ9NcRQbuokkDyDYMYV6hzQKBgQD75ahYGFGZznRKtSE3 396 w/2rUqTYIWxx2PQz5G58PcsTZM89Hj4aZOoLmudHbrTQHluRNcHoXEI62rs0cVPs 397 D7IlZOLfs+SSTeNEXxD57mjyyufpV65OcNc1mSJAmMX2jWQ8ndnOuWPcc5J6fNvT 398 au0a7ZBOaeKHnA8XXL3GYilM9QKBgQC35xKi7f2JmGtsYY21tfRuDUm6EjhMW6b7 399 GWnI9IXF8TGj15s7oDEYvqSPTJdB6PAb/tZwdbj9mB4qj176x1kB/N7GO974O8UP 400 /PdHkU7duyf5nRq1mrI+yGFHVsGD313rc+akYdKcC207e6IRMST1ZFoznC6qNgpi 401 nNTuDz4ZbwKBgA5Dd9/dKKm77gvY69Objn6oBFuUsO5VaaaSlcsFOL2VZMLCNqQJ 402 +NLFZ7k8xJJQVcEIOT2uE7X/csBKdoUUcnL5nnsqVZQPQwI5G937KQgugylMZLte 403 WmFXlX/w5qzKXtWr3ox9JPFzveSfs1bqZBi1QQmfp0skhBo/jyNvpYUNAoGAMNkw 404 GhcdQW87GY7QFXQ/ePwOmV49lgrCT/BwKPDKl8l5ZgvfL/ddEzWQgH/XraoyHT2T 405 uEuM18+QM73hfLt26RBCHGXK1CUMMzL+fAQc7sjH1YXlkleFASg4rrpcrKqoR+KB 406 YSiayNhAK4yrf+WN66C8VPknbA7us0L1TEbAOAECgYEAtwRiiQwk3BlqENFypyc8 407 0Q1pxp3U7ciHi8mni0kNcTqe57Y/2o8nY9ISnt1GffMs79YQfRXTRdEm2St6oChI 408 9Cv5j74LHZXkgEVFfO2Nq/uwSzTZkePk+HoPJo4WtAdokZgRAyyHl0gEae8Rl89e 409 yBX7dutONALjRZFTrg18CuegOzA5BgorBgEEAZIIEggBMSswKQYJYIZIAWUDBAIC 410 BBySyJ1DMNPY4x1P3pudD+bp/BQhQd1lpF5bQ28F 411 -----END PRIVATE KEY----- 413 This secret key was generated using provable prime generation found 414 in [FIPS186-4] using the seed 415 "92c89d4330d3d8e31d4fde9b9d0fe6e9fc142141dd65a45e5b436f05". This 416 seed is the first 224 bits of the [SHA256] digest of the string 417 "draft-lamps-sample-certs-keygen.alice.sign.seed". 419 4.3. Alice's Encryption End-Entity Certificate 421 This certificate is used to encrypt messages to Alice. 423 -----BEGIN CERTIFICATE----- 424 MIIDbTCCAlWgAwIBAgIT3r7MRJB7qx35ms1tFWj7th3y5jANBgkqhkiG9w0BAQ0F 425 ADAtMSswKQYDVQQDEyJTYW1wbGUgTEFNUFMgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 426 MCAXDTE5MTEyMDA2NTQxOFoYDzIwNTIwOTI3MDY1NDE4WjAZMRcwFQYDVQQDEw5B 427 bGljZSBMb3ZlbGFjZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqV 428 KfqLwaLjj+gBUCfkacKTg8cc2OtJ9ZSed6U3jUoiZVpMLcP3MUKtLeLg9r1mAfID 429 lB/wlbdmadXPmrszyidmbuZmOpB5voVQfiLYYy3iOx7YOqzXrl6udP07k0sV+UdS 430 NRFxrfKeoQEFXgOaGdmnx4OG/e3p1fIKM0dPzZLoOAJF5m5O0xzXPL74zFCWp2f1 431 ZkuE4A6l41koaZXCN5XL7wWTLMLeNf9Byb5ksKqUuqEHAMd1nmoNMgjY9VfVfcrv 432 9w43GG8FtpSX+TWzB2zNS2OF+XIVnzRG5DeoULq8v88Z5bLpIJ/nx26r8A4SSwIB 433 aVv4wPxAf1iPsIVKarUCAwEAAaOBlzCBlDAMBgNVHRMBAf8EAjAAMB4GA1UdEQQX 434 MBWBE2FsaWNlQHNtaW1lLmV4YW1wbGUwEwYDVR0lBAwwCgYIKwYBBQUHAwQwDwYD 435 VR0PAQH/BAUDAwcgADAdBgNVHQ4EFgQUolNB1UQ8gCkVfAEj8OeOr83zdw8wHwYD 436 VR0jBBgwFoAUeF8OWnjYa+RUcD2z3ez38fL6wEcwDQYJKoZIhvcNAQENBQADggEB 437 AEi3/4eQPCAAbdgVMVbA7CplI+5LIV+7qUrORNdN8E53zu1oBkxktmDPWpQGiGYJ 438 fsQD2Gu1sz0Ofpqzaw0QHo90ghEcz3GOb9/JFEBRwV8Ern1rHXKRis56PPdBAlTg 439 3D7QKgwkGolETHH1TFv4mY/XC1CWzWq/wKPActIDt1cujjUKk2ILsa1kqYfbEQol 440 ZGil0pxx9jdMS5qaTdjb66GvPpkQI1uH4E9xiYbJu5bD+SX0Sgzih79GEhaP8vjc 441 w6+P//nJ3ExJkVT7OvIJmwGvV0ULtmsghoigcd2BBc/fOKdbyIBmJBe152dd02EW 442 6FwMfHKDtHO8k+/XBeZcxF0= 443 -----END CERTIFICATE----- 445 4.4. Alice's Decryption Private Key Material 447 This private key material is used by Alice to decrypt messages. 449 -----BEGIN PRIVATE KEY----- 450 MIIE+gIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCalSn6i8Gi44/o 451 AVAn5GnCk4PHHNjrSfWUnnelN41KImVaTC3D9zFCrS3i4Pa9ZgHyA5Qf8JW3ZmnV 452 z5q7M8onZm7mZjqQeb6FUH4i2GMt4jse2Dqs165ernT9O5NLFflHUjURca3ynqEB 453 BV4DmhnZp8eDhv3t6dXyCjNHT82S6DgCReZuTtMc1zy++MxQlqdn9WZLhOAOpeNZ 454 KGmVwjeVy+8FkyzC3jX/Qcm+ZLCqlLqhBwDHdZ5qDTII2PVX1X3K7/cONxhvBbaU 455 l/k1swdszUtjhflyFZ80RuQ3qFC6vL/PGeWy6SCf58duq/AOEksCAWlb+MD8QH9Y 456 j7CFSmq1AgMBAAECggEADgxoWEDDRE5yEZ+s7TMw+WH2o+3XOOrryqnsLbOyv34I 457 wAAUWK7qZyjd9rSDOAtBOgFhQNXYhWZlT+0iHslCIfqJMZ8wy1iFHBCIphoMSWs5 458 /D+idXrUef5Y23rClBxXH0g1UnSGXnpUH4ehV6p1lvZMh4OJKEoMC4cpyd1SzXrw 459 +VGCc1+pXv/tTW3Rb2qoWO9JoWY+Epcssrw5N8OFIFODh4QfbLN6pVTt28aQ4pf/ 460 1KhLoapjFzXSYp/jrcNjYJ9qRdSAbZsKOJ2yZ0yqjLHDCDipFty+W0pkUZcJhsgu 461 Cg1Stt7tKgSvAV/nEjN8e/vA91/AACKBCNcLzEoLgQKBgQC4eTM6BDCzlusXJBK4 462 SRC/WwUthJZzfOk2Gmwr0DCTRYhWQSDjBfiQNboazHObVPz45qP10fOt2iPEHeX+ 463 VWAXTNrN69M9lEzxygA3s76lAejBR3FbLWkzLYqPB3oZwSIE7CrWHTXJipFWZv+X 464 FG1R418fnRCUMJ4j85qem5iyqQKBgQDWhQMJu7FC02fr83qsIdLwqhiDtTpwUN3j 465 qfp7JoEZOxbm3TgM1xPAkrQTUgfr2ZhXGtUwsuKHyifxQEycrTkBOg0gqAfG0fnv 466 ybyXK6/guctHJQiy64lL39kPuvQkKB+YO60B/oF6zbyFvqanoKXjpspObN3i3yBU 467 X5/EOu/LLQKBgQCUVwHWeWAgSg+pgBx9jGOnPK4hOCkznRJ7qyuo37Tv+E317lFf 468 vYFvlYSd4CJmmiUCkZTvK3FkL7HrFo/HwSeQFQEt7aDkN8jX9bPPFv8K+UoNgkGp 469 LA8YVFrDQSPyadfNVYvsuXhzJLZSYGjPOGHgI5JufYLDZ4UDK/T97ekQYQKBgDDM 470 ORCxvXTyGiW2USVu3EkaqFDtnMmH27G6LNxuudc/dco2cFWbZ0bbGFN8yYiBCwJl 471 fDGDv7wb5FIgykypqtn4lpvjHUHA6hX90gShT3TTTsZ0SjJJGgZEeV/2qyq+ZdF/ 472 Ya+ecV26BzR1Vfuzs4jBnCuS4DaHgxcuWW2N6pZRAoGAWTovk3xdtE0TZvDerxUY 473 l8hX+vwJGy7uZjegi4cFecSkOR4iekVxrEvEGhpNdEB2GqdLgp6Q6GPdalCG2wc4 474 7pojp/0inc4RtRRf3nZHaTy00bnSe/0y+t0OUbkRMtXhnViVhCcOt6BUcsHupbu2 475 Adub72KLk+gvASDduuatGjqgOzA5BgorBgEEAZIIEggBMSswKQYJYIZIAWUDBAIC 476 BBwc90hJ90RfRmxCciUfX5a3f6Bpiz6Ys/Hugge/ 477 -----END PRIVATE KEY----- 479 This secret key was generated using provable prime generation found 480 in [FIPS186-4] using the seed 481 "1cf74849f7445f466c4272251f5f96b77fa0698b3e98b3f1ee8207bf". This 482 seed is the first 224 bits of the [SHA256] digest of the string 483 "draft-lamps-sample-certs-keygen.alice.encrypt.seed". 485 4.5. PKCS12 Object for Alice 487 This PKCS12 ([RFC7292]) object contains the same information as 488 presented in Section 4.1, Section 4.2, Section 4.3, Section 4.4, and 489 Section 3.1. 491 It is locked with the simple five-letter password "alice". 493 -----BEGIN PKCS12----- 494 MIIXsAIBAzCCF0gGCSqGSIb3DQEHAaCCFzkEghc1MIIXMTCCBC8GCSqGSIb3DQEH 495 BqCCBCAwggQcAgEAMIIEFQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQMwDgQIWQKs 496 PyUaB9YCAhTCgIID6GT96ewG16YBcazV7Zo8cZ0AWul+It5HDTSG2EYFtJB8nqhG 497 rgKuUeD1g1xWJw++M7z3kAtEn1Vxi1KdHtzZ9S47GRd69TWSpbA8l6X7nY9WcdhW 498 N3OcpdBcuJo7PQ/PFk1srsXbqrKpnDkHn22twIN57/ZR1dvicpvsRbmjWf73ia4w 499 GfabS7WUGTt6Kpdd/kUzWNdII07B+qjcqAOlZ608Vql1MD75Jbb7nXTP5DpSP7WA 500 kCAGD4b6O7MzqBwGWLHXnLQP3RniraqgFwLKOAOM4G2G+wJVQ7ig2GhJoD0qfd9U 501 +dpELWZs5hWXU1E2Q5mx8AkQZHesAhCHsONLMB38rzCeWGRODHV03+U9EjQOusOu 502 jzHEEPtKzZa+c2BtzwnVxYi1Tz9BIs0OWLSE5hlYuT8ZQ13/bDlaUmKZgBvEubzZ 503 t/fglGTlCczymabSpaMpQRzXO0eT+/enDdILpDT2cBf6Q3+a521g38gaf0CIKfGf 504 NLCCfL2YxLbjHJHxCq5WqyY8bLDNreCxffQ3wV154eIvwYdLfiq44uM2s2vrr5bM 505 LAV9DhomAuyfQJixk8I6YejlEwZQscDeh5+037DTzDc0AFQDe8d365hQMcqMYC9w 506 aey7X1SUCL9B9coEyR2k4NM1qFNnd0n3K1j0bY9N0o2kzI/02nCcO9Yq2qMHkA1m 507 XShpyrmkqYMDtlM7DXQDPlYGumIwYu8tSPuFJzXSq64BNmRxgvOhFnrqytwBeAVS 508 XTe8HelM6EOW6z/KUffWOYwuq/QHCgNRODJN3hB9oI7Ij5g6wn920WNTzoFjivoi 509 QNEivXhyEakrBwZF08fJFUJHoJg4N7M1nV3F6I8/pgdPyRMFHO6InfDD+/Uoitwg 510 51BxMyAvejGVzk0KxolG5NQoUOXhje7qFURxIbqXrSI1Xui6jSUPXTTyGLj5rcLo 511 mpVMLbs5tUQFRDBtN5qBmbW1SWf3ZvkHScMrPAgpZ/cDSKh5w2ykUGWhIPAaXClA 512 +WCWlMOuzrk+JDRjmO+Mzptno9b4NCiFCyGJqQSyEo4dD4ftZVciNK6fCjnArkz3 513 mgQroeIDf/VpoExLcf+Kp/PK+X9oTbyW5pShH2B1sKD57l1qT5AlBfmpKA0lrw9D 514 KRvO8kfLxaNBbijOU1f0YTQIwoykq6k8YqH78RcjoeOoEcFriknBYqc3ay6tNbgd 515 IhaBuRXnxxv0drXkMLReZ6EqPBz8NmYu+vhYKtaMxg3T5+H7BEfmLy6qIJpsEqtV 516 a4vWrVbhMsNtfjVQnDhbeZ6Tea+U5kxXAhXfKE1A9LM3UkYcvn3aBg8smKIrL/wu 517 /LPJSKIwggQXBgkqhkiG9w0BBwagggQIMIIEBAIBADCCA/0GCSqGSIb3DQEHATAc 518 BgoqhkiG9w0BDAEDMA4ECPoEFEHQGB9dAgIU5oCCA9BEuCtcDZvvbXNHI+j/3C3U 519 zI65UbgkDQL3S02ZMP6Ooec5Mrx4t5GekUR6hyZJqkHpcDP7UjdnlU17TYH01bfi 520 lcIaaNaJ/5pkNAqfPKKT9ZXNTh/2iVauqBPcQVS8tNWMPsOSl3V+MlaCz5GJPSH0 521 H36rXRZV3cEq5KppiG12CHmNTpumpcRoeYAn6UMs8iaFPyoxNUircsNBtr4BpWqL 522 qU0cuVL6aUS0mWwC92UXNRbfo7MLhmn92myE1FuiQeeda04dX4HTVT7l+jEiBq4Q 523 pXIGBOu2pOJlmc87ruUl3UEnjXN8NSTgIlmuzu/ohx0jDJRf13ABRoJtYC2kw/iz 524 Pj0Yu4ux18uZ/FfN7qgKAAMB2Dx1UJLCC713LbUj1zaCMc4uEgt+9tnmMe5bKMg0 525 V3eMa5QvHp0yxGZpqpewisaBI79z9ZoIkY3gqfnZhzRg1uJyHOLNY3hvMTK6O2XL 526 Xgvw9mNbx6YCOj+SSAVKQIqt6vswSa7G0Zfc0y26evVOdOMJcfYJ6D1Q+NV9/nlj 527 st4pFf8orZL2zrMoC2ISvjEJKku9dyh7DIUxVJGQm7Kc46MYBV0N7ZLPHrlsq8/j 528 ap2q4glZfYRefqFKzD7ZnIcRKu1dLIRCji86m9Ic+n8Jox2aUAICm9Cx9TdE74gP 529 9+uHpGfI51sMlU0Q8Fn2W8xHfBiwzbcyEAW+YZj5iKuGCcjPAx+dJSMLkFU9/Uun 530 wgO3VOPoYyLOluO1e8Uc3nw56eT2x5yV69gnK19s/K0zyOELm43Ex1JiJKWOO8Xa 531 UbmbYlzZEgxhfp3fP65KN3FOw8ehHEuTTpXTIYJQlKFzODzm+fkYpZCdXZDjCxli 532 o+LPHjrhQIR1umBlGaCL6myNTSeFbyJAF5gUy1VqD4cEm2bxDSdBefBPLvR5Z+b/ 533 4aGPaqpNTb5n/vXeWY6AHOyDA4aLtuKUo7TWTvp4dSKLzPGhTUdu00WGTxSj4rs7 534 9tyeHdTlbhhugLvpfyrBzDWA4BvyVHpCOfnj26UvCKLQgAvjzKEXsiqiYuQdsgQz 535 rgc9mwLi6GuJLm3OjMhonGtaRCgF3vFvKUuki3WY/7EcClFn/kjjCLQhP3EcP7wi 536 uH6dpnlu9l5R63a7Tc9pvhCnYyt5Rt9kTCh+NcPEH18eAHj+2nnEDsN+nUfLzAgV 537 NHrNBq9ZgEWibC6/8ihy3qaYRAuHFK+zQseWT0vEgJCBqvo0QwDnGit0NhtLczAt 538 gan1xOL4/N1VE/bZ7Ydxm/dDpBcdvspiXg9LHlGI6tS8UDfAlGi2BhPmiE3OAR4e 539 MIIDrwYJKoZIhvcNAQcGoIIDoDCCA5wCAQAwggOVBgkqhkiG9w0BBwEwHAYKKoZI 540 hvcNAQwBAzAOBAidIqBxZFwvagICFCKAggNotP/z1THhMYAjuY/0fDNvUslKV/d2 541 LU4mkt/mLD72DZCkQJx5MYl8dw4JbQv6TrS3wWPsvJSAEG2XlY1PkF6MHqPfuWRp 542 B7g5Q972q4TXKqiffDXQa/GyGaUjqu6q9te8uP1u+duQ2qbfZWGsWSTBSu5NYLDY 543 tYNy9xWscdGzCG8fvFiYlrc6cdyUl4G6aw3dZ1kcDk9ki1TwsL2mAagktorzTt5H 544 ewu1DVkpQ4OdIXuD9uqhZ5P6Mbb8zyVPkFDBUPj28zIA045T/gEyAuuJRTU5ndTO 545 TGzXzXgC4b67zbSQqzIZsL3Bld+uWlQhS8xkpaOKUzdexN4pu1SnLAJcGE9xOkcW 546 1c9Ro+yj7mkxTU/UzoYzyKWQzduJtl033iE8ocZV4kcknJZTPKcNvgdPCMKvcjSH 547 YD6HDIVUBU+Frm1yvXQz8Jvxi2WMy/+ThTUwJF1HJ/CXVITECAg0rbCCMbxwq+Ys 548 7XzzqhBYdQWEJJHEUFDb7yo1qK9hDkxu0ZWHA8PJf4YhxUcUFCKyYOn2VzfTgbpY 549 b0Df2MqOossUGeIfWn866rsRQLFaZJNpJSJMgWbc7ASeq0hL9s6cRTtN19Afyp4G 550 pQUpdMbYKcRabkuKZDCPdmSnaNCeQ8KlRdF517O0Bv3uYH2xaWIFGXP3nh+54czF 551 yxC5eEALTW1fDRH+xf/AzkaRB9uSB6i4ykZfhdGyAI8DpccCT7/SI99KJmQ+s9S5 552 WFRmBaepqV40a+VKDVO4wIsdiGiz27GNocRumfKdNjaREDIufWlX1s2PI2b3SJCz 553 ncyZvLY2fOpumqZYXemWUIWiPE44IsZV6mCJ0UsqEFvZNrPNyfzo9w1s5SNy1oIl 554 d2NxpNkLRAm8FIA3MbyIuvFYGhyo124sHXLGjXJOhqpnn4q5dhLCnB/Y2HtRSlih 555 raJyNO1GE1PwF6Y5pdbYHkIr9VPlPueoHFbPiz4rIgHMuUa6IRkIfZrm3QEEagzo 556 ZgFudPJAokWD7hy9rg+fXj0SW1O2yFPesBCxWY5OQd3j2/2WYHUwwx9y6GJl+C1k 557 I/71/kxATWchmg8uRoq/DigGlbxmvBzPUZmpbvpvLwBk96J9M+Bxg34gC8xj0G6K 558 YxdZDBMJoqQmTn4xeK6qBqjlFaRdg4eKN8JHJqA5Xa6u/t4wggWUBgkqhkiG9w0B 559 BwGgggWFBIIFgTCCBX0wggV5BgsqhkiG9w0BDAoBAqCCBSYwggUiMBwGCiqGSIb3 560 DQEMAQMwDgQIehcRLmVUApMCAhQOBIIFAHb5dXZKzCeRUo2ZSj0oyuFS3zQ5HhKy 561 fapsyCqbYCKv/lSzNYWvuda7xfa+uOM7/wCB9sWdz0MTpaBMHWx9hvibZIY65oM+ 562 ry4tTuKKqOJl37OsnjB0dSNTKszsI3faPUjslxqIH3aC1shD7OqhIRGZzRjK44PJ 563 yWv626oQrgVtTYR9NYTdee+SbBZbkEt/EpWipwftWXGR6tSYJQn99eO9Vih8HyQv 564 wIpidUh3pCFOlow4VZyAqIWOHcw9TAjBXNv+qfdH7fiX9wM5/GvnQReIsqjXCUoc 565 6pSQIAqD/f+I/d1F2ZmqM7KwX0LGRER9OWZGyF734pN9GLbNetWm6rKxmlSI/5m6 566 +2Jxxfann16P+vBSEgWJ/I8GnJAdzIbBTyfjog4Gi2+lmrPzK7+C79ntM9nfsr4x 567 Vzy/BknwZIaJksd4VvOGkS9nfM6shtBJB9uR+GJfthtsvIVUHN0kz2r/lVzMSRbO 568 g9yR53hv1H/nXCmUjWz/BvobmoaVBcCmmOnnYZTHMNarIVYdLQFif5ZLH7WV/XVE 569 VIoRntNRiKsK96VAHm5XboWQGCqL0hehIX3Nily1genGm1aFlSQNMvLDko1ILDTK 570 rINvPmjG/WFoLntpJFPtYZsooT1jjXLw3VTSodtgKQNdPYOEidSJqwIS87fzrCB2 571 Wmwys0iGfdsuNhSaqNqa0dMO6FiW2fkux7H+w7SX1/n9YeZUNLOcewLcC7E8IA1I 572 arjglZE1L6Yb2ldXxV9q3PPOwKuGnah0TKnD6mLn5BIGOGTzF1VspXRrJhFrcLe+ 573 xsJR1r6niI3bcMWXXy7gbm1X/CRE902IynxE1oDR+xZ6rjPWDJP7kVf4GvA8trCG 574 rot4pbJbmwlBeMIylScdQoHEnyqrenOnRMmXZaKzl3njtq7Wk78qoJq0a6Vh/sde 575 0KcOPFkyTZdMBlTztm0K2VJU3jUVzPlM0WY2fyGDoA89ol+/MiNsgiaEghGybXBY 576 ipOex+p7j1GIRN/CKmpWsqjZnB78kyXmZ6AE1vC6neD/7zANInDkzXiun6ic72Lo 577 BX3JGiCSuM6hIPJ0AcDwlzTDu0H2rCQNw+tivJ2v4KbgeKoc6beQb5fZHs7VsWHi 578 kIcpwqB5ngwt34wHgFG0nTS4lZmvzSJ7FMRVGmsDYkDTpZzgNOaxiUBQMcEvxNIe 579 3nAmA+dvB7w6XRQVSUsL+vBFhHiWGZ7hk5sCeHElewXK0SyJADgfFlYq3EfEgZ13 580 h4wtoSfbBVtzbbyg2LNegUCLfIJkc7fmT7X7JSxbjOgndMHEeMdVb+NFxbgsXYrY 581 D8rC2A8l5cQzZrsxb1bvgybEJz+NU/52UgGrPmdjJKuGBK/V2zor6qPvKyId1Gb4 582 QQuIoyClwhZ+qk9nE4Eft84y7ISgMywH+lw87HrSHKfpqzQhCxlrLu53IYK/4PhE 583 7BYC9Q4tvIsZXSGZ+nju4tyzERSlaNe5njUeIENr4B/+kXULwVDcvMFHqUFJMkFa 584 i8FUga7gyipZ+654clGgJjnNBO1va8JcdtdPRRW4gwdrVn8u8J78KBzt6ChkrpKR 585 V8VeWKBk9lhcT0ZNpJnNqhDrkfzHBqP0Uo133I7P7C+h9sNDI153W6IOIodyQE0A 586 v1WxHo4y/1d1VeGDaB7hOSDq9ZMpm9n1En7F6/1/s4IUZHja/qRrK9hD4M0Xq0Lh 587 FXuUzuipo49OMUAwGQYJKoZIhvcNAQkUMQweCgBhAGwAaQBjAGUwIwYJKoZIhvcN 588 AQkVMRYEFKJTQdVEPIApFXwBI/Dnjq/N83cPMIIFlAYJKoZIhvcNAQcBoIIFhQSC 589 BYEwggV9MIIFeQYLKoZIhvcNAQwKAQKgggUmMIIFIjAcBgoqhkiG9w0BDAEDMA4E 590 CKq4DtyiayOyAgIUpQSCBQAKQtkPOS4sLE6Os7nP4RaJWBuyXl27V/o6TusBRBgQ 591 oPzP+aC+O99wgisEKedyB47bAzcO4sba4q8UkERAsYHcEhdD2hGRCL7ou9jTtrr4 592 RgZpa5V9CJcBO0t4bqy2lUefOpm6no+RX840uyM4q5Q+cfH1rTQ1a/a+gLglbpto 593 EkH/4dfR3ELYiXcM5UrBYTJOHcyME8c+TXbpf7kiplTtlsrlZyU5zrWcxngrBxwF 594 A+O85W/uVR3QZSW+EGx/VCYwGruZlNytBvBYjsYsnC+yKYXbqL81DgOePy+eh6VX 595 64SwBLXcWcY+NK2EZrhzrUFjl+PXFKY3IVVPJhTE9o7gJA0hzvAanOluWXozD3/W 596 PQaXhyIJDwM2MjznjL2MBydpy9K8Cio7XaV6PX8DszIZkfI4DAz5f7G7WbwUq3Ij 597 PPPWiUv+JsR+dnqzWDJ22SXc+AdQP2sKqMvP8gOpHOsVlXXE76c5rUcZCZD+gGv1 598 avO7YttWqbDqLj6oQEIJ8LX0Qvwd0YEhetE0bJ5uv2njhQDhLkH/JIbmFSgJZeM8 599 dtKHb8f5wZc2B+nXGB+TFboGzSuP7gaWu1vKsJNqT/J/FYEqcamI2F+td7z1sGfb 600 R9ckAcxXeb2uPVbCJ1a50gRlz9qVm5Hb5f53X7aoQQp3F3LDGQmJ+GFQ/oXXwabq 601 n4TvNO9KDhxpGcMMU9RnugUfNU9GBec0vfrzmVKZdmJ36HOmMnLvgRakRhCV3kGA 602 BXY83hwUv17E1qASLKcAWIachkCCGpBGyGtP2IOZTn7PsLJR1BzKnePa7MgFcgoC 603 ToIpdQnCTtAsalmBm1s480LN3GB5ojeGbQvNf9TAviA0tg5VuT4/O48V6uYSJsIZ 604 sawm3tGA/LjxyfV1aLddQT5Zf5ZX9BX+K/PB4oYAFxtUpMK/aL5G1MvppUJ9CjqA 605 tnoKE+EkdQmyZ1VoDO9ih44zuRx6XV4AEYafNB8ygjRHGsvPW0/M0Es0w16wzJHT 606 uf/15fD/nH7Xh5MzhCF0CtvLn8v+S1Poi2/40O6pS2byjUFRbeCpzEpRxdv90LCb 607 9ALdy0yG9u41W3yInKNFnaWBulfOPFCeZT92M1BgwJA8ZcydtiiunRNAH5iWLSPl 608 oUpOD1v6En+rat+PoyRXIy2fLHBL25awLhABoZPgRsCiLsiNiohfyngksrQKeRgO 609 laBMT92J8r1E4sUKirQlcOdiWBE6vmBSXzyN/twvfgPNIXgR0rw6c7VhhS+hNTrs 610 ttg/xcfvJ/bftDbKm+RZL+yQoOkkAf9R5tizyMdMBlaMrpfrBxvNtMiykbZ88SYo 611 A70Trwab2aHQluVhs8OjXGBEOqmSudcSdV1EhBpo9HBsDZZi0IwOp5/B9fCHdnTh 612 CTiUm80eQ6mX2/DB9LlNh7gHOyLL3azTm12D0ZpZNaXyxLzdiRiAdwpWZmmegOOG 613 70yi0D5eIxh6cbnbuU6Ygdp+pFFVYHfAvc5Czpne2OPhXX2k0Okbwawr9AfrFjIf 614 AEmBFx5GBGr/lSiUQSkbUC/s209YgaOgWTYt3KXPzrThJJGZnnXZRTGfIi6vp8Rs 615 nPX35+Dxe/Lp3gXDdIJeWG6XVA8t3fspcoTqPkm/XGNMmOZ81KX/ReVdP+dC93so 616 v2DuDZbYGPmHlD47bOOiA68GD64DEuNtQ8MhWk8VRR1FqcuwB0T0bc+SIKEINkvY 617 mDFAMBkGCSqGSIb3DQEJFDEMHgoAYQBsAGkAYwBlMCMGCSqGSIb3DQEJFTEWBBS7 618 9syyLR0GEhyXrilqkBDTIGZmczBfME8wCwYJYIZIAWUDBAIDBEB46MAsz3IW/otz 619 UKMFDfWTViMUL7zfR11eaXJwLbIeYN0LvgCPONEp+hUMwXfnwDNTB89j1Ly5arzK 620 LfOLWHXiBAj1OQCGvaJQwQICKAA= 621 -----END PKCS12----- 623 5. Bob's Sample 625 Bob has the following information: 627 * Name: "Bob Babbage" 629 * E-mail Address: "bob@smime.example" 631 5.1. Bob's Signature Verification End-Entity Certificate 633 This certificate is used for verification of signatures made by Bob. 635 -----BEGIN CERTIFICATE----- 636 MIIDaDCCAlCgAwIBAgITWeEgizhkG2crS8Kgl56AnNft6zANBgkqhkiG9w0BAQ0F 637 ADAtMSswKQYDVQQDEyJTYW1wbGUgTEFNUFMgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 638 MCAXDTE5MTEyMDA2NTQxOFoYDzIwNTIwOTI3MDY1NDE4WjAWMRQwEgYDVQQDEwtC 639 b2IgQmFiYmFnZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOZwBdIJ 640 UaH/TYwSpHuoPu0S6zoEX8EI3B/ts5tAH+uxSUTaxME7jrrZVmplAN6ffsG+16os 641 1RzkIVXrI8IKfDyaaPAHZvGq/OHdrbXstTlXcWgibjXu0iY368EoQejbwJu0vAgx 642 t/hGqZDvX859qVsGkREOrcFrR4tUE+dT3bkbYkNaKrLiZPCwQ4FDGZSlLGl3xfBi 643 syZRrmi0Zef9yn6/fm+lZAg7sU2WC2cbevmt/0JGgtyPZtsoD7m7RxSQeT+frPG6 644 ETkiptTgdYLC6MPHhfUuzrXBhnqKGSYiVEAkdeDWlOWyMnyhGVdmErV8Hc7aBCSd 645 n0VESCvvGJ8JQd0CAwEAAaOBlTCBkjAMBgNVHRMBAf8EAjAAMBwGA1UdEQQVMBOB 646 EWJvYkBzbWltZS5leGFtcGxlMBMGA1UdJQQMMAoGCCsGAQUFBwMEMA8GA1UdDwEB 647 /wQFAwMHwAAwHQYDVR0OBBYEFBfFhHvQp+92kDi4s28IvJK1niuUMB8GA1UdIwQY 648 MBaAFHhfDlp42GvkVHA9s93s9/Hy+sBHMA0GCSqGSIb3DQEBDQUAA4IBAQAT2G9y 649 JTWq6FS7hBYLjeBijVILmvwRiy+AucPJS/DtPM10mwObdrTnvOoLKeEIQWDV7gg5 650 RNWiHlhSUsjUdXcsOvuQ3FxsKp5scFd9xc9C7EAzaoorvpQOSiJsFEFnkvQwjdZ0 651 rfHH2Y+k2Sa5YZZdhZJWwqyNWQmUavWSmazqkUb5DAlOx7Dcfb4AzEX3sO55LAYF 652 XKpqLxzoVPsiy1JsEmSd1IRe5ux/b66xdwpSTx935A0nTQ8UcBvndM6o+4UIFZOb 653 PPLBKORIXiHNtoWqjsxIcQaGDE8kY2LEc94wDUXcaJSOi2zCHuF+DOuUTXTPmCJC 654 pVUZ9OWDKfM54rYh 655 -----END CERTIFICATE----- 657 5.2. Bob's Signing Private Key Material 659 This private key material is used by Bob to create signatures. 661 -----BEGIN PRIVATE KEY----- 662 MIIE+wIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDmcAXSCVGh/02M 663 EqR7qD7tEus6BF/BCNwf7bObQB/rsUlE2sTBO4662VZqZQDen37BvteqLNUc5CFV 664 6yPCCnw8mmjwB2bxqvzh3a217LU5V3FoIm417tImN+vBKEHo28CbtLwIMbf4RqmQ 665 71/OfalbBpERDq3Ba0eLVBPnU925G2JDWiqy4mTwsEOBQxmUpSxpd8XwYrMmUa5o 666 tGXn/cp+v35vpWQIO7FNlgtnG3r5rf9CRoLcj2bbKA+5u0cUkHk/n6zxuhE5IqbU 667 4HWCwujDx4X1Ls61wYZ6ihkmIlRAJHXg1pTlsjJ8oRlXZhK1fB3O2gQknZ9FREgr 668 7xifCUHdAgMBAAECggEABcQg1fTtieZ+O/aNdU149NK0qx97GLTBjIguQEDDBVFK 669 2lu4PhBg9AdgAUqLH1PE+eq65JaGZwvFH8X1Ms2AKiRzYsPOQIoJ4n1hc69uiEN9 670 Ykcv4QHOvvqtCtWYjJyb5By9WPeLH6QynJ6FlBoSqxhURSWyYfTuwqt1OHEhsUuH 671 d3N5BmbFiRBNj4aIA9zz+i5xL0m33kMKai/Ajj3sI0AJsZ5ZVAhYbC8sCt1Xevb6 672 i41p9S6GSwGC19by+1y9WC1QGtb5GDotvChMvmZS/O3NeDc6xC/LZoQcHNVgiZd7 673 f1g6iEkJlCYK+D7xsd7Y630w75Haj0vnlhiJObSA+wKBgQDxv8jp2D6IVRGgYfaC 674 nUU3Mg70wagX1fgPHO9Sk6e9c8CgORh2uwWjpTawu88xBGFyZ+xnWqr7GCNsltas 675 3m94ri4A4R94+5uL8+oOLC26gMDfzATd1Q3k/h919YLk89tonQEUbCFZJdphThEb 676 vg2W+nNsEVcQGuClzhX0AyGMswKBgQD0BYk3sdGQbBA/hYD1EYsZfYebUiYv2lTt 677 VGRgTohKFclRAWOtGP9YRbKyEVkBLhjgkXzS9xGqKywP71z9Iny+zDGbzk8ElB/g 678 lS7GFGX50TG0ISfaFWTYdxt4mN9pduZE2blT/26uyU8DXCEBhF/OqhwQjJqKTYTT 679 Rl3Ara5fLwKBgQDQyVtjIyD2q8naY2D8c4mo3vHtzyc21tQzcUD8Z4vSYps1hbos 680 KN/48qJmRv3tjqP+o+SXasYKsFE/4pIroLxTVNNkbQm6ektfttwpO1yPG834OwLk 681 97HVWOig/tX6mOWg1yBsm+q9TKTrrvm1pRGlmE6BQgSYYy4r5O4u3VlnYwKBgQCl 682 B4FvWyDhTVQHwaAfHUg3av/k+T++KSg6gVKJF1Nw1x8ZW5kvnbJC3pAlgTnyZFyK 683 s5n5iwI1VZEtDbKTt1kqKCp8tqAV9p9AYWQKrgzxUJsOuUWcZc+X3aWEf87IIpNE 684 iQKfXiZaquZ23T2tKvsoZz8nqg9x7U8hG3uYLV26HQKBgCOJ/C21yW25NwZ5FUdh 685 PsQmVH7+YydJaLzHS/c7PrOgQFRMdejvAku/eYJbKbUv7qsJFIG4i/IG0CfVmu/B 686 ax5fbfYZtoB/0zxWaLkIEStVWaKrSKRdTrNzTAOreeJKsY4RNp6rvmpgojbmIGA1 687 Tg8Mup0xQ8F4d28rtUeynHxzoDswOQYKKwYBBAGSCBIIATErMCkGCWCGSAFlAwQC 688 AgQc9K+qy7VHPzYOBqwy4AGI/kFzrhXJm88EOouPbg== 689 -----END PRIVATE KEY----- 691 This secret key was generated using provable prime generation found 692 in [FIPS186-4] using the seed 693 "f4afaacbb5473f360e06ac32e00188fe4173ae15c99bcf043a8b8f6e". This 694 seed is the first 224 bits of the [SHA256] digest of the string 695 "draft-lamps-sample-certs-keygen.bob.sign.seed". 697 5.3. Bob's Encryption End-Entity Certificate 699 This certificate is used to encrypt messages to Bob. 701 -----BEGIN CERTIFICATE----- 702 MIIDaDCCAlCgAwIBAgITO17BWkcdhfwmHN7ueuPziuUW1DANBgkqhkiG9w0BAQ0F 703 ADAtMSswKQYDVQQDEyJTYW1wbGUgTEFNUFMgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 704 MCAXDTE5MTEyMDA2NTQxOFoYDzIwNTIwOTI3MDY1NDE4WjAWMRQwEgYDVQQDEwtC 705 b2IgQmFiYmFnZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKrRwJQT 706 TIgSJPIiasB5P8g6BVsI/D/WdbmHatWqiLqH746AMo3QPE27AURnZr2iDkkDnqbD 707 Y1tZKO5RPB5Q7PSR59RPrcx95in5/htnq2PmpZDCU1z7zAFHQgPPntTie5PdYGFw 708 6cyFqz9ynNMU5bCfLRiepocnSV98D9Px7sh6XykEHw7rDx/EuconT3Ilrge1o9F+ 709 MWNaVAM9q0kgJZxr4RMyhW1uNwT42Fz1J0VjLVxcmtXY6uhG/TP5JW4XWYXgyy7I 710 y1El2FO9K/VVxjP6nI3fzYVmKYQngXKrMGjOZly2HZtJhZqqHnBetplBNA4jXYcC 711 k7Z3n3dHJZfg9xUCAwEAAaOBlTCBkjAMBgNVHRMBAf8EAjAAMBwGA1UdEQQVMBOB 712 EWJvYkBzbWltZS5leGFtcGxlMBMGA1UdJQQMMAoGCCsGAQUFBwMEMA8GA1UdDwEB 713 /wQFAwMHIAAwHQYDVR0OBBYEFEqzrDFTAkmcTeNueeAlYZU+iGIlMB8GA1UdIwQY 714 MBaAFHhfDlp42GvkVHA9s93s9/Hy+sBHMA0GCSqGSIb3DQEBDQUAA4IBAQCCgLLW 715 tCBYZK+DatWaOVNiJdTxgQBRXtspGV79bejJgFV2YG9BwvacdKx3ZnCNiUprr69Y 716 WOjP/l9GP4bCKHNfrp6j79rGxe8MtxEWswF00cBj6QYZaWWjMXQS5G6NJqSAWlCl 717 cQfNSVMIgtD6vCf3ibyB22LDRYBokLFSK63B0y0OXbdGZYaQNVFqCXBPT5zhB3p7 718 lZAU09PukACJI+7lfupW6Xc3Brhqnw9pkouNElBvMSx5rAcAxsNK4/Jkw+sQSEih 719 VinpFedAz36YufvpHUNOmYspiHFz48iGPAaNbDREEoDUSRB2PxXVMim22EH6iBXe 720 t1oEQxqwa0AMz5Fn 721 -----END CERTIFICATE----- 723 5.4. Bob's Decryption Private Key Material 725 This private key material is used by Bob to decrypt messages. 727 -----BEGIN PRIVATE KEY----- 728 MIIE/AIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCq0cCUE0yIEiTy 729 ImrAeT/IOgVbCPw/1nW5h2rVqoi6h++OgDKN0DxNuwFEZ2a9og5JA56mw2NbWSju 730 UTweUOz0kefUT63MfeYp+f4bZ6tj5qWQwlNc+8wBR0IDz57U4nuT3WBhcOnMhas/ 731 cpzTFOWwny0YnqaHJ0lffA/T8e7Iel8pBB8O6w8fxLnKJ09yJa4HtaPRfjFjWlQD 732 PatJICWca+ETMoVtbjcE+Nhc9SdFYy1cXJrV2OroRv0z+SVuF1mF4MsuyMtRJdhT 733 vSv1VcYz+pyN382FZimEJ4FyqzBozmZcth2bSYWaqh5wXraZQTQOI12HApO2d593 734 RyWX4PcVAgMBAAECggEAEvPt6aAQjEJzHfiKnqt1U7p4UKb5Ef4yFrE7PdTLkeK2 735 RjncIhb6MeevVs8gO6co7Zn8tuUT95U3cOXLhVOWTvaHYeurTXaknICz3IeOoSl8 736 skiVZko70uJ8pR6asWUlr/zOjlEwZ7RnEUWet97oM0YeA07LDFDkF7eUq//6bfzT 737 ewr/QfDDsv+erwJBh+9CRHOJyTuDH1WeGxYV8VK3M6VhdTjFxXxFhrQ4pBe5J/UA 738 17Bd2GM8Urg6VYzVo6x4ajnc1H/ezYLdc459poTffv6Fg2trqFVAj2IrQlAeqjda 739 lemsa6Np801mUGknq3fjKS13RYGBv/48rCHOT8eRgQKBgQDM5TuS4ANQjOYoOgtF 740 xoVjbVlndOo+SmdFkZihzQHxcbLY9HXe5HlbLf1IMXz/nERxl+SmYuuJk0EdiM9r 741 HOCcHRLfBmC7t0GdVvLDHSAX8Ec47LbtKZqyM1U9dn7Z+5q4iywqpaP8pP3+oY57 742 cgtQax1jle3xhRAj65cl1RBmQQKBgQDVbLqK6wKDfSdZuMZGUtOY0rtamBDCgEU6 743 rEqBAyCPy5NpF1pomUFcYKWT/wbReFqtuyq2OyiATB0yHHMko46BUtN7qX/m/skt 744 DHWXVWs1+G4IgEMVokM9jjrkgdY5grrJ68sagKC+bgv35BizHPIqgQuO6qnPSrM9 745 bevwbQEj1QKBgQCiPE/zeBSnzyjeaTdLxGkR1R+ZX2WqdNdYqnQkiWMkflaSmt5J 746 4raEj+GhLC5BZsZ6+z480M6XXFWOwSkbMv5WHl824KHvgKcfoh0OiR1EVyjN1gDx 747 wKOQvjycMhs3FpXn0arjCczS2wGSgPGEpUR4JJhcpfaF6kphZsWDWzVlAQKBgQC2 748 ivbKltNhj4w2q1m7EGC3F5bzl5jOI1QTKQXYbspM8zwz6KuFR3+l+Wvlt30ncJ9u 749 dOXFU7gCdBeMotTBA7uBVUxZOtKQyl9bTorNU1wNn1zNnJbETDLi1WH9zCdkrTIC 750 PtFK67WQ6yMFdWzC1gEy5YjzRjbTe/rukbP5weH1uQKBgQC+WfachEmQ3NcxSjbR 751 kUxCcida8REewWh4AldU8U0gFcFxF6YwQI8I7ujtnCK2RKTECG9HCyaDXgMwfArV 752 zf17a9xDJL2LQKrJ9ATeSo34o9zIkpbJL0NCHHocOqYdHU+VO2ZE4Gu8DKk3siVH 753 XAaJ/RJSEqAIMOgwfGuHOhhto6A7MDkGCisGAQQBkggSCAExKzApBglghkgBZQME 754 AgIEHJjImYZSlYkp6InjQZ87/Q7f4KyhXaMGDe34oeg= 755 -----END PRIVATE KEY----- 757 This secret key was generated using provable prime generation found 758 in [FIPS186-4] using the seed 759 "98c8998652958929e889e3419f3bfd0edfe0aca15da3060dedf8a1e8". This 760 seed is the first 224 bits of the [SHA256] digest of the string 761 "draft-lamps-sample-certs-keygen.bob.encrypt.seed". 763 5.5. PKCS12 Object for Bob 765 This PKCS12 ([RFC7292]) object contains the same information as 766 presented in Section 5.1, Section 5.2, Section 5.3, Section 5.4, and 767 Section 3.1. 769 It is locked with the simple three-letter password "bob". 771 -----BEGIN PKCS12----- 772 MIIXoAIBAzCCFzgGCSqGSIb3DQEHAaCCFykEghclMIIXITCCBCcGCSqGSIb3DQEH 773 BqCCBBgwggQUAgEAMIIEDQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQMwDgQIe/d6 774 qDQ/28QCAhQGgIID4OAnlsZankpTStcSJpXiMtvB6Ol+f6XhgDJ5hOJLHyYerFHQ 775 6BaMiIgPQ3ycT/UwYjtIE9yo6NxHz94jCsMM74OgzUMYc1b62VChOcADCRpZ2HYy 776 EGfGQPUdxKuOzbeS7O9LQNrCA0/B2y+Wtu4D+dthoO84KK9916Jq87+eDrA8qXQm 777 sy1jVGNBA6Y1n2DWAnR4H9+Ghm0tYCcRDPhd6togL533EZ8FsbGw/eZbkojyAYGj 778 wNjkk+DfJcIIxIxuN4OMY9lFnqakj3OcQA5vChL/2qa+DhkDAkEwqBKDwNv6eMol 779 gyvLbusIOxsPc9ejLPoXn4JEURtkInN6zUr2j9OVpQzjqaJx8lSwDS04i0fmUzqi 780 RzaCy3CKw2VQZyEfXmtbad2fVp7yXP/Bx2R0ddeCpj604PLPe0kxPFrdCIIVIg2y 781 CZmjcjvJJCWehiDHsmVvKVkfmthJmoS0qRLZ4Sc2AVQZwA30zc4hFEh6hECUBmS+ 782 v4Nlp1IOocSPLTW0nw2e/+I1+Y0nfo3wRpQMHNL5DHxhgRRa73IHKdpwY2dGOmw5 783 yKzJnhJAVoiTIy1CbK3Rfd7buuWTpOyL14AbFFfW9N2LP8QWYWi0m/fZs/z7MPVL 784 kTi63kzk7jHpOzxoy8Xzs5QlrDQlTaDrG8yqGmVTSxvvGhx243xonNja1A8TWaf4 785 5GBuZwEDyehmyclX+G49rz7PewVyXdJuUDgUKub+Y/RTKUh55oGpbNKNK2WLIYgH 786 XOQRVJa/VZJfc9IDqF9ZfPiyVCACx3tSzqeCzNW8n2bvppX68vpUT8V2FSFBVB6c 787 +VcBNJ5MdpatpqH0CaBOmfWmOBA8him76FSSQokuANZhI+wxGw8+mvcrJTpZnuVq 788 xndKasvJxpHfARrgTk8l5ijNXnxrGzWktMH3lWbhJciIPtw4DJhcO17dhoptJepS 789 enF+cpZXRoXY5HsiengdGpDgXP7aiWIgrdrWqr1ktzX8o94+EKeZrEU0WoWDZHo+ 790 gCjtLUwKH6f/oyex2dWfe8ABDyjat/WZRFwf8qpJuE5vbL50VDNbLEAMgGFXPuE1 791 ih/sgi7ZBcSmlY704dEpS6HMVcMGoMr3NPlLUruiYZanr3eYlWMd98C+FoJwb7Ca 792 RdDK/Ud1Q8E1GvQi+59cTBABLANiWPVsh7rWOLo4d84dJyiDcb2LAGNLxXN2uTXH 793 1oadAPHVOwYSe6H1B67tlFJhivuRcS/dumTFUW4hI4HGzpq+XwnQFY/qBwjZsf5T 794 fIQgJ9+3wEx7w/AXk0wR0l+ITKLauH10IQFd4BEvtTOaZZIbR0Wf3RvJLaKGMIIE 795 DwYJKoZIhvcNAQcGoIIEADCCA/wCAQAwggP1BgkqhkiG9w0BBwEwHAYKKoZIhvcN 796 AQwBAzAOBAjiGuDSkfG4UwICFLWAggPIqZnFK5vMsK5cy32va9aHXHjKzzCZf/Zj 797 5gFAAl2KMJZ04AyAFR8dLJxEGHUQgDUCgQklDf0RfmfxHjIPSaNirddpb96bJnkY 798 0EkNIo0rsAfV4errJwZ2zItFP+h4jVMYM6FerKGP1Cs6fWf4m8SWIIJ4afGhh2wF 799 vnGs4weTulxxosmxli/Y/l+OxeGfhhtiCtTkiX01WcPNO5vkSsTIrZgxMcdVV8PR 800 Vwvf0NgY5zS55pkNVlZSmmAfm5uwZNDd4Wgdb4tC0mBLaXxmsxjSxVJsxoA94tqw 801 2JkNo6jqRhyKpEJ+4cAH6e3YidKX7D0V51CItVBn+0GFHrEJzFkwtiaB7GYwBebZ 802 kKAILCFejgzV8iC18bvIFY7cRr5fo57+0M78SM/WrqmC9zbX5boQcwcaxR3cN7ya 803 wGcfZzAbRv+fViALCpARgmz9HnhNZ+PjFgfX7KrbyM7+NWILfJ6F9UTuwXW2OVTR 804 F4+WJaXry0pMC/0YHu+3Kbdf/J6hfgEPcjmeczFprMJPuWY1aoHySAGg4a+Ngb8h 805 OgvhvKQvh/HTgVDsVik2TWfDAgsS0NB61c1oi9fRLwuHOaK9jeR5I9i9/ZgI6K0g 806 xe/LgfRfVHr5awnO4akRE4G1Uh6cxwsQU3Bt2WOeXSO9jfofTfEaw7Tax5C0mird 807 GANd/5B14u5goMGRk3B1XOVq8G8K970rjGu2Zh8KCz4qGgWROvK+ee33K02gNii3 808 qQis0ynO5b1ylpEMrOf+GegUbYm9pccduN03zEpCwNPnIY05pV95IxGCWfIcOJbt 809 c23RnXfqQLAlNXn4nrf9g9sxtJ6iecVjCHoJXrNhyMLy2uF2/eJaM4WWlBR95pSP 810 DO2u2gI0aEfCYXAN1CkhvhKpm/Zl8QHG7tXc8//U1bhWgpmx44+bXf5T4hG29HpD 811 Zl9r/+CkbWJofF/86FqleyFEhiZ9cMfznKuYtvegMhDsQ4z/YUU/2U0/hEhsQVpF 812 YtCCxcrXzXmwXfZZ3JrgYxbfRzc6UG9jhvSTR0fvKPfVW03qRC4Hxy7AjMOxbADl 813 GCh/NiYC+h07b3GCsHuJdRh87JyeL+x5Y1DNgcJdIzwEIetB6cKPYOX4Na2kyInk 814 LgAfwZGAQTHN1IXB4gbYUnfuYgzSIc07AE13sxORgrfRWL/xRW8egWyDIVkHKITJ 815 rM9Zzid+sjkGte3RQKTPw+wYvPAbhprlB92lxeB+gKlODVe58ZnpUALzY9+BS5Tf 816 EbIOJiHcjlr3vGTUBLp/xhuHpkzdaPysQDqE5vYR5uIwggOvBgkqhkiG9w0BBwag 817 ggOgMIIDnAIBADCCA5UGCSqGSIb3DQEHATAcBgoqhkiG9w0BDAEDMA4ECEyHXPVs 818 ncxTAgIUQ4CCA2ivLIdvKuViOkHRZXgcOxBJkBxK2m0tDslwbMSITMi1KvQ7NVP1 819 NngNw19Hsql9SHXPzSk46aalvaxH34WRNXs2GtZrWOFb5XDwuxqNcTOxGaxVsavG 820 X5psJ3ubC907kWykkqKIKhDjny8NkY7K1UcacWI8OY86WGgOUjryK9oCzIjVcLGa 821 pt1fzimZqezwx3ArSbekOUoCkDxLpPYaTbqMcogcp93yTK3SvaemkzgtKIVnVt3m 822 6FDrihnUifcPzSrAUqZk3UfGeaELCP4Y9oIB5Xak4o1qI9h+eR82mzEKyoFfI0Z7 823 FjGsDhNXoldLPFYZIDdja9ZQya7X+0AmDoTWzjTqY/efDeaD26Z7E2Tkfdp34XY/ 824 3oDSKmggX8k48P+I1gWVTONmeIZm6i5iJs0nQJX0dsRfBgSXHvTjptejINuh8MeJ 825 IRiRA2YPtSqPSDAlcTC0HzEAlOMeZcKAfd/JbrXvgjK/MUDx1IRGgmUi5nKIaKpQ 826 YqZ8tTBvWSm86P+JhAlUH5RXZa7tnLsn3IAZ3sc7JnVmB1bIwVzNNLzZg5p4gk+c 827 2gvHWecLTkJLrdpESKKJX4xvLomD1x4TI+YlKpCjnbArImlO99BsDPCBliRsGx+u 828 OFuVWXzdgLBkz+UN+OMQs4pBhMGIFDA3Q7VrgXtbcik/LAWTECEhTR8Jf/d0xeaz 829 +d3e+VA7lZlyELr4pBlqelHD89a+8UtHPGR1esw3EID4h5nt1oP2S8nGGcyYwd4b 830 sX7AAXV4sozPIjSsyG1I9N7QYCY7b+Cyrdvy4JSGVa7vz+7q8IHs9K40lG1kKUv9 831 p7Y/w0vdfPWhT6+NZvlXsQknYBR3+IPXlHDsqwNB8oYA8xtYsy3SzBi+BZyLIiDa 832 SkeJ6RNxbjYIRBqPckCW6XmI02unKbiD0E2z919GjtI10hx6dzgdhAEDnzTJ0NYA 833 vT+v4W2dXDTmZeJD2EYb9r2GFFUErYsEKzBgRv21HmJlZMjk7lM+XbirRoSJb715 834 VrH+bRdYnBAOEiIamsND3wIq/LoZ4O/wQqeSY9eaza7qEtVzZ8d+r7qqCQkl8lQG 835 iC7Ce/VzaSZ8823m9LoMw2AX8Us/bdT5kR60w+WMYPrq5tky9XYLILuTh1bwTSps 836 AO4NH42IhpH2Tg+mmaS6M2MQzDCCBZgGCSqGSIb3DQEHAaCCBYkEggWFMIIFgTCC 837 BX0GCyqGSIb3DQEMCgECoIIFLjCCBSowHAYKKoZIhvcNAQwBAzAOBAiO/0ICbTbZ 838 LQICFOwEggUIFwT/JI8UjJQPfYTFonJEo8zEbpYWXKboqw6/zZsMGmAnUPgQNQDx 839 yuLVprs5jUc437kVB2M3F0x8DjmEppebtHfIoyjoXF7jdnA4EF38tsso0K1nMPmS 840 gl02iYZtOqsOvBpfeO5Hj4Ovhi26J9PzTwPcgl3QQPqfWv7CwgGVn4/hntBAriPS 841 E4gAlfAcqkxtJBm01QwDoAdsOKOMsYntgWajpr1J3Hm+34NPL04Usf1OpcesPUJ4 842 CBxNyLXxjjsOzD78WVvKY+N+j89xTsytz5Y0fEkFqrcl8pgBQxH72jBwSCm5YwHz 843 3BhWQgr2bpWJ1f2LWcVsnrN9tx6RhQtAAkcyNgX/ksp5EW4JTo+o6oXLRhXIYauR 844 rUrisMY++b8ZJTp6C1t0RW2QdqgMZghSZgaW6FSC6Dy2Dd/ezdkYUCgiEtq8eSxF 845 /8WDw6Va2iGVSNt4/p/OJ97yN5yOJ0K1g0hATebU+I3E74PQ9RK84FfJvyHDBC6f 846 vYZW/ouMcgp3YmAF+dTm74Hq88X4daV+/UPYf/cVpyiwcBTg6H3jrkrs0yKoWLIf 847 rIvMNBeeKZ+fl2Enw1MFzkLI4VGD/UeRwrbhN0SHkh5lIGtu0yRTfq6msYQpkw+j 848 r7QwJIdQyrAoaaVaRotVyvgTOLlHw8r6o7v36yoNov3kDPW7DfbSVTWX5lIyQn8N 849 qMwa4N1clWT8ukfZXSaYykFSqF3w5zala4iIhu03GjDcfiWLMUlYVAUcvSmcIULE 850 1oW7FKiJc8OadeIu0JBySRSEvf7B3w8leYUs+u/h1ptrZZKhe1JdAtlszvHJ0DD0 851 kMqA6Ig4yomscGSol/sRUqpecIQwVZTCRRq9dJOFJkKhKD5Eo9E0Z2snp01fpUF5 852 qlMeBjpYgkX7jhyFyvq+qDqBAY8izvkcruE69WooBVyorqKHURjWtY+rhzcB4+HL 853 72wZKzLnY3iUjJ1UANxM8mC9fpD1NJt/7epqzPyZ2Kd4GJVYi8sQpFKf4tRHDr0t 854 I5iUB78qj1EBp1w4qvRn/jC4ii7+Bas8mz/AJ25QeviC44Vj+eT2YYXafDivrmoe 855 BuVMIBbD066YnuBC2CeKydNWdiARzc3IfhcuhVwq7riotYfyDqd4e0Jy7Y57pbwv 856 4Qwz1yCxRjSwiFQ7/fRa2Cx8xtxKcC/A4LGnXAKISy+uNbDWA7AYaP6RmGgMCaNi 857 Xy3F1zvxnE3bv68tXRF9vjuEChUq56N6992qhoBuHP0J/mRItw+JoI4m/OFnEUGT 858 3bNyxpEFyA7aXBE91aQdSXl4a97nC0/RSFH/fRwPFYgxr3XdCIf3Cw5PDs25YNsX 859 WCsDCVejWMFrwOzmDwa8sBkY270+rGv76qXvb/uGD3M2C+DySVy55Zd42wjghSez 860 gY6taT0tqKfLOS6Vl4ELU78Q6va2o8MlcUdi343tOi60MZgCDUwPP8TjKZINh8u1 861 KNhzgpwNLz1gE0dd200l3bbzdZ6uio3R52WQWRCk17Z9lUesCJavytcAi0mMefMx 862 BPMOdnUi6O8TPDRA0mcohbE5rybwDXAoB/VUbwgM0/qCpZ7VcSKN1lUuoe9+Kho0 863 NK/gyMEvntMxGNNI8arV8UkeFollPhrtumvdwqbVCeN8TBj5vXo6Hu+eKB7AVwjB 864 k/rRHpZxnnVGXbm8HzM+kjib2cY1diusVRJ/1+Q9GXuo135tQbobgcMzAmqAqZp9 865 kDE8MBUGCSqGSIb3DQEJFDEIHgYAYgBvAGIwIwYJKoZIhvcNAQkVMRYEFEqzrDFT 866 AkmcTeNueeAlYZU+iGIlMIIFkAYJKoZIhvcNAQcBoIIFgQSCBX0wggV5MIIFdQYL 867 KoZIhvcNAQwKAQKgggUmMIIFIjAcBgoqhkiG9w0BDAEDMA4ECCNi2K1bMEiBAgIU 868 dgSCBQDLIXo4ExcyE8+4aiZIj/Wnh/SVVVR0n7s4PGCbXt+VrOHd9YzTuUicAqIc 869 HH62dv7NSy+fgqZG7SmVR1IodadFe+5usAzXoyyhhEe2c+ToeVbr5rs+vBvQUyh6 870 X5XTV5QVOAkwSyKGjyfdy86x1Q8cL2D2BM+Rpkm1cFtjgWcB46U6S6w50sG7XOKS 871 CMI4a6rnHPVgPPdXMrj3VSPJY8bhBqEDPVTnfSHf/wKZrIi54O3F33B5jt6Cm9+9 872 m9Fed8n+81w59rRom72CY9Xii/ULER9THwjxOZOQ+dIml23KauwexuOGjii0UR8M 873 eM/A0n7UNys+bZTulgdpWW/mDhJ+eLATnhJw5ro/AWa6YVXG+t5k9LjdJ1ZmqS4b 874 JxvBwilpEGoh0MM6Yp0dr1XM4mT/E0JMWD458Ngs05CuCpwAUXGdQmgrVsFrrV0H 875 TyHeVLDhe43J3GI6HCWJVOeDQzzmaO3AM+IooRDkTHnJMaxUXphKTag5+f/smNYE 876 hzVjZeIc8GFZ36eSI4BNGHSXFACwLu2ThkzpXMmg50JAUhBYxqE/fVevLUH4JPLg 877 z869wk8gRlUBo6ihQGrnsx7ZO5IsYahEYjz0N05PVPJYMLSyMovG9i+LpzQ49gIB 878 zPu2fdLR41u5n5O5mG1Y4aJ7OCJxMORYhWHuctHdGdpJsgiq8+1iiUwmfyCfb0ZL 879 3ePMU+W0zkAsyn22aK8jDBLLVZlvOZIVqR3Gx4QFPSk6qCMQ0E58VkMUMxYvClzT 880 wSeEMu66eND/AKTE+XXV/d9bmSmWGk7Y8XrDKLKfmRdrlIeondVJv5mk12YKxBPQ 881 GeUqK5XJUa2dzH9zvfEX8iYzdt4281QCiXJ3qwmbT+8RoOLBt4KyOs2e2ZSZnjrL 882 9OO4oUsHIOyEfjwnWoLhKbkmun8GJxoB2yCzTawVQf9/qIUXaSzcp23AV6Lf1k9O 883 f79HYPW3cQJAtjf6XBVE1xVZPkfTuC3yVLufljs2ed/ctpHg9nuId/xHFH7t4Hbm 884 U3/ZufE1GHnsRQ3kbnqA5WXerd9UzeoDaVDjFXGrITp8env08GXYvwWGXLL150l0 885 DuJSv1E+1yww86SNjBYUTx0r0CJjjTk27vIUhAYUEA+J71IeifqqPDKYXnrCdUEa 886 jbfEdek30WiLR+ChEvEp48Mla6UVTLm/mjziwbsxm5QlGccmz13e32RiyrfseB+R 887 yllmzeJtydP2IHkWK7pww9yOlPK0QtZs66IGZKqeXrWBk9QFYDX42gAy/xTfglco 888 4KO7akhp3UzTIQyTXnt+OsOScc+ArVm/dwClm+ZxybtOcVyadjpKWydyfAr3aTkG 889 xX6RmHrEWr1R9BnMGPYesDs+yeVNs1QdDhff/bQLwCLXdGLWwLe6kitUiyi8F3bd 890 fPjR7R61lEUvJrBm7YLmgdxRCJ02LFLGn09iSMNe5vmiNaKiuzfb4Dp9dqEMhmJf 891 dsTURagfJIyqULoe08EIIozahivbzoWVA6oPAkk2D8DnTiMegX4IZ/Zb3LPxJKAe 892 XO3Ys1YQrNSNZ3B2ZISBapzGzhFZfRVzPOmXhN53pDhlxkw0btkKblYA9CvP+kzg 893 wekzCy/Mlq/HbO38CV1NKzay3yg4ntehJ+v9/k7gaqKmo3ZWMGk0WGBv/GFxYhme 894 Nd14Y65D9TlypM/zrXSyGoOqZgSA6HlAgogzwwSaGwx9n/o6czE8MBUGCSqGSIb3 895 DQEJFDEIHgYAYgBvAGIwIwYJKoZIhvcNAQkVMRYEFBfFhHvQp+92kDi4s28IvJK1 896 niuUMF8wTzALBglghkgBZQMEAgMEQESULk1nPh/xbTET83QqxpxbEpCxkvY1zrpc 897 aWzzbehThKle6bJRDM3zlpr0dHs8Qxs3ocSpAQ1XOXjuXlqFfKsECJ1vqXe6ro0F 898 AgIoAA== 899 -----END PKCS12----- 901 6. Example Ed25519 Certificate Authority 903 The example Ed25519 Certificate Authority has the following 904 information: 906 * Name: "Sample LAMPS Ed25519 Certificate Authority" 908 6.1. Certificate Authority Certificate 910 This cerificate is used to verify certificates issued by the example 911 Ed25519 Certificate Authority. 913 -----BEGIN CERTIFICATE----- 914 MIIBcDCCASKgAwIBAgITGz6zL8fCL93bElmwkKaEVA49zzAFBgMrZXAwNTEzMDEG 915 A1UEAxMqU2FtcGxlIExBTVBTIEVkMjU1MTkgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 916 MCAXDTIwMTIxNTIxMzU0NFoYDzIwNTIxMjE1MjEzNTQ0WjA1MTMwMQYDVQQDEypT 917 YW1wbGUgTEFNUFMgRWQyNTUxOSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwKjAFBgMr 918 ZXADIQCEgUZ9yI/rkX/82DihqzVIZQZ+RKE3URyp+eN2TxJDBKNDMEEwDwYDVR0T 919 AQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwYAMB0GA1UdDgQWBBRropV9uhSb5C0E 920 0Qek0YLkLmuMtTAFBgMrZXADQQCpSPkvILHd5nLh+YT34REF0VVphNaxdw1dnx/J 921 7BGYvgKOObND0sqpkpc1neTiIi9gdfs5zSIak6TnVDdiuccK 922 -----END CERTIFICATE----- 924 6.2. Ed25519 Certificate Authority Secret Key 926 This secret key material is used by the example Ed25519 Certificate 927 Authority to issue new certificates. 929 -----BEGIN PRIVATE KEY----- 930 MC4CAQAwBQYDK2VwBCIEIAt889xRDvxNT8ak53T7tzKuSn6CQDe8fIdjrCiSFRcp 931 -----END PRIVATE KEY----- 933 This secret key is the [SHA256] digest of the ASCII string "draft- 934 lamps-sample-certs-keygen.ca.25519.seed". 936 7. Carlos's Sample Certificates 938 Carlos has the following information: 940 * Name: "Carlos Turing" 942 * E-mail Address: "carlos@smime.example" 944 7.1. Carlos's Signature Verification End-Entity Certificate 946 This certificate is used for verification of signatures made by 947 Carlos. 949 -----BEGIN CERTIFICATE----- 950 MIIBqTCCAVugAwIBAgITfTA2/ZV2DbKUTmbWgsuSzBMGCTAFBgMrZXAwNTEzMDEG 951 A1UEAxMqU2FtcGxlIExBTVBTIEVkMjU1MTkgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 952 MCAXDTIwMTIxNTIxMzU0NFoYDzIwNTIxMjE1MjEzNTQ0WjAYMRYwFAYDVQQDEw1D 953 YXJsb3MgVHVyaW5nMCowBQYDK2VwAyEAws6AMizeYchNhE1g75Gc552urn8e5Add 954 I/IAppL3yK2jgZgwgZUwDAYDVR0TAQH/BAIwADAfBgNVHREEGDAWgRRjYXJsb3NA 955 c21pbWUuZXhhbXBsZTATBgNVHSUEDDAKBggrBgEFBQcDBDAPBgNVHQ8BAf8EBQMD 956 B8AAMB0GA1UdDgQWBBRkheM7nB1azeYLuhp/CL7EnMyEPzAfBgNVHSMEGDAWgBRr 957 opV9uhSb5C0E0Qek0YLkLmuMtTAFBgMrZXADQQDHbvRfqrivP1YFE1vR4s8IxQba 958 mPgWm+bh1bz0WQZEJx27+HXSwcQq1OaigzpNX5x/8fXy3Tdfyh/syZqkGwAD 959 -----END CERTIFICATE----- 961 7.2. Carlos's Signing Private Key Material 963 This private key material is used by Carlos to create signatures. 965 -----BEGIN PRIVATE KEY----- 966 MC4CAQAwBQYDK2VwBCIEILvvxL741LfX+Ep3Iyye3Cjr4JmONIVYhZPM4M9N1IHY 967 -----END PRIVATE KEY----- 969 This secret key is the [SHA256] digest of the ASCII string "draft- 970 lamps-sample-certs-keygen.carlos.sign.25519.seed". 972 7.3. Carlos's Encryption End-Entity Certificate 974 This certificate is used to encrypt messages to Carlos. 976 -----BEGIN CERTIFICATE----- 977 MIIBqTCCAVugAwIBAgITqKfyfNYXEMyA0hgjaMFYQldVQzAFBgMrZXAwNTEzMDEG 978 A1UEAxMqU2FtcGxlIExBTVBTIEVkMjU1MTkgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 979 MCAXDTIwMTIxNTIxMzU0NFoYDzIwNTIxMjE1MjEzNTQ0WjAYMRYwFAYDVQQDEw1D 980 YXJsb3MgVHVyaW5nMCowBQYDK2VuAyEALmgxzNMgyJ11NRhNz9bKYSpfDyFmbVBs 981 jPbFfaAUPHSjgZgwgZUwDAYDVR0TAQH/BAIwADAfBgNVHREEGDAWgRRjYXJsb3NA 982 c21pbWUuZXhhbXBsZTATBgNVHSUEDDAKBggrBgEFBQcDBDAPBgNVHQ8BAf8EBQMD 983 BwgAMB0GA1UdDgQWBBSBKaD6I6BLIIwNeADe7doWyzQluTAfBgNVHSMEGDAWgBRr 984 opV9uhSb5C0E0Qek0YLkLmuMtTAFBgMrZXADQQBAEptLosUVLmgSGgX/KBtx6end 985 0GlzlW+uz/tkIV0FlqKwrOXt3ixbQJ1dTWBnKdpxKxOwwJrfn5/01YgzUJ0E 986 -----END CERTIFICATE----- 988 7.4. Carlos's Decryption Private Key Material 990 This private key material is used by Carlos to decrypt messages. 992 -----BEGIN PRIVATE KEY----- 993 MC4CAQAwBQYDK2VuBCIEIIH5782H/otrhLy9Dtvzt79ffsvpcVXgdUczTdUvSQsK 994 -----END PRIVATE KEY----- 996 This secret key is the [SHA256] digest of the ASCII string "draft- 997 lamps-sample-certs-keygen.carlos.encrypt.25519.seed". 999 7.5. PKCS12 Object for Carlos 1001 This PKCS12 ([RFC7292]) object contains the same information as 1002 presented in Section 7.1, Section 7.2, Section 7.3, Section 7.4, and 1003 Section 6.1. 1005 It is locked with the simple five-letter password "carlos". 1007 -----BEGIN PKCS12----- 1008 MIIIxgIBAzCCCF4GCSqGSIb3DQEHAaCCCE8EgghLMIIIRzCCAm8GCSqGSIb3DQEH 1009 BqCCAmAwggJcAgEAMIICVQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQMwDgQIwS3R 1010 pT1mkyMCAhS7gIICKKwyttinvdBY3pNtMUJ4/G6tE8tBny4Xnh5vONwv0SU1nPzN 1011 NKDPjaanMtw61VEFsQTJOTktIeNVV8uzT1a15/A9ax7U+70Mw3zwiXsyzMxEd7ry 1012 Qmj7djYjx5xQ+UsnBgzrjapUSYmryDvYqEuig27O9Q8zaxdMd/wep3OGeaa4jrXo 1013 dEW3iXBEkjH0wvCc9FV72z5AGMQzvz1dGC+cjSeJyvNvcfqkifhpPCmdM1Wltj1J 1014 aejep+P21+yZRle9mDYSgiwWOzMcOD7hLYOEo81CvNmPtoYjctm3L7okSwS6lVoA 1015 pDLoIumlHgvA7jMWOUM5VkW5ONrPREB3uSQnP2CoKJjmTYQ1VupJl9/Gfltj3O5c 1016 eX5/gsU8q/G0Bti9hpEV5Cu83hnz6Zrb2LzIu0TpyYsjslUUs3vkG5fTBkCcjWkM 1017 R40VTz5kxL16U1px1cDGQ50Fa1qISXMzBsXV38gSGIU/qcUVPtuTZzNckFrcQDLs 1018 4IxjUO+ijnh5oHEHdeSBM9CWzMsq/agNihb0dO4uC/VLtwh+TxLiTOrMLrAhIpqx 1019 NUDo8jyYhn0/GQNQJHBgSn2GIoUpC5CLOBGw37LxXqvJqNeuZ378mTO1xbc10MTo 1020 TBW5aZkNZPJsx59msjJVXZjTr3qZ7AephyEWJEJIyJbzNVbvLP+qBWzie4avydlJ 1021 fpYqjoWQxsJBcY5vjVDl7ofF5kgRLZkz++GWPMYACfgqf5ZcMDCCAk8GCSqGSIb3 1022 DQEHBqCCAkAwggI8AgEAMIICNQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQMwDgQI 1023 4zNcyy17/xoCAhSUgIICCO+ILkjMy7C90J/ATzaSEgL69GkwwyuZbTo/YwY2fq/E 1024 NNrBt/RMcgRLgNAWw/QpFI9QhwjAicFscq9V7NXPpVCd9x/cX0qbx+EA9k3UdSBJ 1025 NyF0rOX0ZkrXJAUuu8aO41DaSpbUshJhh5hx5MRqbANlaT+1Q7D+k9vz3zcpO3wx 1026 zyHqNYxmZ+x1ExxiCxmLTxTwLHsJnFMamYuP7fBT5A34iYZdtVwotA/ussPx/HXP 1027 n+KAXt1QQyvEb7kch9nJEWAmuCjdpIvf2AQCTSHp+WnDB/Tg7pEw8RT+HIcAwbXd 1028 8AfhZmncDCOmNKe+4HPrp8R5CXwz7tpOqo/EqC5x36ak94RQXh7QM/r7thL68d1U 1029 VL9Vx7LnRLjsQAedSHXrKyYShluzTLbJNHLDVnYBT1m1WyO0mDRm4Y0SLUiJ+Lud 1030 AeKlVMJV6H+BeyxsXBSRQu5BHI8XhO/gQh00dmXTT9plqZ7V44qRHpYqeeoHYzZO 1031 G8gPoCQ+AXCWmrctugcDu09tgbpGkDOFI+J0mAJz/E3vkHJ7T92TXj98Bf/zlKEX 1032 AQGvaxCI5FpT224x0DBF/z6ZxWKZortuaxPhChBqrZ14qdBVdnXpgdoFUY9SLAn8 1033 hthwn93in0IFHHdjRgaxR3c0TE0a28xwQpvI17w5t/Vl+WGQ8GHmPAzFUDLO33oE 1034 mn2FmWVjMWswggHvBgkqhkiG9w0BBwagggHgMIIB3AIBADCCAdUGCSqGSIb3DQEH 1035 ATAcBgoqhkiG9w0BDAEDMA4ECGj2DS1DJhO/AgIUgYCCAaiPztSEqZVM6ghfLfK9 1036 UFKypTE38W/ozxw1QDOKxETQplu8iDrsYI54EbU1w6g6vWxrhHvIcJEMPbnUX7V2 1037 DQwyi/Hd3ad0EdQ45kGb7mNciltIuDGPrFrBqsPEx4hDJGjePIvgEXDpj8szxJwQ 1038 wq9WbdPq2pH7uD4Va9+HbeJjRTP7CP8ceGAO77zfAU1MZl7n+ydptAwVN3Ex9GGc 1039 jbs0yocOXheRDYK8U1Hl22UjQ5OtXA83DID8QeLr+NNFIlwcYJEPM5kxKnBIcngP 1040 utB3SLz16w8eap9yfHuVwdr1dI6rn93dcFix2ympTJnQLNSVEPZS62cydmWOYKUo 1041 LyhuYfM7ZnuI1vOWl932pgkIHdplfkmygB+OE5w9NXhv5En6tqtISNdJcpfB65as 1042 E8orGVDrQeao9E2mVTAFgiHHLCKcsbL4n3OwG83I0fzEja6yLyDzu/hGyMh/Jyuf 1043 rcJGgMWrn2/+2TVzTVUcvcTFsypfaPAb6UkEvt5h+2xatZMnJC5CkBY+yzc3ahqN 1044 GtgFtEf7RdDZK12+IA1qxrRkNSH+DE57xFLGMIHEBgkqhkiG9w0BBwGggbYEgbMw 1045 gbAwga0GCyqGSIb3DQEMCgECoFowWDAcBgoqhkiG9w0BDAEDMA4ECA2F84MR3NKt 1046 AgIUXQQ4ISoWJ7Wl6JxL05Jc1CMvBs3eQ7yVgzYep5JmgQonglIWVXWRZbfHB+7l 1047 pkqsYRgF8Yx3yt6dGKMxQjAbBgkqhkiG9w0BCRQxDh4MAGMAYQByAGwAbwBzMCMG 1048 CSqGSIb3DQEJFTEWBBSBKaD6I6BLIIwNeADe7doWyzQluTCBxAYJKoZIhvcNAQcB 1049 oIG2BIGzMIGwMIGtBgsqhkiG9w0BDAoBAqBaMFgwHAYKKoZIhvcNAQwBAzAOBAg0 1050 VyogQx931QICFLUEOBmu4SxJoFj4Kb1YpHweEfcleH4CgxKvCQMIrK1a34w0hcHS 1051 NjZBkcNs3e4WfuofDTowO2GcqeJrMUIwGwYJKoZIhvcNAQkUMQ4eDABjAGEAcgBs 1052 AG8AczAjBgkqhkiG9w0BCRUxFgQUZIXjO5wdWs3mC7oafwi+xJzMhD8wXzBPMAsG 1053 CWCGSAFlAwQCAwRAit56S2r7yFrpjMaCK3ybG63nQrjdqKEIHQZSMvr4UmbA6u1n 1054 tadRca4edJMDRdUIRFckfpa1qHI9YWBWGP4TFAQIkONpmR/LgWcCAigA 1055 -----END PKCS12----- 1057 8. Dana's Sample Certificates 1059 Dana has the following information: 1061 * Name: "Dana Hopper" 1063 * E-mail Address: "dna@smime.example" 1065 8.1. Dana's Signature Verification End-Entity Certificate 1067 This certificate is used for verification of signatures made by Dana. 1069 -----BEGIN CERTIFICATE----- 1070 MIIBpTCCAVegAwIBAgITpJvJ/RfYIwaHOq+JHuYw2w0HKzAFBgMrZXAwNTEzMDEG 1071 A1UEAxMqU2FtcGxlIExBTVBTIEVkMjU1MTkgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 1072 MCAXDTIwMTIxNTIxMzU0NFoYDzIwNTIxMjE1MjEzNTQ0WjAWMRQwEgYDVQQDEwtE 1073 YW5hIEhvcHBlcjAqMAUGAytlcAMhALLaHeGGRooNjrs+4K40ueetCId1JZik+WAW 1074 w6J/zm+uo4GWMIGTMAwGA1UdEwEB/wQCMAAwHQYDVR0RBBYwFIESZGFuYUBzbWlt 1075 ZS5leGFtcGxlMBMGA1UdJQQMMAoGCCsGAQUFBwMEMA8GA1UdDwEB/wQFAwMHwAAw 1076 HQYDVR0OBBYEFEgDhsFpuHhtrt7zzAawM6xXMt2WMB8GA1UdIwQYMBaAFGuilX26 1077 FJvkLQTRB6TRguQua4y1MAUGAytlcANBAO1JTk7QtXn5yCwgjVRYMzwY6vCaxR0v 1078 yNVq04iiXCADZWNyeBt2rvpTwJ0j5ky5/OzJygrhSmkxoi1ySsvypgw= 1079 -----END CERTIFICATE----- 1081 8.2. Dana's Signing Private Key Material 1083 This private key material is used by Dana to create signatures. 1085 -----BEGIN PRIVATE KEY----- 1086 MC4CAQAwBQYDK2VwBCIEINZ8GPfmQh2AMp+uNIsZMbzvyTOltwvEt13usjnUaW4N 1087 -----END PRIVATE KEY----- 1089 This secret key is the [SHA256] digest of the ASCII string "draft- 1090 lamps-sample-certs-keygen.dana.sign.25519.seed". 1092 8.3. Dana's Encryption End-Entity Certificate 1094 This certificate is used to encrypt messages to Dana. 1096 -----BEGIN CERTIFICATE----- 1097 MIIBpTCCAVegAwIBAgITC+vfipqj1grZL8ViMpnNj1gd6zAFBgMrZXAwNTEzMDEG 1098 A1UEAxMqU2FtcGxlIExBTVBTIEVkMjU1MTkgQ2VydGlmaWNhdGUgQXV0aG9yaXR5 1099 MCAXDTIwMTIxNTIxMzU0NFoYDzIwNTIxMjE1MjEzNTQ0WjAWMRQwEgYDVQQDEwtE 1100 YW5hIEhvcHBlcjAqMAUGAytlbgMhAOAxojYBaRT0sbwK9pEeANIRj13vZjwQ1l4z 1101 CJs+6CRUo4GWMIGTMAwGA1UdEwEB/wQCMAAwHQYDVR0RBBYwFIESZGFuYUBzbWlt 1102 ZS5leGFtcGxlMBMGA1UdJQQMMAoGCCsGAQUFBwMEMA8GA1UdDwEB/wQFAwMHCAAw 1103 HQYDVR0OBBYEFJ3fTdQF75rsYIa8J20E6c5a3I+kMB8GA1UdIwQYMBaAFGuilX26 1104 FJvkLQTRB6TRguQua4y1MAUGAytlcANBAD5H9BEI9UMNr17ZTPgcUqP7Lj4LYpmm 1105 AMjqTuul+fQWupaq81D3eqKH/+I0xBgU7tOm5daFOcylUECUppIxIgk= 1106 -----END CERTIFICATE----- 1108 8.4. Dana's Decryption Private Key Material 1110 This private key material is used by Dana to decrypt messages. 1112 -----BEGIN PRIVATE KEY----- 1113 MC4CAQAwBQYDK2VuBCIEIGxZt8L7lY48OEq4gs/smQ4weDhRNMlYHG21StivPfz3 1114 -----END PRIVATE KEY----- 1116 This seed is the [SHA256] digest of the ASCII string "draft-lamps- 1117 sample-certs-keygen.dana.encrypt.25519.seed". 1119 8.5. PKCS12 Object for Dana 1121 This PKCS12 ([RFC7292]) object contains the same information as 1122 presented in Section 8.1, Section 8.2, Section 8.3, Section 8.4, and 1123 Section 6.1. 1125 It is locked with the simple four-letter password "dana". 1127 -----BEGIN PKCS12----- 1128 MIIItgIBAzCCCE4GCSqGSIb3DQEHAaCCCD8Eggg7MIIINzCCAmcGCSqGSIb3DQEH 1129 BqCCAlgwggJUAgEAMIICTQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQMwDgQIZNqH 1130 TA2APx0CAhQXgIICII41QoooyUFqZ/fDWmgn1xEzYA0oJmBoFCl8uyXfZ/0yP63q 1131 EYmGtmplf0qtFoI9tG1k0yKnmYY4xACo8Vy12BxSY62YfDv/2Uk+R4vNsyO9IwDR 1132 rR4LF1rvYOlj8VNbIovXp2c1RUZW7QZKL/qVb5V9hNL80mKk77TteeFFKvDBYPyw 1133 DYUBr+CP5gbMi71DwePoXHN+Rd6hHFFrUBhFVEUlXgCTs/rgsN+WJ3Wx1SK44xel 1134 MyP9PzrMO5rnZDnP1pPsanIB/Zl5xDKbg/lg19St+dnnaHr3Le5knMRcc48PZ/r8 1135 0bSaEQ2TxxUbdVQoshPtpoJ20EMgD0omRYZNYBB3ukj2j5c2gHCAsv+3cRKYZbpn 1136 37N0MreFTdVyx7KKXKUz9pyVk7TDxtseq4uF/tZzo2QTe0aWoVAsapcu9Ypc4OW+ 1137 r/EehKR5MxPoNxa9eKIZEmDPU6ZnNRhnJG3QB63zAZ9ojY72PgvNOMrrKipCI4Jc 1138 irJ7KK5hOLh7ScsFaYnZnVwfdN5Vw6os4VxY51uW6JOQuCaCZtB6ypEe40DCPevd 1139 ej+YYm4qCxGnbiS7lf2yBkoYsmmz9yGCePvkHLpdYL3yql12Ti8cEV1hyQP9manq 1140 ye4OvnlHKczGOIeE3sHipkjTyAqo+uSDy2/TMZU6U9Wpq5FcrmOIs3HHFaEKWq7N 1141 oIVLEGgVcvgyL9hGrb5WsU71e6JgeZsZ9jL2QigwggJPBgkqhkiG9w0BBwagggJA 1142 MIICPAIBADCCAjUGCSqGSIb3DQEHATAcBgoqhkiG9w0BDAEDMA4ECPG6iJpJkNuf 1143 AgIUf4CCAgj/MCKXWbtp1qlHufYRzMhWeV3BaYoisKS4N0I+MYEv0VpHKLGp8e5v 1144 CtkuWnuY3WJ6Mqn5F27MIGyjoimcoeQboApOgVYu+QZbwWX4HV7jPfByE3DX1Ll5 1145 7irBYXUaoGzqBspDsmancqL7LHr/HJszKpv7kSTKiRpHvqdcg3RtD+AetoZxrYci 1146 zmfcBONW4XDyTDKM4sSyypMrSjiO/huGjg4TXQQYLbxOxUo+RH7JWzTH3RLHhH/w 1147 /+RHKXvym7uRm+oSlXkffz47VyA348w7+YADMCxeujG+NlBikGJEc53R1xGuiVjI 1148 8aButCifePwyQ65/m+jklMOqIrq2M12mh9z6mtT6kYqZjcKxwV+rEib4TX48+HOt 1149 2vp9r6o41+ulLu9f2P/EJka86biQU0MbWA+cd0JXpDm7CgVT/c7opob3Fs3fM1BH 1150 Sh8g8moOIAI7EBfkxkymrgrCBptm74W6AxQGAgYFrNWBHunFer4DnE2rhDLxFvZg 1151 X2c1VJPfhKDM9lt7vksoAttmXNWY1UuCBqGipH11qe7txE/tgAZJF51owRvFGOLQ 1152 7dCFH+cyS55UIJPhuFgUR7qskzrrh5SyWuBdMDSgyf7z+Jo86mBQEtwIsT2erqGf 1153 z7fqo1TFyK2HpTr1FsTFjhNq4cXBQB2Red7f6IuK9/b6A6soKwpApjE3Uoymc3MK 1154 MIIB7wYJKoZIhvcNAQcGoIIB4DCCAdwCAQAwggHVBgkqhkiG9w0BBwEwHAYKKoZI 1155 hvcNAQwBAzAOBAjnyf7N2H+W4AICFJ2AggGoGREGUW0ANjBShA7junSDi0+1a3uu 1156 PVz1O2L0eWnKISTivDOBDjmhkAwoMF+RSaTqc0eFz4yCEiMdBEkO/Uk3+R5HCOGr 1157 tKh0sMh1Ti8dPEPbXcwVvs7vUuXx5iAMAMN2BP2/4DTB32XMCHwFwTHyTFkQcsdI 1158 4GtpnP9YsusabQWaD2YjHKZnNTP1LBKrllhxEyUK1zB39rfQkRtM6X/2cpO/rKjH 1159 NEKW0QQIzx4jrrf93cbXGMZy7ZZWygkbS8SNfe6ztvR3/AAU03PD7b9GfMSHW0gN 1160 6HAHuRX3U6STB3kGUB0u80+Ff4OHIRf0gTwfXjj0RW1cJ+T+mpJfsmgycVFSNn4r 1161 ThuIwSSHWB/dJguhj1pd2kldHS90T3xbcxxQPru41HIRpc69BVPmdgsywt285Q1A 1162 IkR0laF7yTn7j0mNCkFjgiUPyUh0B6oziqa6bPFX33v9vbIkvGEH/xiyH5KL8NVn 1163 e+SJqOqo5Ldz+VwuVjRVaJKYRiEIwG/igukbZELynt+n2ab7MQBwaF7szah6rgoJ 1164 9siHtn2qqcLH/yFSpa31l+zmrzCBwAYJKoZIhvcNAQcBoIGyBIGvMIGsMIGpBgsq 1165 hkiG9w0BDAoBAqBaMFgwHAYKKoZIhvcNAQwBAzAOBAi9gc9b1vmGZAICFLoEOGDs 1166 hI5HudzQ7whUdHIlB2e63n/f8D8eU4Fd6sxoX0eGz9q3aYjrfYQB1SuXJlAEe/sI 1167 wCYmHS1EMT4wFwYJKoZIhvcNAQkUMQoeCABkAGEAbgBhMCMGCSqGSIb3DQEJFTEW 1168 BBSd303UBe+a7GCGvCdtBOnOWtyPpDCBwAYJKoZIhvcNAQcBoIGyBIGvMIGsMIGp 1169 BgsqhkiG9w0BDAoBAqBaMFgwHAYKKoZIhvcNAQwBAzAOBAhcO/FJPCuuLgICFPoE 1170 OIndI0W9ychDOX3aWnkEfmBHjJ/mOSmr6ZVQ+R7YEEGPYYaaW0KhuGn+ymPjE+sb 1171 rOqDREHiQBOcMT4wFwYJKoZIhvcNAQkUMQoeCABkAGEAbgBhMCMGCSqGSIb3DQEJ 1172 FTEWBBRIA4bBabh4ba7e88wGsDOsVzLdljBfME8wCwYJYIZIAWUDBAIDBEBIhL6p 1173 HFTK0hwRZDyE3YSCZQkqqfjtQ5Af5bMNXzoKrBwKyiIFjaLjzqOHsXjZfvpYFn9l 1174 SfA4Br7bcbT0GhQEBAguQ5JM5djJbQICKAA= 1175 -----END PKCS12----- 1177 9. Security Considerations 1179 The keys presented in this document should be considered compromised 1180 and insecure, because the secret key material is published and 1181 therefore not secret. 1183 Applications which maintain blacklists of invalid key material SHOULD 1184 include these keys in their lists. 1186 10. IANA Considerations 1188 IANA has nothing to do for this document. 1190 11. Document Considerations 1192 [ RFC Editor: please remove this section before publication ] 1194 This document is currently edited as markdown. Minor editorial 1195 changes can be suggested via merge requests at 1196 https://gitlab.com/dkg/lamps-samples or by e-mail to the author. 1197 Please direct all significant commentary to the public IETF LAMPS 1198 mailing list: "spasm@ietf.org" 1200 11.1. Outstanding Changes 1202 * Cross-sign between two sample CAs ? 1204 * Add SMIMECapabilities (RFC 4262) for X25519 certificates 1205 indicating supported ECDH schemes, as in section 8 of RFC 8418? 1207 11.2. Document History 1209 11.2.1. Substantive Changes from draft-ietf-*-00 to draft-ietf-*-01 1211 * Added Curve25519 sample certificates (new CA, Carlos, and Dana) 1213 11.2.2. Substantive Changes from draft-dkg-*-05 to draft-ietf-*-00 1215 * WG adoption (dkg moves from Author to Editor) 1217 11.2.3. Substantive Changes from draft-dkg-*-04 to draft-dkg-*-05 1219 * PEM blobs are now "sourcecode", not "artwork" 1221 11.2.4. Substantive Changes from draft-dkg-*-03 to draft-dkg-*-04 1223 * Describe deterministic key generation 1225 * label PEM blobs with filenames in XML 1227 11.2.5. Substantive Changes from draft-dkg-*-02 to draft-dkg-*-03 1229 * Alice and Bob now each have two distinct certificates: one for 1230 signing, one for encryption, and public keys to match. 1232 11.2.6. Substantive Changes from draft-dkg-*-01 to draft-dkg-*-02 1234 * PKCS#12 objects are deliberately locked with simple passphrases 1236 11.2.7. Substantive Changes from draft-dkg-*-00 to draft-dkg-*-01 1237 * changed all three keys to use RSA instead of RSA-PSS 1239 * set keyEncipherment keyUsage flag instead of dataEncipherment in 1240 EE certs 1242 12. Acknowledgements 1244 This draft was inspired by similar work in the OpenPGP space by 1245 Bjarni Runar and juga at [I-D.bre-openpgp-samples]. 1247 Eric Rescorla helped spot issues with certificate formats. 1249 Sean Turner pointed to [RFC4134] as prior work. 1251 Deb Cooley suggested that Alice and Bob should have separate 1252 certificates for signing and encryption. 1254 Wolfgang Hommel helped to build reproducible encrypted PKCS#12 1255 objects. 1257 Carsten Bormann got the XML "sourcecode" markup working for this 1258 draft. 1260 13. References 1262 13.1. Normative References 1264 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1265 Requirement Levels", BCP 14, RFC 2119, 1266 DOI 10.17487/RFC2119, March 1997, 1267 . 1269 [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., 1270 Housley, R., and W. Polk, "Internet X.509 Public Key 1271 Infrastructure Certificate and Certificate Revocation List 1272 (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, 1273 . 1275 [RFC5322] Resnick, P., Ed., "Internet Message Format", RFC 5322, 1276 DOI 10.17487/RFC5322, October 2008, 1277 . 1279 [RFC7292] Moriarty, K., Ed., Nystrom, M., Parkinson, S., Rusch, A., 1280 and M. Scott, "PKCS #12: Personal Information Exchange 1281 Syntax v1.1", RFC 7292, DOI 10.17487/RFC7292, July 2014, 1282 . 1284 [RFC8032] Josefsson, S. and I. Liusvaara, "Edwards-Curve Digital 1285 Signature Algorithm (EdDSA)", RFC 8032, 1286 DOI 10.17487/RFC8032, January 2017, 1287 . 1289 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 1290 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 1291 May 2017, . 1293 [RFC8551] Schaad, J., Ramsdell, B., and S. Turner, "Secure/ 1294 Multipurpose Internet Mail Extensions (S/MIME) Version 4.0 1295 Message Specification", RFC 8551, DOI 10.17487/RFC8551, 1296 April 2019, . 1298 13.2. Informative References 1300 [FIPS186-4] 1301 "Digital Signature Standard (DSS)", National Institute of 1302 Standards and Technology report, 1303 DOI 10.6028/nist.fips.186-4, July 2013, 1304 . 1306 [I-D.bre-openpgp-samples] 1307 Einarsson, B. R., juga, and D. K. Gillmor, "OpenPGP 1308 Example Keys and Certificates", Work in Progress, 1309 Internet-Draft, draft-bre-openpgp-samples-01, 20 December 1310 2019, . 1313 [RFC4134] Hoffman, P., Ed., "Examples of S/MIME Messages", RFC 4134, 1314 DOI 10.17487/RFC4134, July 2005, 1315 . 1317 [RFC7469] Evans, C., Palmer, C., and R. Sleevi, "Public Key Pinning 1318 Extension for HTTP", RFC 7469, DOI 10.17487/RFC7469, April 1319 2015, . 1321 [RFC8410] Josefsson, S. and J. Schaad, "Algorithm Identifiers for 1322 Ed25519, Ed448, X25519, and X448 for Use in the Internet 1323 X.509 Public Key Infrastructure", RFC 8410, 1324 DOI 10.17487/RFC8410, August 2018, 1325 . 1327 [SHA256] Dang, Q., "Secure Hash Standard", National Institute of 1328 Standards and Technology report, 1329 DOI 10.6028/nist.fips.180-4, July 2015, 1330 . 1332 Author's Address 1334 Daniel Kahn Gillmor (editor) 1335 American Civil Liberties Union 1336 125 Broad St. 1337 New York, NY, 10004 1338 United States of America 1340 Email: dkg@fifthhorseman.net