idnits 2.17.1 draft-leontiev-cryptopro-cppk-00.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Looks like you're using RFC 2026 boilerplate. This must be updated to follow RFC 3978/3979, as updated by RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack an IANA Considerations section. (See Section 2.2 of https://www.ietf.org/id-info/checklist for how to handle the case when there are no actions for IANA.) ** The document seems to lack separate sections for Informative/Normative References. All references will be assumed normative when checking for downward references. ** The abstract seems to contain references ([RFC3280], [RFC3279]), which it shouldn't. Please replace those with straight textual mentions of the documents in question. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year == Line 110 has weird spacing: '...gorithm is u...' == Line 137 has weird spacing: '...ined in a cer...' == Line 138 has weird spacing: '...scribed in th...' == Line 244 has weird spacing: '...ificant of 6...' == Line 275 has weird spacing: '... public key o...' == (5 more instances...) == The document seems to use 'NOT RECOMMENDED' as an RFC 2119 keyword, but does not include the phrase in its RFC 2119 key words list. -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (June 15, 2003) is 7621 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- == Missing Reference: 'RFC 2119' is mentioned on line 86, but not defined == Missing Reference: 'GOST3411' is mentioned on line 167, but not defined == Missing Reference: 'GOST341094' is mentioned on line 124, but not defined == Missing Reference: 'GOST34102001' is mentioned on line 125, but not defined == Missing Reference: 'GOSTR3411' is mentioned on line 592, but not defined -- Looks like a reference, but probably isn't: '0' on line 477 -- Looks like a reference, but probably isn't: '31' on line 290 -- Looks like a reference, but probably isn't: '63' on line 482 == Unused Reference: 'GOSTR341194' is defined on line 1972, but no explicit reference was found in the text == Unused Reference: 'RFC 2219' is defined on line 1992, but no explicit reference was found in the text == Unused Reference: 'TLS' is defined on line 1996, but no explicit reference was found in the text ** Obsolete normative reference: RFC 3280 (Obsoleted by RFC 5280) ** Obsolete normative reference: RFC 2246 (ref. 'TLS') (Obsoleted by RFC 4346) Summary: 6 errors (**), 0 flaws (~~), 16 warnings (==), 5 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 PKIX Working Group Serguei Leontiev, CRYPTO-PRO 3 INTERNET-DRAFT Dennis Shefanovskij, DEMOS Co Ltd 4 Expires December 15, 2003 June 15, 2003 5 Intended Category: Informational 7 Algorithms and Identifiers for the Internet X.509 Public Key 8 Infrastructure Certificates and Certificate Revocation List (CRL), 9 corresponding to the algorithms GOST R 34.10-94, GOST R 34.10-2001, GOST 10 R 34.11-94 12 14 Status of this Memo 16 This document is an Internet-Draft and is in full conformance with 17 all provisions of Section 10 of RFC2026. 19 Internet-Drafts are working documents of the Internet Engineering 20 Task Force (IETF), its areas, and its working groups. Note that 21 other groups may also distribute working documents as Internet- 22 Drafts. 24 Internet-Drafts are draft documents valid for a maximum of six months 25 and may be updated, replaced, or obsoleted by other documents at any 26 time. It is inappropriate to use Internet-Drafts as reference 27 material or to cite them other than as "work in progress." 29 The list of current Internet-Drafts can be accessed at 30 http://www.ietf.org/ietf/1id-abstracts.txt 32 The list of Internet-Draft Shadow Directories can be accessed at 33 http://www.ietf.org/shadow.html. 35 Comments or suggestions for improvement may be done via "ietf-pkix" 36 mailing list, or directly to the authors. 38 Abstract 40 This document describes identifiers and appropriate parameters for 41 the algorithms GOST R 34.10-94, GOST R 34.10-2001, GOST R 34.11-94, 42 and also ASN.1 encoding scheme for digital signatures and public 43 keys, used in Internet X.509 Public Key Infrastructure (PKI). This 44 specification extends [RFC 3279], "Algorithms and Identifiers for the 45 Internet X.509 Public Key Infrastructure Certificate and Certificate 46 Revocation List (CRL) Profile" and, correspondingly, [RFC 3280], 47 "Internet X.509 Public Key Infrastructure: Certificate and 48 Certificate Revocation List (CRL) Profile". All realizations of this 49 specification also MUST correspond [RFC 3280]. 51 Table of Contents 53 1 Introduction. . . . . . . . . . . . . . . . . . . . . . 2 54 2 Algorithm Support . . . . . . . . . . . . . . . . . . . 3 55 2.1 One-way Hash Functions. . . . . . . . . . . . . . . . . 4 56 2.1.1 One-way Hash Function GOST R 34.11-94 . . . . . . . . . 4 57 2.2 Signature Algorithms. . . . . . . . . . . . . . . . . . 4 58 2.2.1 Signature Algorithm GOST R 34.10-94 . . . . . . . . . . 5 59 2.2.2 Signature Algorithm GOST R 34.10-2001 . . . . . . . . . 6 60 2.3 Subject Public Key Algorithms . . . . . . . . . . . . . 7 61 2.3.1 GOST R 34.10-94 Keys. . . . . . . . . . . . . . . . . . 7 62 2.3.2 GOST R 34.10-2001 Keys. . . . . . . . . . . . . . . . . 9 63 3 Algorithm Parameters. . . . . . . . . . . . . . . . . . 11 64 3.1 GOST R 34.11-94 Parameters. . . . . . . . . . . . . . . 13 65 3.2 GOST R 34.10-94 Parameters. . . . . . . . . . . . . . . 13 66 3.3 GOST R 34.10-2001 Parameters. . . . . . . . . . . . . . 14 67 4 Security Considerations . . . . . . . . . . . . . . . . 14 68 5 Appendix ASN.1 Moduls . . . . . . . . . . . . . . . . . 14 69 5.1 Cryptographic-Gost-Useful-Definitions . . . . . . . . . 14 70 5.2 GostR3411-94-DigestSyntax . . . . . . . . . . . . . . . 17 71 5.3 GostR3411-94-ParamSetSyntax . . . . . . . . . . . . . . 18 72 5.4 GostR3410-94-PKISyntax. . . . . . . . . . . . . . . . . 21 73 5.5 GostR3410-94-ParamSetSyntax . . . . . . . . . . . . . . 23 74 5.6 GostR3410-2001-PKISyntax. . . . . . . . . . . . . . . . 33 75 5.7 GostR3410-2001-ParamSetSyntax . . . . . . . . . . . . . 35 76 6 References. . . . . . . . . . . . . . . . . . . . . . . 41 77 Acknowledgments. . . . . . . . . . . . . . . . . . . . . . . . 42 78 Author's Addresses . . . . . . . . . . . . . . . . . . . . . . 43 79 Full Copyright Statement . . . . . . . . . . . . . . . . . . . 44 81 1 Introduction 83 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 84 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 85 document are to be interpreted as described in [RFC 2119]. 87 This document defines identifiers and corresponding algorithm 88 parameters and attributes proposed by CRYPTO-PRO Company within 89 "Russian Cryptographic Software Compatibility Agreement" community 90 for the algorithms GOST R 34.10-94, GOST R 34.10-2001, GOST R 91 34.11-94, key establishment algorithms based on GOST R 34.10-94 92 public keys, key establishment algorithms based on GOST R 34.10-2001 93 public keys, and also ASN.1 encoding [X.660] for digital signatures 94 and public keys, used in Internet X.509 Public Key Infrastructure 95 (PKI). 97 This specification extends [RFC 3279], "Algorithms and Identifiers 98 for the Internet X.509 Public Key Infrastructure Certificate and 99 Certificate Revocation List (CRL) Profile" and, correspondingly, [RFC 100 3280], "Internet X.509 Public Key Infrastructure: Certificate and 101 Certificate Revocation List (CRL) Profile". All realizations of this 102 specification MUST also correspond [RFC 3280]. 104 This specification defines the content of the signatureAlgorithm, 105 signatureValue, signature, and subjectPublicKeyInfo fields within 106 Internet X.509 certificates and CRLs. 108 This document defines one-way hash-function GOST R 34.11-94 109 [GOST3411] for use in the generation of digital signatures. This 110 algorithm is used in conjunction with digital signature algorithms. 112 This specification describes the encoding of digital signatures, 113 generated with the following cryptographic algorithms: 115 * GOST R 34.10-94; 116 * GOST R 34.10-2001. 118 This document also defines the contents of the subjectPublicKeyInfo 119 field for Internet X.509 certificates. For each algorithm, the 120 appropriate alternatives for the keyUsage extension are provided. 121 This specification describes encoding formats for public keys used 122 with the following cryptographic algorithms: 124 * GOST R 34.10-94 [GOST341094]; 125 * GOST R 34.10-2001 [GOST34102001]; 126 * Key establishment algorithms based on GOST R 34.10-94 public 127 keys [CPALGS]; 128 * Key establishment algorithms based on GOST R 34.10-2001 public 129 keys [CPALGS]. 131 2 Algorithm Support 133 This section is review of cryptographic algorithms, which may be used 134 within the Internet X.509 certificates and CRL profile [RFC 3280]. 135 The one-way hash functions and digital signature algorithms, which 136 may be used to sign certificates and CRLs, and identifies object 137 identifiers (OIDs) for public keys contained in a certificate are 138 also described in this section. 140 The appropriate CA and/or applications MUST support digital 141 signatures and public keys fully for one of the specified algorithms. 142 Hence when using any of the algorithms identified in this 143 specification in CA and/or applications MUST support them as 144 described below. 146 2.1 One-way Hash Functions 148 This section identifies one-way, collision free hash function GOST R 149 34.11-94 - the only one could be used in digital signature 150 algorithms GOST R 34.10-94/2001. The data that is hashed for 151 certificates and CRL signing is fully described in [RFC 3280]. 153 2.1.1 One-way Hash Function GOST R 34.11-94 155 GOST R 34.11-94 has been developed by "GUBS of Federal Agency 156 Government Communication and Information" and "All-Russian Scientific 157 and Research Institute of Standardization". The algorithm GOST R 158 34.11-94 produces a 256-bit hash value of the arbitrary finite bit 159 length input. This document does not contain GOST R 34.11-94 full 160 specification, which could be found in [GOSTR3411] in Russian, 161 [Schneier95] ch. 18.11, p. 454. contain the brief technical 162 description in English. 164 The initial value (IV) and S-box are optional for algorithm 165 parameters (Algorithm Parameters part in [GOST28147] in Russian, 166 description in English see in [Schneier95] ch. 14.1, p. 331). The 167 Standard [GOST3411] does not define hash function algorithm 168 parameters, which ought to be set by OID in software code. The 169 Parameters for OID prescribed below are included in appendix. 171 2.2 Signature Algorithms 173 In according to [RFC 3280] the Certificates and CRL may be signed 174 with either GOST R 34.10-94 or with GOST R 34.10-2001 signature 175 algorithms. The signatureAlgorithm field of Certificates or 176 CertificateRevocationList for certificate or CRL indicates the 177 algorithm ID used for signature and associated parameters, essential 178 as OID. In case of omitted parameters, these ones are generated 179 hereditarily from top of issuers. This section also defines 180 algorithm identifiers and parameters that MUST be used in the 181 signatureAlgorithm field in a Certificate or 182 CertificateRevocationList. 184 Signature algorithms are always used conjointly with a one-way hash 185 function GOST R 34.11-94 as indicated in [GOSTR341094] and 186 [GOSTR34102001]. 188 This section identifies OIDS for GOST R 34.10-94 and GOST R 189 34.10-2001. The contents of the parameters component for each 190 algorithm may vary and details are provided below for each algorithm 191 separately. 193 The data to be signed (per example, the one-way hash function output 194 value) is preformatted for the signature algorithm to be used. Then, 195 a private key operation is performed to generate the signature value. 196 This signature value is then ASN.1 encoded as a BIT STRING and 197 included in the Certificate or CertificateRevocationList in the 198 signatureValue field. 200 2.2.1 Signature Algorithm GOST R 34.10-94 202 GOST R 34.10-94 has been developed by "GUBS of Federal Agency 203 Government Communication and Information" and "All-Russian Scientific 204 and Research Institute of Standardization". This signature algorithm 205 MUST be used conjointly with one-way, collision free hash function 206 GOST R 34.11-94. This document does not contain GOST R 34.10-94 207 standard description, which is fully described in [GOSTR341094] in 208 Russian, and brief description in English could be found in 209 [Schneier95] ch. 20.3, p. 495. 211 The ASN.1 OID used to identify GOST R 34.10-94 signature algorithm in 212 fields signatureAlgorithm in Certificate and 213 CertificateRevocationList is the next: 215 id-CryptoPro-algorithms OBJECT IDENTIFIER ::= 216 { iso(1) member-body(2) ru(643) rans(2) cryptopro(2) } 218 id-GostR3411-94-with-GostR3410-94 OBJECT IDENTIFIER ::= 219 { id-CryptoPro-algorithms gostR3411-94-with-gostR3410-94(4)} 221 GostR3410-94-CertificateSignatureAlgorithms 222 ALGORITHM-IDENTIFIER ::= { 223 { NULL IDENTIFIED BY 224 id-GostR3411-94-with-GostR3410-94 } | 225 { GostR3410-94-PublicKeyParameters IDENTIFIED BY 226 id-GostR3411-94-with-GostR3410-94 } } 228 See chapter Algorithms Parameters for further details. 230 When the id-GostR3411-94-with-GostR3410-94 algorithm identifier 231 appears in an AlgorithmIdentifier and parameters are omitted, the 232 software MUST use the parameters from the signer's public key. 234 Signature algorithm GOST R 34.10-94 generates digital signature in 235 the form of a binary 512-bit vector (256||256). This vector 236 is encoded as two data blocks, being given after decoding at the 237 signature verification algorithm input. At first, 256 block then 238 256 block. signatureValue field BIT STRING type: 240 GostR3410-94-SignatureValue ::= BIT STRING 241 At that, least-significant of the first octet 242 (GostR3410EncryptedDigest[0]) corresponds to least-significant (1-st) 243 of vector 256||256 (s1 = (GostR3410EncryptedDigest[0] & 1)). 244 Whereas most-significant of 64-th octet (GostData[31]) corresponds 245 to most-significant (512-d) of vector 256||256 (r'256 = 246 ((GostR3410EncryptedDigest[63] & 0x80)>>7)). 248 2.2.2 Signature Algorithm GOST R 34.10-2001 250 GOST R 34.10-2001 was developed by "GUBS of Federal Agency Government 251 Communication and Information" and "All-Russian Scientific and 252 Research Institute of Standardization". This signature algorithm 253 MUST be used conjointly with one-way, collision free hash function 254 GOST R 34.11-94. This document does not contain GOST R 34.10-2001 255 standard description, which is fully described in [GOSTR34102001]. 257 The ASN.1 OID used to identify GOST R 34.10-2001 signature algorithm 258 in fields signatureAlgorithm of Certificate and 259 CertificateRevocationList is: 261 id-GostR3411-94-with-GostR3410-2001 OBJECT IDENTIFIER ::= 262 { id-CryptoPro-algorithms gostR3411-94-with-gostR3410-2001(3) } 264 GostR3410-2001-CertificateSignatureAlgorithms 265 ALGORITHM-IDENTIFIER ::= { 266 { NULL IDENTIFIED BY 267 id-GostR3411-94-with-GostR3410-2001 } | 268 { GostR3410-2001-PublicKeyParameters IDENTIFIED BY 269 id-GostR3411-94-with-GostR3410-2001 } } 271 See chapter Algorithms Parameters for further details. 273 When the id-GostR3411-94-with-GostR3410-2001 algorithm identifier 274 appears in an AlgorithmIdentifier and parameters are omitted, the 275 MUST use the parameters concerned with the public key of the issuer 276 of this certificate or CRL. 278 Signature algorithm GOST R 34.10-2001 generates digital signature in 279 the form of a binary 512-bit vector (256||256). This vector 280 encoded as two data blocks, piping after encoding to input of 281 signature verification algorithm in according to GOST R 34.10-2001, 282 first block 256, then block 256. The field signatureValue has 283 type BIT STRING: 285 GostR3410-2001-CertificateSignature ::= BIT STRING 287 At that, least-significant of the first octet 288 (GostR3410EncryptedDigest[0]) corresponds to least-significant (1-st) 289 of vector 256||256 (s1 = (GostR3410EncryptedDigest[0] & 1)). 290 Whereas most-significant of 64-th octet (GostData[31]) corresponds to 291 most-significant (512-d) of vector 256||256 (r256 = 292 ((GostR3410EncryptedDigest[63] & 0x80)>>7)). 294 2.3 Subject Public Key Algorithms 296 In according to [RFC 3280] the certificates may contain a public key 297 for any algorithm. Within the framework of this specification the 298 only GOST R 34.10-94 and GOST R 34.10-2001 public key algorithms 299 defined. The algorithm and associated parameters are definable as OID 300 in certificate through ASN.1 structure AlgorithmIdentifier. 302 This section identifies defines OID and public key parameters for the 303 GOST R 34.10-94 and GOST R 34.10-2001 algorithms. The appropriate CA 304 MUST use the predefined OID issuing certificates containing public 305 keys for these algorithms. The appropriate applications supporting 306 any of these algorithms MUST fully recognize the OID identified in 307 this section 309 2.3.1 GOST R 34.10-94 Keys 311 This section defines OID and parameters encoding scheme for public 312 key including into certificate. Public key GOST R 34.10-94 could be 313 used for digital signature verification by GOST R 34.10-94 314 [GOSTR341094] algorithm and for key exchange algorithm based on GOST 315 R 34.10-94 [CPALGS]. 317 Public key OID for GOST R 34.10-94 declared in this document is: 319 id-GostR3410-94 OBJECT IDENTIFIER ::= 320 { id-CryptoPro-algorithms gostR3410-94(20) } 322 An assumed cryptographic key usage could be pointed in keyUsage field 323 [RFC 3280]. The usage the same key for signature and for key 324 establishment is NOT RECOMMENDED, but possible. 326 SubjectPublicKeyInfo sintax of primary certificate context for id- 327 GostR3410-94 algorithm produced in following ASN.1 structure: 329 SubjectPublicKeyInfo ::= 330 SEQUENCE { 331 algorithm AlgorithmIdentifier, 332 subjectPublicKey BIT STRING 333 } 335 GostR3410-94-PublicKeyAlgorithms ALGORITHM-IDENTIFIER ::= { 336 { GostR3410-94-PublicKeyParameters IDENTIFIED BY 337 id-GostR3410-94 } } 339 GostR3410-94-PublicKeyParameters ::= 340 SEQUENCE { 341 publicKeyParamSet 342 OBJECT IDENTIFIER, 343 digestParamSet 344 OBJECT IDENTIFIER, 345 encryptionParamSet 346 OBJECT IDENTIFIER OPTIONAL 347 } 349 where: 350 * publicKeyParamSet - public key parameters identifier for GOST 351 R 34.10-94; 352 * digestParamSet - parameters identifier for GOST R 34.11-94; 353 * encryptionParamSet - optional parameters identifier for GOST 354 28147-89 MAY be presented anytime and MUST be presented if keyUsage 355 is keyAgreement or keyEnchiperment. 357 AlgorithmIdentifier within subjectPublicKeyInfo could takes place 358 only if a certificate contains these parameters. If GOST R 34.10-94 359 algorithm parameters are omitted in subjectPublicKeyInfo, and CA 360 signs subject certificate using GOST R 34.10-94, then GOST R 34.10-94 361 parameters taken from subjectPublicKeyInfo field of issuer 362 certificate are applicable to public key of GOST R 34.10-94 subject. 363 That is, cryptographic parameters inheritance takes place. If 364 subjectPublicKeyInfo AlgorithmIdentifier field contain no parameters, 365 but CA sign certificate using signature algorithm different from GOST 366 R 34.10-94, then certificate users MUST reject it. 368 Public key GOST R 34.10-94 MUST be ASN.1 encoded in following way. 370 In GOST R 34.10-94 public key is a number y = a^x (mod p), where a 371 and p - parameters, and y is a bit-vector (1024), at that 372 encoding should present 1024 (BIT STRING) as a vector holding 373 data in a little-endian. At first, a key is presented as an OCTET 374 STRING, and then, being DER-encoded, presented as a BIT STRING. 376 GostR3410-94-PublicKey ::= BIT STRING 378 GostR3410-94-PublicKeyOctetString ::= OCTET STRING 380 If the keyUsage extension is present in an end-entity certificate, 381 which contains a GOST R 34.10-94 public key, the following values MAY 382 be present: 384 digitalSignature; 385 nonRepudiation. 386 keyEncipherment; 387 keyAgreement. 389 If the keyAgreement or keyEnchiperment extension is present in a 390 certificate GOST R 34.10-94 public key, the following values MAY be 391 present as well: 393 encipherOnly; 394 decipherOnly. 396 The keyUsage extension MUST NOT assert both encipherOnly and 397 decipherOnly. 399 If the keyUsage extension is present in an CA or CRL signer 400 certificate which contain a GOST R 34.10-94 public key, the following 401 values MAY be present: 403 digitalSignature; 404 nonRepudiation; 405 keyCertSign; 406 cRLSign. 408 2.3.2 GOST R 34.10-2001 Keys 410 This section defines OID and parameters encoding for public key 411 including in certificate. Public key GOST R 34.10-2001 could be used 412 for digital signature generation by GOST R 34.10-2001 [GOSTR34102001] 413 algorithm and for key exchange algorithm based on GOST R 34.10-2001 414 [CPALGS]. Public key OID for GOST R 34.10-2001 is: 416 id-GostR3410-2001 OBJECT IDENTIFIER ::= 417 { id-CryptoPro-algorithms gostR3410-2001(19) } 419 Assumed cryptographic key usage could be pointed in keyUsage field 420 [RFC 3280]. The usage of the same key for digital signature and key 421 establishment is NOT RECOMMENDED, but possible. 423 SubjectPublicKeyInfo syntax of primary certificate context for id- 424 GostR3410-94 algorithm produced in following ASN.1 structure: 426 SubjectPublicKeyInfo ::= 427 SEQUENCE { 428 algorithm AlgorithmIdentifier, 429 subjectPublicKey BIT STRING 430 } 432 GostR3410-2001-PublicKeyAlgorithms ALGORITHM-IDENTIFIER ::= { 433 { GostR3410-2001-PublicKeyParameters IDENTIFIED BY 434 id-GostR3410-2001 } } 436 GostR3410-2001-PublicKeyParameters ::= 437 SEQUENCE { 438 publicKeyParamSet 439 OBJECT IDENTIFIER, 440 digestParamSet 441 OBJECT IDENTIFIER, 442 encryptionParamSet 443 OBJECT IDENTIFIER OPTIONAL 444 } 446 * publicKeyParamSet - public key parameters identifier for GOST R 447 34.10-2001; 448 * digestParamSet - parameters identifier for GOST R 34.11-94; 449 * encryptionParamSet - optional parameters identifier for GOST 450 28147-89 MAY be presented anytime and MUST be presented if keyUsage 451 differs from digitalSignature, nonRepudiation, keyCertSign and 452 cRLSign. 454 AlgorithmIdentifier within subjectPublicKeyInfo takes place only if a 455 certificate could contain parameters. If GOST R 34.10-2001 algorithm 456 parameters are omitted in subjectPublicKeyInfo, and CA signs subject 457 certificate using GOST R 34.10-2001, then GOST R 34.10-2001 458 parameters taken from subjectPublicKeyInfo field of issuer 459 certificate are applicable to public key of GOST R 34.10-2001 460 subject. That is, cryptographic parameters inheritance takes place. 461 If subjectPublicKeyInfo AlgorithmIdentifier field contain no 462 parameters, but CA sign certificate using signature algorithm 463 different from GOST R 34.10-2001, then certificate users MUST reject 464 it. 466 GOST R 34.10-2001 public key MUST be ASN.1 encoded in a following 467 way. GOST R 34.10-2001 specifies that public key is a point on the 468 elliptic curve Q = dP, where d is a private key, P is a base point, 469 and Q presents in a way of 512-bit vector (256||256). This 470 vector DER-encoded as two data blocks. At first, 256 block, then 471 256 block. subjectPublicKey field BIT STRING type is presented as 472 a taken up object GostR3410-2001-PublicKeyOctetString. 474 At that, least-significant of the first octet 475 (GostR3410-2001-PublicKeyOctetString[0]) corresponds to least- 476 significant (1-st) of vector 256||256 (Yq1 = 477 (GostR3410-2001-PublicKeyOctetString[0] & 1)). 479 Whereas most-significant of 64-th octet 480 (GostR3410-2001-PublicKeyOctetString[63]) corresponds to most- 481 significant (512-d) of vector 256||256 (Xq256 = 482 ((GostR3410-2001-PublicKeyOctetString[63] & 0x80)>>7)). 484 In other words, 256||256 vector is stored in little-endian, 485 that correspond binary vector form and their concatenation in GOST R 486 34.10-2001 ch. 5.3. At first, key is placed in OCTET STRING, than is 487 DER-encoded and placed in BIT STRING. 489 GostR3410-2001-PublicKey ::= BIT STRING 491 GostR3410-2001-PublicKeyOctetString ::= OCTET STRING 493 If the keyUsage extension is present in an end-entity certificate, 494 which conveys a GOST R 34.10-2001 public key, the following values 495 MAY be present: 497 digitalSignature; 498 nonRepudiation. 499 keyEncipherment; 500 keyAgreement. 502 If the keyAgreement or keyEnchiperment extension is present in a 503 certificate, the following values MAY be present: 505 encipherOnly; 506 decipherOnly. 508 The keyUsage extension MUST NOT assert both encipherOnly and 509 decipherOnly. 511 If the keyUsage extension is present in an CA or CRL signer 512 certificate which contain a GOST R 34.10-2001 public key, the 513 following values MAY be present: 515 digitalSignature; 516 nonRepudiation; 517 keyCertSign; 518 cRLSign. 520 3 Algorithm Parameters 522 Cryptographic algorithm parameters in certificates and CRL are 523 indicated by appropriate OID. Algorithm parameters OID, proposed 524 hereby, are the next. 526 For hash function parameters GOST R 34.11-94: 528 id-CryptoPro-hashes OBJECT IDENTIFIER ::= 529 { iso(1) member-body(2) ru(643) rans(2) cryptopro(2) hashes(30) } 531 id-GostR3411-94-TestParamSet OBJECT IDENTIFIER ::= 532 { id-CryptoPro-hashes test(0) } 534 id-GostR3411-94-CryptoProParamSet OBJECT IDENTIFIER ::= 535 { id-CryptoPro-hashes cryptopro(1) } 537 For public key parameters GOST R 34.10-94: 539 id-CryptoPro-signs OBJECT IDENTIFIER ::= 540 { iso(1) member-body(2) ru(643) rans(2) cryptopro(2) signs(32) } 542 id-GostR3410-94-TestParamSet OBJECT IDENTIFIER ::= 543 { id-CryptoPro-signs test(0) } 545 id-GostR3410-94-CryptoPro-A-ParamSet OBJECT IDENTIFIER ::= 546 { id-CryptoPro-signs cryptopro-A(2) } 548 id-GostR3410-94-CryptoPro-B-ParamSet OBJECT IDENTIFIER ::= 549 { id-CryptoPro-signs cryptopro-B(3) } 551 id-GostR3410-94-CryptoPro-C-ParamSet OBJECT IDENTIFIER ::= 552 { id-CryptoPro-signs cryptopro-C(4) } 554 id-GostR3410-94-CryptoPro-D-ParamSet OBJECT IDENTIFIER ::= 555 { id-CryptoPro-signs cryptopro-D(5) } 557 For public key parameters GOST R 34.10-2001: 559 id-CryptoPro-ecc-signs OBJECT IDENTIFIER ::= { iso(1) member-body(2) 560 ru(643) rans(2) cryptopro(2) ecc-signs(35) } 562 id-GostR3410-2001-TestParamSet OBJECT IDENTIFIER ::= 563 { id-CryptoPro-ecc-signs test(0) } 565 id-GostR3410-2001-CryptoPro-A-ParamSet OBJECT IDENTIFIER ::= 566 { id-CryptoPro-ecc-signs cryptopro-A(1) } 568 id-GostR3410-2001-CryptoPro-B-ParamSet OBJECT IDENTIFIER ::= 569 { id-CryptoPro-ecc-signs cryptopro-B(2) } 571 id-GostR3410-2001-CryptoPro-C-ParamSet OBJECT IDENTIFIER ::= 572 { id-CryptoPro-ecc-signs cryptopro-C(3) } 574 Specific further parameter values are presented in Appendix. 576 If any organization needs to assign their own parameters, they should 577 be described and MUST be published in a way of appendix to this 578 document or in other way in following forms: 580 3.1 GOST R 34.11-94 Parameters 582 Hash function parameters GOST R 34.11-94 according to [GOSTR3411]: 584 GostR3411-94-ParamSetParameters ::= 585 SEQUENCE { 586 hUZ Gost28147-89-UZ, 587 h0 GostR3411-94-Digest 588 } 590 hUZ - S-box [GOSTR3411], [GOST28147]. 592 h0 - initializing value(IV) [GOSTR3411]. 594 3.2 GOST R 34.10-94 Parameters 596 algorithm parameters GOST R 34.10-94 according to [GOSTR341094]: 598 GostR3410-94-ParamSetParameters ::= 599 SEQUENCE { 600 p INTEGER, 601 q INTEGER, 602 a INTEGER, 603 validationAlgorithm 604 AlgorithmIdentifier {{ 605 GostR3410-94-ValidationAlgorithms 606 }} OPTIONAL 607 } 609 p - modulus, prime number, 2^1023