draft-ietf-keyprov-symmetrickeyformat-07.txt   draft-ietf-keyprov-symmetrickeyformat-08.txt 
KEYPROV Working Group Sean Turner, IECA KEYPROV Working Group Sean Turner, IECA
Internet Draft Russ Housley, Vigil Security Internet Draft Russ Housley, Vigil Security
Intended Status: Standard Track February 1, 2010 Intended Status: Standards Track April 26, 2010
Expires: August 1, 2010 Expires: October 26, 2010
Symmetric Key Package Content Type Symmetric Key Package Content Type
draft-ietf-keyprov-symmetrickeyformat-07.txt draft-ietf-keyprov-symmetrickeyformat-08.txt
Abstract Abstract
This document defines the symmetric key format content type. It is This document defines the symmetric key format content type. It is
transport independent. The Cryptographic Message Syntax can be used transport independent. The Cryptographic Message Syntax can be used
to digitally sign, digest, authenticate, or encrypt this content to digitally sign, digest, authenticate, or encrypt this content
type. type.
Status of this Memo Status of this Memo
skipping to change at page 1, line 38 skipping to change at page 1, line 38
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html http://www.ietf.org/shadow.html
This Internet-Draft will expire on August 1, 2010. This Internet-Draft will expire on October 26, 2010.
Copyright Notice Copyright Notice
Copyright (c) 2010 IETF Trust and the persons identified as the Copyright (c) 2010 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 31 skipping to change at page 2, line 31
3.1.2. Cryptographic Module Information Attributes..........7 3.1.2. Cryptographic Module Information Attributes..........7
3.2. PSKC Key Attributes.......................................8 3.2. PSKC Key Attributes.......................................8
3.2.1. Key Identifier.......................................8 3.2.1. Key Identifier.......................................8
3.2.2. Algorithm............................................8 3.2.2. Algorithm............................................8
3.2.3. Issuer...............................................8 3.2.3. Issuer...............................................8
3.2.4. Key Profile Identifier...............................8 3.2.4. Key Profile Identifier...............................8
3.2.5. Key Reference Identifier.............................9 3.2.5. Key Reference Identifier.............................9
3.2.6. Friendly Name........................................9 3.2.6. Friendly Name........................................9
3.2.7. Algorithm Parameters.................................9 3.2.7. Algorithm Parameters.................................9
3.2.8. Counter.............................................11 3.2.8. Counter.............................................11
3.2.9. Time................................................11 3.2.9. Time................................................12
3.2.10. Time Interval......................................12 3.2.10. Time Interval......................................12
3.2.11. Time Drift.........................................12 3.2.11. Time Drift.........................................12
3.2.12. Value MAC..........................................12 3.2.12. Value MAC..........................................12
3.3. Key Policy Attributes....................................13 3.3. Key Policy Attributes....................................13
3.3.1. Start Date..........................................13 3.3.1. Key Start Date......................................13
3.3.2. Expiry Date.........................................13 3.3.2. Key Expiry Date.....................................13
3.3.3. Number of Transactions..............................13 3.3.3. Number of Transactions..............................14
3.3.4. Key Usage...........................................13 3.3.4. Key Usage...........................................14
3.3.5. PIN Policy..........................................14 3.3.5. PIN Policy..........................................15
4. Key Encoding..................................................16 4. Key Encoding..................................................16
4.1. AES Key Encoding.........................................16 4.1. AES Key Encoding.........................................16
4.2. Triple DES Key Encoding..................................16 4.2. Triple DES Key Encoding..................................17
5. Security Considerations.......................................17 5. Security Considerations.......................................17
6. IANA Considerations...........................................17 6. IANA Considerations...........................................18
7. References....................................................17 7. References....................................................18
7.1. Normative References.....................................17 7.1. Normative References.....................................18
7.2. Non-Normative References.................................18 7.2. Non-Normative References.................................20
APPENDIX A: ASN.1 Module.........................................19 APPENDIX A: ASN.1 Module.........................................20
A.1. Symmetric Key Package ASN.1 Module.......................19 A.1. Symmetric Key Package ASN.1 Module.......................20
A.2. PSKC ASN.1 Module........................................21 A.2. PSKC ASN.1 Module........................................22
1. Introduction 1. Introduction
This document defines the symmetric key format content type. It is This document defines the symmetric key format content type. It is
transport independent. The Cryptographic Message Syntax (CMS) transport independent. The Cryptographic Message Syntax (CMS)
[RFC5652] can be used to digitally sign, digest, authenticate, or [RFC5652] can be used to digitally sign, digest, authenticate, or
encrypt this content type. encrypt this content type.
The uses cases that motivated the attributes in this work are The use cases that motivated the attributes in this work are
elaborated in [PSKC]. They are omitted to avoid duplication. elaborated in [PSKC]. They are omitted to avoid duplication.
This document also includes Abstract Syntax Notation One (ASN.1) This document also includes Abstract Syntax Notation One (ASN.1)
definitions of the Extensible Markup Language (XML) element and definitions of the Extensible Markup Language (XML) element and
attributes defined in [PSKC]. attributes defined in [PSKC].
1.1. Requirements Terminology 1.1. Requirements Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
1.2. ASN.1 Syntax Notation 1.2. ASN.1 Syntax Notation
The key package is defined using the ASN.1 [X.680, X.681, X.682, and The key package is defined using the ASN.1 [X.680], [X.681], [X.682],
X.683]. and [X.683].
2. Symmetric Key Package Content Type 2. Symmetric Key Package Content Type
The symmetric key package content type is used to transfer one or The symmetric key package content type is used to transfer one or
more plaintext symmetric keys from one party to another. A symmetric more plaintext symmetric keys from one party to another. A symmetric
key package MAY be encapsulated in one or more CMS protecting content key package MAY be encapsulated in one or more CMS protecting content
types. This content type must be Distinguished Encoding Rules (DER) types. This content type MUST be Distinguished Encoding Rules (DER)
encoded [X.690]. encoded [X.690].
The symmetric key package content type has the following syntax: The symmetric key package content type has the following syntax:
ct-symmetric-key-package CONTENT-TYPE ::= ct-symmetric-key-package CONTENT-TYPE ::=
{ SymmetricKeyPackage IDENTIFIED BY id-ct-KP-sKeyPackage } { SymmetricKeyPackage IDENTIFIED BY id-ct-KP-sKeyPackage }
id-ct-KP-sKeyPackage OBJECT IDENTIFIER ::= id-ct-KP-sKeyPackage OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9) { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) ct(1) 25 } smime(16) ct(1) 25 }
skipping to change at page 5, line 8 skipping to change at page 5, line 8
appears here, then it MUST NOT also be included in sKeyPkgAttrs. appears here, then it MUST NOT also be included in sKeyPkgAttrs.
- sKey optionally contains the key value encoded as an OCTET STRING. - sKey optionally contains the key value encoded as an OCTET STRING.
The OneSymmetricKey field MUST include either sKeyAttrs, or sKey, or The OneSymmetricKey field MUST include either sKeyAttrs, or sKey, or
sKeyAttrs and sKey. sKeyAttrs and sKey.
3. PSKC Attributes 3. PSKC Attributes
The following attributes are defined to assist those using the The following attributes are defined to assist those using the
symmetric key package defined in this document as part of a Portable symmetric key package defined in this document as part of a Dynamic
Symmetric Key Container protocol [PSKC]. [PSKC] should be consulted Symmetric Key Provision Protocol (DSKPP) [DSKPP] with Portable
for the definitive attribute descriptions. The attributes fall in to Symmetric Key Container (PSKC) attributes. [PSKC] should be
three categories. The first category includes attributes that apply consulted for the definitive attribute descriptions. The attributes
to a key package, and these attributes will generally appear in fall in to three categories. The first category includes attributes
sKeyPkgAttrs. The second category includes attributes that apply to that apply to a key package, and these attributes will generally
a particular key, and these attributes will generally appear in appear in sKeyPkgAttrs. The second category includes attributes that
sKeyAttrs. The third category includes attributes that apply to a key apply to a particular key, and these attributes will generally appear
policy. Of the attributes defined, only the Key Identifier (Section in sKeyAttrs. The third category includes attributes that apply to a
3.2.1) and Algorithm (Section 3.2.2) key attributes MUST be included. key policy. Of the attributes defined, only the Key Identifier
All other attributes are OPTIONAL. (Section 3.2.1) and Algorithm (Section 3.2.2) key attributes MUST be
included. All other attributes are OPTIONAL.
Like PSKC, the Symmetric Key Content Type supports extensibility. Like PSKC, the Symmetric Key Content Type supports extensibility.
Primarily this is accomplished through the definition and inclusion Primarily this is accomplished through the definition and inclusion
of new attributes, but in some instances where the attribute contains of new attributes, but in some instances where the attribute contains
more than one type the ASN.1 "..." extensibility mechanism is more than one type the ASN.1 "..." extensibility mechanism is
employed. employed.
A straightforward approach to conversion from XML types to ASN.1 is A straightforward approach to conversion from XML types to ASN.1 is
employed. The <xs:string> type converts to UTF8String; the XML employed. The <xs:string> type converts to UTF8String; the XML
<xs:dateTime> type converts to GeneralizedTime; and the XML integer <xs:dateTime> type converts to GeneralizedTime; and the XML integer
skipping to change at page 5, line 51 skipping to change at page 6, line 5
device to which the Symmetric Key Package is provisioned. device to which the Symmetric Key Package is provisioned.
3.1.1.1. Manufacturer 3.1.1.1. Manufacturer
The Manufacturer attribute indicates the manufacturer of the device. The Manufacturer attribute indicates the manufacturer of the device.
The attribute definition is as follows: The attribute definition is as follows:
at-pskc-manufacturer ATTRIBUTE ::= { at-pskc-manufacturer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer } TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }
id-pskc-manufacturer OBJECT IDENTIFIER ::= { TBD } id-pskc-manufacturer OBJECT IDENTIFIER ::= { id-pskc 1 }
3.1.1.2. Serial Number 3.1.1.2. Serial Number
The Serial Number attribute indicates the serial number of the The Serial Number attribute indicates the serial number of the
device. The attribute definition is as follows: device. The attribute definition is as follows:
at-pskc-serialNo ATTRIBUTE ::= { at-pskc-serialNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-serialNo } TYPE UTF8String IDENTIFIED BY id-pskc-serialNo }
id-pskc-serialNo OBJECT IDENTIFIER ::= { TBD } id-pskc-serialNo OBJECT IDENTIFIER ::= { id-pskc 2 }
3.1.1.3. Model 3.1.1.3. Model
The Model attribute indicates the model of the device. The attribute The Model attribute indicates the model of the device. The attribute
definition is as follows: definition is as follows:
at-pskc-model ATTRIBUTE ::= { at-pskc-model ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-model } TYPE UTF8String IDENTIFIED BY id-pskc-model }
id-pskc-model OBJECT IDENTIFIER ::= { TBD } id-pskc-model OBJECT IDENTIFIER ::= { id-pskc 3 }
3.1.1.4. Issue Number 3.1.1.4. Issue Number
The Issue Number attribute contains an issue number to distinguish The Issue Number attribute contains an issue number to distinguish
between two devices with the same serial number. The attribute between two devices with the same serial number. The attribute
definition is as follows: definition is as follows:
at-pskc-issueNo ATTRIBUTE ::= { at-pskc-issueNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issueNo } TYPE UTF8String IDENTIFIED BY id-pskc-issueNo }
id-pskc-issueNo OBJECT IDENTIFIER ::= { TBD } id-pskc-issueNo OBJECT IDENTIFIER ::= { id-pskc 4 }
3.1.1.5. Device Binding 3.1.1.5. Device Binding
The Device Binding attribute provides an opaque identifier that The Device Binding attribute provides an opaque identifier that
allows keys to be bound to the device or to a class of devices. allows keys to be bound to the device or to a class of devices.
When loading keys into a device, the attribute's value MUST be When loading keys into a device, the attribute's value MUST be
checked against information provided to the user via out-of-band checked against information provided to the user via out-of-band
mechanisms. The implementation then ensures that the correct device mechanisms. The implementation then ensures that the correct device
or class of device is being used with respect to the provisioned key. or class of device is being used with respect to the provisioned key.
at-pskc-deviceBinding ATTRIBUTE ::= { at-pskc-deviceBinding ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceBinding } TYPE UTF8String IDENTIFIED BY id-pskc-deviceBinding }
id-pskc-deviceBinding OBJECT IDENTIFIER ::= { TBD } id-pskc-deviceBinding OBJECT IDENTIFIER ::= { id-pskc 5 }
3.1.1.6. Start Date 3.1.1.6. Device Start Date
When included in sKeyPkgAttrs, the Start Date attribute indicates the When included in sKeyPkgAttrs, the Device Start Date attribute
start date for a device. The date MUST be expressed in UTC form with indicates the start date for a device. The date MUST be expressed in
no time zone component. Implementations SHOULD NOT rely on time UTC form with no time zone component. Implementations SHOULD NOT
resolution finer than milliseconds and MUST NOT generate time rely on time resolution finer than milliseconds and MUST NOT generate
instants that specify leap seconds. The attribute definition is as time instants that specify leap seconds. The attribute definition is
follows: as follows:
at-pskc-startDate ATTRIBUTE ::= { at-pskc-deviceStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-startDate } TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceStartDate }
id-pskc-startDate OBJECT IDENTIFIER ::= { TBD } id-pskc-deviceStartDate OBJECT IDENTIFIER ::= { id-pskc 6 }
3.1.1.7. Expiry Date 3.1.1.7. Device Expiry Date
When included in sKeyPkgAttrs, the Expiry Date attribute indicates When included in sKeyPkgAttrs, the Device Expiry Date attribute
the expiry date for a device. The date MUST be expressed in UTC form indicates the expiry date for a device. The date MUST be expressed
with no time zone component. Implementations SHOULD NOT rely on time in UTC form with no time zone component. Implementations SHOULD NOT
resolution finer than milliseconds and MUST NOT generate time rely on time resolution finer than milliseconds and MUST NOT generate
instants that specify leap seconds. The attribute definition is as time instants that specify leap seconds. The attribute definition is
follows: as follows:
at-pskc-expiryDate ATTRIBUTE ::= { at-pskc-deviceExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-expiryDate } TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceExpiryDate }
id-pskc-expiryDate OBJECT IDENTIFIER ::= { TBD } id-pskc-deviceExpiryDate OBJECT IDENTIFIER ::= { id-pskc 7 }
3.1.2. Cryptographic Module Information Attributes 3.1.2. Cryptographic Module Information Attributes
Cryptographic Module attributes uniquely identify a cryptographic Cryptographic Module attributes uniquely identify a cryptographic
module. This is useful when the device contains more than one module. This is useful when the device contains more than one
cryptographic module. At this time only one attribute is defined. cryptographic module. At this time only one attribute is defined.
3.1.2.1. Cryptographic Module Identifier 3.1.2.1. Cryptographic Module Identifier
When included in sKeyPkgAttrs, the Identifier attribute uniquely When included in sKeyPkgAttrs, the Cryptographic Module Identifier
identifies the cryptographic module to which the key is being or was attribute uniquely identifies the cryptographic module to which the
provisioned. The attribute definition is as follows: key is being or was provisioned. The attribute definition is as
follows:
at-pskc-id ATTRIBUTE ::= { at-pskc-moduleId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-id } TYPE UTF8String IDENTIFIED BY id-pskc-moduleId }
id-pskc-id OBJECT IDENTIFIER ::= { TBD } id-pskc-moduleId OBJECT IDENTIFIER ::= { id-pskc 8 }
3.2. PSKC Key Attributes 3.2. PSKC Key Attributes
PSKC key attributes apply to a specific key. As noted earlier, the PSKC key attributes apply to a specific key. As noted earlier, the
Key Identifier (Sec 3.2.1) and Algorithm (Sec 3.2.2) key attributes Key Identifier (Sec 3.2.1) and Algorithm (Sec 3.2.2) key attributes
are REQUIRED. All other attributes are OPTIONAL. are REQUIRED. All other attributes are OPTIONAL.
3.2.1. Key Identifier 3.2.1. Key Identifier
When included in sKeyAttrs, the Identifier attribute uniquely When included in sKeyAttrs, the Key Identifier attribute uniquely
identifies the key. The syntax is found in Section 3.1.2.1. identifies the key. The attribute definition is as follows:
at-pskc-keyId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyId }
id-pskc-keyId OBJECT IDENTIFIER ::= { id-pskc 9 }
3.2.2. Algorithm 3.2.2. Algorithm
The Algorithm attribute uniquely identifies the PSKC algorithm The Algorithm attribute uniquely identifies the PSKC algorithm
profile. Values may be taken from [PSKC-ALGORITHM-PROFILES]. The profile. [PSKC] defines two algorithm profiles "HOTP" and
attribute definition is as follows: "KEYPROV-PIN". The attribute definition is as follows:
at-pskc-algorithm ATTRIBUTE ::= { at-pskc-algorithm ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-algorithm } TYPE UTF8String IDENTIFIED BY id-pskc-algorithm }
id-pskc-algorithm OBJECT IDENTIFIER ::= { TBD } id-pskc-algorithm OBJECT IDENTIFIER ::= { id-pskc 10 }
3.2.3. Issuer 3.2.3. Issuer
The Issuer attribute names the entity that issued the key. The The Issuer attribute names the entity that issued the key. The
attribute definition is as follows: attribute definition is as follows:
at-pskc-issuer ATTRIBUTE ::= { at-pskc-issuer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issuer } TYPE UTF8String IDENTIFIED BY id-pskc-issuer }
id-pskc-issuer OBJECT IDENTIFIER ::= { TBD } id-pskc-issuer OBJECT IDENTIFIER ::= { id-pskc 11 }
3.2.4. Key Profile Identifier 3.2.4. Key Profile Identifier
The Key Profile Identifier attribute carries a unique identifier used The Key Profile Identifier attribute carries a unique identifier used
between the sending and receiving parties to establish a set of key between the sending and receiving parties to establish a set of key
attribute values that are not transmitted within the container but attribute values that are not transmitted within the container but
agreed between the two parties out of band. This attribute will then agreed between the two parties out of band. This attribute will then
represent the unique reference to a set of key attribute values. represent the unique reference to a set of key attribute values.
at-pskc-keyProfileId ATTRIBUTE ::= { at-pskc-keyProfileId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyProfileId } TYPE UTF8String IDENTIFIED BY id-pskc-keyProfileId }
id-pskc-keyProfileId OBJECT IDENTIFIER ::= { TBD } id-pskc-keyProfileId OBJECT IDENTIFIER ::= { id-pskc 12 }
3.2.5. Key Reference Identifier 3.2.5. Key Reference Identifier
The Key Reference attribute refers to an external key to be used with The Key Reference attribute refers to an external key to be used with
a key derivation scheme and no specific key value (secret) is a key derivation scheme and no specific key value (secret) is
transported but only the reference to the external master key is used transported but only the reference to the external master key is used
(e.g., the PKCS#11 key label). (e.g., the PKCS#11 key label).
at-pskc-keyReference ATTRIBUTE ::= { at-pskc-keyReference ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyReference } TYPE UTF8String IDENTIFIED BY id-pskc-keyReference }
id-pskc-keyReference OBJECT IDENTIFIER ::= { TBD } id-pskc-keyReference OBJECT IDENTIFIER ::= { id-pskc 13 }
3.2.6. Friendly Name 3.2.6. Friendly Name
The Friendly Name attribute contains a human readable name for the The Friendly Name attribute contains a human readable name for the
secret key. The attribute definition is as follows: secret key. The attribute definition is as follows:
at-pskc-friendlyName ATTRIBUTE ::= { at-pskc-friendlyName ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName } TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName }
id-pskc-friendlyName OBJECT IDENTIFIER ::= { TBD } id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }
The text is encoded in UTF-8 [RFC3629], which accommodates most of
the world's writing systems. The friendlyNameLangTag field
identifies the language used to express the friendlyName. When
friendlyNameLangTag is absent, English is used. The value of the
friendlyNameLangTag should be a language tag as described in
[RFC5646].
3.2.7. Algorithm Parameters 3.2.7. Algorithm Parameters
The Algorithm Parameters attribute contains parameters that influence The Algorithm Parameters attribute contains parameters that influence
the result of the algorithmic computation, for example response the result of the algorithmic computation, for example response
truncation and format in One-Time Password (OTP) and Challenge- truncation and format in One-Time Password (OTP) and Challenge-
Response (CR) algorithms. Response (CR) algorithms.
at-pskc-algorithmParameters ATTRIBUTE ::= { at-pskc-algorithmParameters ATTRIBUTE ::= {
TYPE PSKCAlgorithmParameters TYPE PSKCAlgorithmParameters
IDENTIFIED BY id-pskc-algorithmParameters } IDENTIFIED BY id-pskc-algorithmParams }
id-pskc-algorithmParameters OBJECT IDENTIFIER ::= { TBD }
id-pskc-algorithmParams OBJECT IDENTIFIER ::= { id-pskc 15 }
The Algorithm Parameters attribute has the following syntax: The Algorithm Parameters attribute has the following syntax:
PSKCAlgorithmParameters ::= CHOICE { PSKCAlgorithmParameters ::= CHOICE {
challengeFormat [0] ChallengeFormat, challengeFormat [0] ChallengeFormat,
responseFormat [1] ResponseFormat, responseFormat [1] ResponseFormat,
... } ... }
ChallengeFormat ::= SEQUENCE { ChallengeFormat ::= SEQUENCE {
encoding Encoding, encoding Encoding,
checkDigit BOOLEAN DEFAULT FALSE, checkDigit BOOLEAN DEFAULT FALSE,
skipping to change at page 10, line 28 skipping to change at page 10, line 34
checkDigit BOOLEAN DEFAULT FALSE, checkDigit BOOLEAN DEFAULT FALSE,
... } ... }
The fields in PSKCAlgorithmParameters have the following meanings: The fields in PSKCAlgorithmParameters have the following meanings:
o ChallengeFormat defines the characteristics of the challenge in a o ChallengeFormat defines the characteristics of the challenge in a
CR usage scenario whereby the following fields are defined: CR usage scenario whereby the following fields are defined:
o encoding specifies the encoding of the challenge accepted by o encoding specifies the encoding of the challenge accepted by
the device and MUST be one of the following values: DECIMAL, the device and MUST be one of the following values: DECIMAL,
HEXADECIMAL, ALPHANUMERIC, BASE64, or BINARY. HEXADECIMAL, ALPHANUMERIC, BASE64, or BINARY. The BASE64
encoding is done as in Section 4 of [RFC4648].
o checkDigit indicates whether a device needs to check the o checkDigit indicates whether a device needs to check the
appended Luhn check digit, as defined in [LUHN], contained in a appended Luhn check digit, as defined in [LUHN], contained in a
challenge. The checkDigit MUST NOT be present if the encoding challenge. The checkDigit MUST NOT be present if the encoding
value is anything other than 'DECIMAL'. A value of TRUE value is anything other than 'DECIMAL'. A value of TRUE
indicates that the device will check the appended Luhn check indicates that the device will check the appended Luhn check
digit in a provided challenge. A value of FALSE indicates that digit in a provided challenge. A value of FALSE indicates that
the device will not check the appended Luhn check digit in the the device will not check the appended Luhn check digit in the
challenge. challenge.
skipping to change at page 11, line 14 skipping to change at page 11, line 23
o ResponseFormat defines the characteristics of the result of a o ResponseFormat defines the characteristics of the result of a
computation and defines the format of the OTP or the response to computation and defines the format of the OTP or the response to
a challenge. For cases where the key is a personal a challenge. For cases where the key is a personal
identification number (PIN) value, this element contains the identification number (PIN) value, this element contains the
format of the PIN itself (e.g., DECIMAL, length 4 for a 4 digit format of the PIN itself (e.g., DECIMAL, length 4 for a 4 digit
PIN). The following fields are defined: PIN). The following fields are defined:
o encoding specifies the encoding of the response generated by o encoding specifies the encoding of the response generated by
the device and MUST be one of the following values: DECIMAL, the device and MUST be one of the following values: DECIMAL,
HEXADECIMAL, ALPHANUMERIC, BASE64, or BINARY. HEXADECIMAL, ALPHANUMERIC, BASE64, or BINARY. BASE64 is
defined as in Section 4 of [RFC4648].
o length defines the length of the response generated by the o length defines the length of the response generated by the
device. If encoding is 'DECIMAL', 'HEXADECIMAL' or device. If encoding is 'DECIMAL', 'HEXADECIMAL' or
'ALPHANUMERIC' this value indicates the number of 'ALPHANUMERIC' this value indicates the number of
digits/characters. If encoding is 'BASE64' or 'BINARY', this digits/characters. If encoding is 'BASE64' or 'BINARY', this
value indicates the number of bytes of the unencoded value. value indicates the number of bytes of the unencoded value.
o checkDigit indicates whether the device needs to append a Luhn o checkDigit indicates whether the device needs to append a Luhn
check digit, as defined in [LUHN], to the response. This is check digit, as defined in [LUHN], to the response. This is
only valid if encoding attribute is 'DECIMAL'. If the value is only valid if encoding attribute is 'DECIMAL'. If the value is
skipping to change at page 11, line 37 skipping to change at page 11, line 47
append a Luhn check digit to the response. append a Luhn check digit to the response.
3.2.8. Counter 3.2.8. Counter
The Counter attribute contains the event counter for event-based OTP The Counter attribute contains the event counter for event-based OTP
algorithms. The attribute definition is as follows: algorithms. The attribute definition is as follows:
at-pskc-counter ATTRIBUTE ::= { at-pskc-counter ATTRIBUTE ::= {
TYPE INTEGER(0..MAX) IDENTIFIED BY id-pskc-counter } TYPE INTEGER(0..MAX) IDENTIFIED BY id-pskc-counter }
id-pskc-counter OBJECT IDENTIFIER ::= { TBD } id-pskc-counter OBJECT IDENTIFIER ::= { id-pskc 16 }
3.2.9. Time 3.2.9. Time
The Time attribute conveys the time for time-based OTP algorithms. The Time attribute conveys the time for time-based OTP algorithms.
If the Time Interval attribute is included, then this element carries If the Time Interval attribute is included, then this element carries
the number of time intervals passed for a specific start point. It the number of time intervals passed for a specific start point. It
uses the BinaryTime syntax from [RFC4049]. The attribute definition uses the BinaryTime syntax from [RFC4049]. The attribute definition
is as follows: is as follows:
at-pskc-time ATTRIBUTE ::= { at-pskc-time ATTRIBUTE ::= {
TYPE BinaryTime IDENTIFIED BY id-pskc-time } TYPE BinaryTime IDENTIFIED BY id-pskc-time }
id-pskc-time OBJECT IDENTIFIER ::= { TBD } id-pskc-time OBJECT IDENTIFIER ::= { id-pskc 17 }
3.2.10. Time Interval 3.2.10. Time Interval
The Time Interval attribute conveys the time interval value for time- The Time Interval attribute conveys the time interval value for time-
based OTP algorithms. It is an integer. The attribute definition is based OTP algorithms. It is an integer. The attribute definition is
as follows: as follows:
at-pskc-timeInterval ATTRIBUTE ::= { at-pskc-timeInterval ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-time } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeInterval }
id-pskc-timeInterval OBJECT IDENTIFIER ::= { TBD } id-pskc-timeInterval OBJECT IDENTIFIER ::= { id-pskc 18 }
3.2.11. Time Drift 3.2.11. Time Drift
The Time Drift attribute contains the device clock drift value, the The Time Drift attribute contains the device clock drift value, the
number of seconds per day the device clocks drifts, for time-based number of seconds per day the device clocks drifts, for time-based
OTP algorithms. It is an integer. The attribute definition is as OTP algorithms. It is an integer. The attribute definition is as
follows: follows:
at-pskc-timeDrift ATTRIBUTE ::= { at-pskc-timeDrift ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-time } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeDrift }
id-pskc-timeDrift OBJECT IDENTIFIER ::= { TBD } id-pskc-timeDrift OBJECT IDENTIFIER ::= { id-pskc 19 }
3.2.12. Value MAC 3.2.12. Value MAC
The Value MAC attribute is a Message Authentication Code (MAC) The Value MAC attribute is a Message Authentication Code (MAC)
generated from the encrypted value in case the encryption algorithm generated from the encrypted value in case the encryption algorithm
does not support integrity checks (e.g., AES-CBC does not provide does not support integrity checks (e.g., AES-CBC does not provide
integrity while AES Key Wrap with MLI does). The attribute definition integrity while AES Key Wrap with MLI does). The attribute definition
is as follows: is as follows:
at-pskc-valueMAC ATTRIBUTE ::= { at-pskc-valueMAC ATTRIBUTE ::= {
TYPE ValueMac IDENTIFIED BY id-pskc-valueMAC } TYPE ValueMac IDENTIFIED BY id-pskc-valueMAC }
id-pskc-valueMAC OBJECT IDENTIFIER ::= { TBD } id-pskc-valueMAC OBJECT IDENTIFIER ::= { id-pskc 20 }
ValueMac ::= SEQUENCE { ValueMac ::= SEQUENCE {
macAlgorithm UTF8String, macAlgorithm UTF8String,
mac UTF8String } mac UTF8String }
The fields in ValueMac have the following meanings: The fields in ValueMac have the following meanings:
o macAlgorithm identifies the MAC algorithm used to generate the o macAlgorithm identifies the MAC algorithm used to generate the
value placed in digest. Values may be taken from [PSKC-ALGORITHM- value placed in digest.
PROFILES].
o mac is the base64 encoded [RFC4648] mac value. o mac is the base64 encoded, as specified in Section 4 of [RFC4648],
mac value.
3.3. Key Policy Attributes 3.3. Key Policy Attributes
Key policy attributes indicate a policy that can be attached to a Key policy attributes indicate a policy that can be attached to a
key. These attributes are defined in the subsections that follow. key. These attributes are defined in the subsections that follow.
3.3.1. Start Date 3.3.1. Key Start Date
When included in sKeyAttrs, the Start Date attribute indicates the When included in sKeyAttrs, the Key Start Date attribute indicates
start of the keys validity. The date MUST be expressed in UTC form the start of the keys validity. The date MUST be expressed in UTC
with no time zone component. Implementations SHOULD NOT rely on time form with no time zone component. Implementations SHOULD NOT rely on
resolution finer than milliseconds and MUST NOT generate time time resolution finer than milliseconds and MUST NOT generate time
instants that specify leap seconds. The attribute definition is as instants that specify leap seconds. The attribute definition is as
in Section 3.1.1.6. follows:
3.3.2. Expiry Date at-pskc-keyStartDate ATTRIBUTE ::= {
When included in sKeyAttrs, the Expiry Date attribute indicates the TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyStartDate }
end of the key's validity period. The date MUST be expressed in UTC
form with no time zone component. Implementations SHOULD NOT rely on id-pskc-keyStartDate OBJECT IDENTIFIER ::= { id-pskc 21 }
time resolution finer than milliseconds and MUST NOT generate time
instants that specify leap seconds. The attribute definition is as in 3.3.2. Key Expiry Date
Section 3.1.1.7.
When included in sKeyAttrs, the Key Expiry Date attribute indicates
the end of the key's validity period. The date MUST be expressed in
UTC form with no time zone component. Implementations SHOULD NOT
rely on time resolution finer than milliseconds and MUST NOT generate
time instants that specify leap seconds. The attribute definition is
as follows:
at-pskc-keyExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyExpiryDate }
id-pskc-keyExpiryDate OBJECT IDENTIFIER ::= { id-pskc 22 }
3.3.3. Number of Transactions 3.3.3. Number of Transactions
The Number of Transactions attribute indicates the maximum number of The Number of Transactions attribute indicates the maximum number of
times a key carried within the package can be used. When this times a key carried within the package can be used. When this
element is omitted there is no restriction regarding the number of element is omitted there is no restriction regarding the number of
times a key can be used. The attribute definition is as follows: times a key can be used. The attribute definition is as follows:
at-pskc-numberOfTransactions ATTRIBUTE ::= { at-pskc-noOfTransactions ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-numberOfTransactions } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-noOfTransactions }
id-pskc-numberOfTransactions OBJECT IDENTIFIER ::= { TBD } id-pskc-noOfTransactions OBJECT IDENTIFIER ::= { id-pskc 23 }
3.3.4. Key Usage 3.3.4. Key Usage
The Key Usage attribute constrains the intended usage of the key. The Key Usage attribute constrains the intended usage of the key.
The recipient MUST enforce the key usage. The attribute definition The recipient MUST enforce the key usage. The attribute definition
is as follows: is as follows:
at-pskc-keyUsage ATTRIBUTE ::= { at-pskc-keyUsage ATTRIBUTE ::= {
TYPE PSKCKeyUsages IDENTIFIED BY id-pskc-keyUsages } TYPE PSKCKeyUsages IDENTIFIED BY id-pskc-keyUsages }
id-pskc-keyUsages OBJECT IDENTIFIER ::= { TBD } id-pskc-keyUsages OBJECT IDENTIFIER ::= { id-pskc 24 }
PSKCKeyUsages ::= SEQUENCE OF PSKCKeyUsage PSKCKeyUsages ::= SEQUENCE OF PSKCKeyUsage
PSKCKeyUsage ::= UTF8String ("OTP" | "CR" | "Encrypt" | PSKCKeyUsage ::= UTF8String ("OTP" | "CR" | "Encrypt" |
"Integrity" | "Verify" | "Unlock" | "Decrypt" | "Integrity" | "Verify" | "Unlock" | "Decrypt" |
"KeyWrap" | "Unwrap" | "Derive" | "Generate") "KeyWrap" | "Unwrap" | "Derive" | "Generate")
The fields in PSKCKeyUsage have the following meanings: The fields in PSKCKeyUsage have the following meanings:
o OTP: The key MUST only be used for OTP generation. o OTP: The key MUST only be used for OTP generation.
o CR: The key MUST only be used for Challenge/Response purposes. o CR: The key MUST only be used for Challenge/Response purposes.
skipping to change at page 14, line 20 skipping to change at page 14, line 46
o OTP: The key MUST only be used for OTP generation. o OTP: The key MUST only be used for OTP generation.
o CR: The key MUST only be used for Challenge/Response purposes. o CR: The key MUST only be used for Challenge/Response purposes.
o Encrypt: The key MUST only be used for data encryption purposes. o Encrypt: The key MUST only be used for data encryption purposes.
o Integrity: The key MUST only be used to generate a keyed message o Integrity: The key MUST only be used to generate a keyed message
digest for data integrity or authentication purposes. digest for data integrity or authentication purposes.
o Verify: The key MUST only be used to verify a keyed message o Verify: The key MUST only be used to verify a keyed message
digest for data integrity or authentication purposes. (is converse digest for data integrity or authentication purposes (is converse
of Integrity) of Integrity).
o Unlock: The key MUST only be used for an inverse challenge o Unlock: The key MUST only be used for an inverse challenge
response in the case where a user has locked the device by response in the case where a user has locked the device by
entering a wrong PIN too many times (for devices with PIN-input entering a wrong PIN too many times (for devices with PIN-input
capability). capability).
o Decrypt: The key MUST only be used for data decryption purposes. o Decrypt: The key MUST only be used for data decryption purposes.
o KeyWrap: The key MUST only be used for key wrap purposes. o KeyWrap: The key MUST only be used for key wrap purposes.
skipping to change at page 14, line 49 skipping to change at page 15, line 28
Section 8.1.5.2.1 of [NIST800-57]). Section 8.1.5.2.1 of [NIST800-57]).
3.3.5. PIN Policy 3.3.5. PIN Policy
The PIN Policy attribute allows policy about the PIN usage to be The PIN Policy attribute allows policy about the PIN usage to be
associated with the key. The attribute definition is as follows: associated with the key. The attribute definition is as follows:
at-pskc-pinPolicy ATTRIBUTE ::= { at-pskc-pinPolicy ATTRIBUTE ::= {
TYPE PINPolicy IDENTIFIED BY id-pskc-pinPolicy } TYPE PINPolicy IDENTIFIED BY id-pskc-pinPolicy }
id-pskc-pinPolicy OBJECT IDENTIFIER ::= { TBD } id-pskc-pinPolicy OBJECT IDENTIFIER ::= { id-pskc 25 }
PINPolicy ::= SEQUENCE { PINPolicy ::= SEQUENCE {
pinKeyId [0] UTF8String OPTIONAL, pinKeyId [0] UTF8String OPTIONAL,
pinUsageMode [1] PINUsageMode, pinUsageMode [1] PINUsageMode,
maxFailedAttempts [2] INTEGER (0..MAX) OPTIONAL, maxFailedAttempts [2] INTEGER (0..MAX) OPTIONAL,
minLength [3] INTEGER (0..MAX) OPTIONAL, minLength [3] INTEGER (0..MAX) OPTIONAL,
maxLength [4] INTEGER (0..MAX) OPTIONAL, maxLength [4] INTEGER (0..MAX) OPTIONAL,
pinEncoding [5] Encoding OPTIONAL } pinEncoding [5] Encoding OPTIONAL }
PINUsageMode ::= UTF8String ("Local" | "Prepend" | "Append" | PINUsageMode ::= UTF8String ("Local" | "Prepend" | "Append" |
"Algorithmic") "Algorithmic")
The fields in PIN Policy have the following meanings: The fields in PIN Policy have the following meanings:
o pinKeyId uniquely identifies the key held within this container o pinKeyId uniquely identifies the key held within this container
that contains the value of the PIN that protects the key. that contains the value of the PIN that protects the key.
o pinUsageMode indicates the way the PIN is used during the usage of o pinUsageMode indicates the way the PIN is used during the
the key. The following values are defined: Local, Prepend, usage of the key. The following values are defined in [PSKC]:
Append, Algorithmic. Local, Prepend, Append, Algorithmic.
o maxFailedAttempts indicates the maximum number of times the PIN o maxFailedAttempts indicates the maximum number of times the PIN
may be entered wrongly before it MUST NOT be possible to use the may be entered wrongly before it MUST NOT be possible to use the
key anymore. key anymore.
o minLength indicates the minimum length of a PIN that can be set to o minLength indicates the minimum length of a PIN that can be set to
protect the associated key. It MUST NOT be possible to set a PIN protect the associated key. It MUST NOT be possible to set a PIN
shorter than this value. If pinEncoding is 'DECIMAL', shorter than this value. If pinEncoding is 'DECIMAL',
'HEXADECIMAL' or 'ALPHANUMERIC' this value indicates the number of 'HEXADECIMAL' or 'ALPHANUMERIC' this value indicates the number of
digits/ characters. If pinEncoding is 'BASE64' or 'BINARY', this digits/ characters. If pinEncoding is 'BASE64' or 'BINARY', this
skipping to change at page 16, line 19 skipping to change at page 16, line 46
ensure that, it is necessary to define a correspondence between the ensure that, it is necessary to define a correspondence between the
abstract syntax of sKey and the notation in the standard algorithm abstract syntax of sKey and the notation in the standard algorithm
description that defines how the key is used. The next sections description that defines how the key is used. The next sections
establish that correspondence for the algorithms AES [FIPS197] and establish that correspondence for the algorithms AES [FIPS197] and
TDEA [SP800-67]. TDEA [SP800-67].
4.1. AES Key Encoding 4.1. AES Key Encoding
[FIPS197] section 5.2, titled Key Expansion, uses the input key as an [FIPS197] section 5.2, titled Key Expansion, uses the input key as an
array of bytes indexed starting at 0. The first octet of sKey SHALL array of bytes indexed starting at 0. The first octet of sKey SHALL
become the key byte in AES labeled index 0 in [FIPS197] SHALL be the become the key byte in AES labeled index 0 in [FIPS197]; it SHALL be
first octet of sKey, and the other key bytes SHALL follow in index the first octet of sKey, and the other key bytes SHALL follow in
order. index order.
Proper parsing and key load of the contents of sKey for AES SHALL be Proper parsing and key load of the contents of sKey for AES SHALL be
determined by using the following sKey octet string to generate and determined by using the following sKey octet string to generate and
match the key expansion test vectors in [FIPS197] Appendix A for AES match the key expansion test vectors in [FIPS197] Appendix A for AES
Cipher Key: 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c Cipher Key: 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c
Tag Length Value Tag Length Value
04 16 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c 04 16 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c
4.2. Triple DES Key Encoding 4.2. Triple DES Key Encoding
skipping to change at page 16, line 43 skipping to change at page 17, line 22
A Triple-DES key consists of three keys for the cryptographic engine A Triple-DES key consists of three keys for the cryptographic engine
(Key1, Key2, and Key3) that are each 64 bits (even though only 56 are (Key1, Key2, and Key3) that are each 64 bits (even though only 56 are
used); the three keys are also referred to as a key bundle (KEY) used); the three keys are also referred to as a key bundle (KEY)
[SP800-67]. A key bundle may employ either two or three mutually [SP800-67]. A key bundle may employ either two or three mutually
independent keys. When only two are employed (called two-key Triple independent keys. When only two are employed (called two-key Triple
DES), then Key1 = Key3. DES), then Key1 = Key3.
Each key in a Triple-DES key bundle is expanded into a key schedule Each key in a Triple-DES key bundle is expanded into a key schedule
according to a procedure defined in [SP800-67] Appendix A. That according to a procedure defined in [SP800-67] Appendix A. That
procedure numbers the bits in the key from 1 to 64, with number 1 procedure numbers the bits in the key from 1 to 64, with number 1
being the left-most, or most significant bit. The first octet of being the left-most, or most significant bit (MSB). The first octet
sKey SHALL be bits 1 through 8 of Key1 with bit 1 being the msb. The of sKey SHALL be bits 1 through 8 of Key1 with bit 1 being the MSB.
second octet of sKey SHALL be bits 9 through 16 of Key1, and so The second octet of sKey SHALL be bits 9 through 16 of Key1, and so
forth, so that the trailing octet of sKEY SHALL be bits 57 through 64 forth, so that the trailing octet of sKEY SHALL be bits 57 through 64
of Key3 (or Key2 for two-key Triple DES). of Key3 (or Key2 for two-key Triple DES).
Proper parsing and key load of the contents of sKey for Triple-DES Proper parsing and key load of the contents of sKey for Triple-DES
SHALL be determined by using the following sKey octet string to SHALL be determined by using the following sKey octet string to
generate and match the key expansion test vectors in [SP800-67] generate and match the key expansion test vectors in [SP800-67]
appendix B for the key bundle: appendix B for the key bundle:
Key1 = 0123456789ABCDEF Key1 = 0123456789ABCDEF
Key2 = 23456789ABCDEF01 Key2 = 23456789ABCDEF01
Key3 = 456789ABCDEF0123 Key3 = 456789ABCDEF0123
Tag Length Value Tag Length Value
04 24 0123456789ABCDEF 23456789ABCDEF01 456789ABCDEF0123 04 24 0123456789ABCDEF 23456789ABCDEF01 456789ABCDEF0123
5. Security Considerations 5. Security Considerations
Implementers of this protocol are strongly encouraged to consider
generally accepted principles of secure key management when
integrating this capability within an overall security architecture.
The symmetric key package contents are not protected. This content The symmetric key package contents are not protected. This content
type can be combined with a security protocol to protect the contents type can be combined with a security protocol to protect the contents
of the package. One possibility is to include this content type in of the package. One possibility is to include this content type in
place of a PSKC package in Dynamic Symmetric Key Provisioning place of a PSKC package in [DSKPP] exchanges. In this case, the
Protocol (DSKPP) [DSKPP] exchanges. In this case, the algorithm algorithm requirements are found in those documents. Another
requirements are found in those documents. Another possibility is to possibility is to encapsulate this content type in a CMS [RFC5652]
encapsulate this content type in a CMS [CMS] protecting content type. protecting content type.
6. IANA Considerations 6. IANA Considerations
None: All identifiers are already registered. Please remove this This document makes use of object identifiers to identify a CMS
section prior to publication as an RFC. content type (Appendix A.1), the ASN.1 version of the PSKC attributes
(Appendix A.2), and the ASN.1 modules found in Appendix A.1 and A.2.
All OIDs are registered in an arc delegated by IANA to the SMIME
Working Group. No further action by IANA is necessary for this
document or any anticipated updates.
7. References 7. References
7.1. Normative References 7.1. Normative References
[FIPS197] National Institute of Standards. "FIPS Pub 197: Advanced [FIPS197] National Institute of Standards. "FIPS Pub 197:
Encryption Standard (AES)", 26 November 2001. Advanced Encryption Standard (AES)", 26 November 2001.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [LUHN] Luhn, H., "Luhn algorithm", US Patent 2950048, August
Requirement Levels", BCP 14, RFC 2119, March 1997. 1960, http://patft.uspto.gov/netacgi/nph-
Parser?patentnumber=2950048.
[RFC4049] Housley, R., "BinaryTime: An Alternate Format for [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Representing Date and Time in ASN.1", RFC 4049, April 2005. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO
Encodings", RFC 4648, October 2006. 10646", STD 63, RFC 3629, November 2003.
[RFCTBD1] Schaad, J., and P. Hoffman, "New ASN.1 Modules for PKIX", [RFC4049] Housley, R., "BinaryTime: An Alternate Format for
draft-ietf-pkix-new-asn1-07.txt, work-in-progress. Representing Date and Time in ASN.1", RFC 4049, April
2005.
[RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data
Encodings", RFC 4648, October 2006.
[RFC5646] Phillips, A. and M. Davis, "Tags for Identifying
Languages", BCP 47, RFC 5646, September 2009.
[RFCTBD1] Schaad, J., and P. Hoffman, "New ASN.1 Modules for
PKIX", draft-ietf-pkix-new-asn1-08.txt, work-in-
progress.
//** RFC EDITOR: Please replace [DSKPP] with [RFCXXXX] where XXXX is //** RFC EDITOR: Please replace [DSKPP] with [RFCXXXX] where XXXX is
the draft-ietf-pkix-new-asn1's RFC #. Make the replacements here and the draft-ietf-pkix-new-asn1's RFC #. Make the replacements here and
elsewhere in the document. **// elsewhere in the document. **//
[RFCTBD2] Schaad, J., and P. Hoffman, "New ASN.1 Modules for [RFCTBD2] Schaad, J., and P. Hoffman, "New ASN.1 Modules for
SMIME", draft-ietf-smime-new-asn1-07.txt, work-in-progress. SMIME", draft-ietf-smime-new-asn1-07.txt, work-in-
progress.
//** RFC EDITOR: Please replace [DSKPP] with [RFCXXXX] where XXXX is //** RFC EDITOR: Please replace [DSKPP] with [RFCXXXX] where XXXX is
the draft-ietf-smime-new-asn1's RFC #. Make the replacements here the draft-ietf-smime-new-asn1's RFC #. Make the replacements here
and elsewhere in the document. **// and elsewhere in the document. **//
[X.680] ITU-T Recommendation X.680 (2002) | ISO/IEC 8824-1:2002. [PSKC] Hoyer, P., Pei, M., and S. Machani, "Portable Symmetric
Information Technology - Abstract Syntax Notation One. Key Container (PSKC), draft-ietf-keyprov-pskc-05.txt,
work-in-progress.
[X.681] ITU-T Recommendation X.681 (2002) | ISO/IEC 8824-2:2002.
Information Technology - Abstract Syntax Notation One: Information
Object Specification.
[X.682] ITU-T Recommendation X.682 (2002) | ISO/IEC 8824-3:2002. //** RFC EDITOR: Please replace [PSKC] with [RFCXXXX] where XXXX is
Information Technology - Abstract Syntax Notation One: Constraint the draft-ietf-keyprov-pskc's RFC #. Make the replacements here and
Specification. elsewhere in the document. **//
[X.683] ITU-T Recommendation X.683 (2002) | ISO/IEC 8824-4:2002. [X.680] ITU-T Recommendation X.680 (2002) | ISO/IEC 8824-
Information Technology - Abstract Syntax Notation One: 1:2002. Information Technology - Abstract Syntax
Parameterization of ASN.1 Specifications. Notation One.
[X.690] ITU-T Recommendation X.690 (2002) | ISO/IEC 8825-1:2002. [X.681] ITU-T Recommendation X.681 (2002) | ISO/IEC 8824-
Information Technology - ASN.1 encoding rules: Specification of Basic 2:2002. Information Technology - Abstract Syntax
Encoding Rules (BER), Canonical Encoding Rules (CER) and Notation One: Information Object Specification.
Distinguished Encoding Rules (DER).
[SP800-67] National Institute of Standards and Technology, "NIST [X.682] ITU-T Recommendation X.682 (2002) | ISO/IEC 8824-
Special Publication 800-67 Version 1.1: Recommendation for the Triple 3:2002. Information Technology - Abstract Syntax
Data Encryption Algorithm (TDEA) Block Cipher", NIST Special Notation One: Constraint Specification.
Publication 800-67, May 2008.
7.2. Non-Normative References [X.683] ITU-T Recommendation X.683 (2002) | ISO/IEC 8824-
4:2002. Information Technology - Abstract Syntax
Notation One: Parameterization of ASN.1 Specifications.
[DSKPP] Doherty, A., Pei, M., Machani, S., and M. Nystrom, "Dynamic [X.690] ITU-T Recommendation X.690 (2002) | ISO/IEC 8825-
Symmetric Key Provisioning Protocol", Internet Draft Informational, 1:2002. Information Technology - ASN.1 encoding rules:
URL: http://www.ietf.org/internet-drafts/draft-ietf-keyprov-dskpp- Specification of Basic Encoding Rules (BER), Canonical
09.txt, work in progress. Encoding Rules (CER) and Distinguished Encoding Rules
(DER).
//** RFC EDITOR: Please replace [DSKPP] with [RFCXXXX] where XXXX is [SP800-67] National Institute of Standards and Technology, "NIST
the draft-ietf-keyprov-dskpp's RFC #. Make the replacements here and Special Publication 800-67 Version 1.1: Recommendation
elsewhere in the document. **// for the Triple Data Encryption Algorithm (TDEA) Block
Cipher", NIST Special Publication 800-67, May 2008.
[LUHN] Luhn, H., "Luhn algorithm", US Patent 2950048, August 1960, 7.2. Informative References
http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=2950048.
[PSKC] Hoyer, P., Pei, M., and S. Machani, "Portable Symmetric Key [DSKPP] Doherty, A., Pei, M., Machani, S., and M. Nystrom,
Container (PSKC), draft-ietf-keyprov-pskc-05.txt, work-in-progress. "Dynamic Symmetric Key Provisioning Protocol", Internet
Draft Informational, URL: http://www.ietf.org/internet-
drafts/draft-ietf-keyprov-dskpp-10.txt, work in
progress.
//** RFC EDITOR: Please replace [PSKC] with [RFCXXXX] where XXXX is //** RFC EDITOR: Please replace [DSKPP] with [RFCXXXX] where XXXX is
the draft-ietf-keyprov-pskc's RFC #. Make the replacements here and the draft-ietf-keyprov-dskpp's RFC #. Make the replacements here and
elsewhere in the document. **// elsewhere in the document. **//
[PSKC-ALGORITHM-PROFILES] Hoyer, P., Pei, M., Machani, S., and A.
Doherty, "Additional Portable Symmetric Key Container (PSKC)
Algorithm Profiles", Internet Draft Informational, URL:
http://tools.ietf.org/html/draft-hoyer-keyprov-pskc-algorithm-
profiles-00, December 2008.
//** RFC EDITOR: Please replace [PSKC-ALGORITHM-PROFILES] with
[RFCXXXX] where XXXX is this ID's RFC #. Make the replacements here
and elsewhere in the document. **//
[NIST800-57] National Institute of Standards and Technology, "NIST [NIST800-57] National Institute of Standards and Technology, "NIST
Special Publication 800-57, Recommendation for Key Management - Part Special Publication 800-57, Recommendation for Key
1: General (Revised)", NIST Special Publication 800-57, March 2007. Management - Part 1: General (Revised)", NIST Special
Publication 800-57, March 2007.
[RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", RFC [RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", RFC
5652, September 2009. 5652, September 2009.
APPENDIX A: ASN.1 Module APPENDIX A: ASN.1 Module
This appendix provides the normative ASN.1 definitions for the This appendix provides the normative ASN.1 definitions for the
structures described in this specification using ASN.1 as defined in structures described in this specification using ASN.1 as defined in
[X.680] through [X.683]. [X.680] through [X.683].
A.1. Symmetric Key Package ASN.1 Module A.1. Symmetric Key Package ASN.1 Module
SymmetricKeyPackageModulev1 SymmetricKeyPackageModulev1
skipping to change at page 20, line 21 skipping to change at page 21, line 14
-- From New SMIME ASN.1 [RFCTBD2] -- From New SMIME ASN.1 [RFCTBD2]
CONTENT-TYPE, Attribute{} CONTENT-TYPE, Attribute{}
FROM CryptographicMessageSyntax-2009 FROM CryptographicMessageSyntax-2009
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-cms-2004-02(41) } smime(16) modules(0) id-mod-cms-2004-02(41) }
; ;
KeyPackageContentTypes CONTENT-TYPE ::= { ContentSet CONTENT-TYPE ::= {
ct-symmetric-key-package, ct-symmetric-key-package,
... -- Expect additional content types -- ... -- Expect additional content types --
} }
ct-symmetric-key-package CONTENT-TYPE ::= ct-symmetric-key-package CONTENT-TYPE ::=
{ SymmetricKeyPackage IDENTIFIED BY id-ct-KP-sKeyPackage } { SymmetricKeyPackage IDENTIFIED BY id-ct-KP-sKeyPackage }
id-ct-KP-sKeyPackage OBJECT IDENTIFIER ::= id-ct-KP-sKeyPackage OBJECT IDENTIFIER ::=
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9) { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) ct(1) 25 } smime(16) ct(1) 25 }
skipping to change at page 21, line 14 skipping to change at page 22, line 9
SKeyPkgAttributes ATTRIBUTE ::= { ... } SKeyPkgAttributes ATTRIBUTE ::= { ... }
SKeyAttributes ATTRIBUTE ::= { ... } SKeyAttributes ATTRIBUTE ::= { ... }
END END
A.2. PSKC ASN.1 Module A.2. PSKC ASN.1 Module
PSKCAttributesModule PSKCAttributesModule
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) TBD } smime(16) modules(0) id-mod-pskcAttributesModule(53) }
DEFINITIONS IMPLICIT TAGS ::= DEFINITIONS IMPLICIT TAGS ::=
BEGIN BEGIN
-- EXPORTS ALL -- EXPORTS ALL
IMPORTS IMPORTS
-- From New PKIX ASN.1 [RFCTBD1] -- From New PKIX ASN.1 [RFCTBD1]
skipping to change at page 21, line 37 skipping to change at page 22, line 32
FROM PKIX-CommonTypes-2009 FROM PKIX-CommonTypes-2009
{ iso(1) identified-organization(3) dod(6) internet(1) { iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) } id-mod-pkixCommon-02(57) }
-- From BinaryTime [RFC4049] -- From BinaryTime [RFC4049]
BinaryTime BinaryTime
FROM BinarySigningTimeModule FROM BinarySigningTimeModule
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) 27 } smime(16) modules(0) id-mod-binarySigningTime(27) }
id-smime
FROM SecureMimeMessageV3dot1-2009
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-msg-v3dot1-02(39) }
; ;
-- --
-- PSKC Attributes OIDs are taken from the SMIME Arc.
--
id-pskc OBJECT IDENTIFIER ::= { id-smime 12 }
--
-- Merge SKeyPKGAttributes to the set of attributes for sKeyPkgAttrs -- Merge SKeyPKGAttributes to the set of attributes for sKeyPkgAttrs
-- --
SKeyPkgAttributes ATTRIBUTE ::= { SKeyPkgAttributes ATTRIBUTE ::= {
at-pskc-manufacturer | at-pskc-serialNo | at-pskc-model | at-pskc-manufacturer | at-pskc-serialNo | at-pskc-model |
at-pskc-issueNo | at-pskc-deviceBinding | at-pskc-startDate | at-pskc-issueNo | at-pskc-deviceBinding |
at-pskc-expiryDate, ... } at-pskc-deviceStartDate | at-pskc-deviceExpiryDate |
at-pskc-moduleId, ... }
-- --
-- Merge SKeyAttributes to the set of attributes for sKeyAttrs -- Merge SKeyAttributes to the set of attributes for sKeyAttrs
-- --
SKeyAttributes ATTRIBUTE ::= { SKeyAttributes ATTRIBUTE ::= {
at-pskc-startDate | at-pskc-expiryDate | at-pskc-keyId | at-pskc-algorithm | at-pskc-issuer |
at-pskc-id | at-pskc-algorithm | at-pskc-issuer |
at-pskc-keyProfileId | at-pskc-keyReference | at-pskc-keyProfileId | at-pskc-keyReference |
at-pskc-friendlyName | at-pskc-algorithmParameters | at-pskc-friendlyName | at-pskc-algorithmParameters |
at-pskc-counter | at-pskc-time | at-pskc-timeInterval | at-pskc-counter | at-pskc-time | at-pskc-timeInterval |
at-pskc-timeDrift | at-pskc-valueMAC | at-pskc-timeDrift | at-pskc-valueMAC | at-pskc-keyStartDate |
at-pskc-numberOfTransactions | at-pskc-keyUsage | at-pskc-keyExpiryDate | at-pskc-numberOfTransactions |
at-pskc-pinPolicy, ... } at-pskc-keyUsage | at-pskc-pinPolicy, ... }
at-pskc-manufacturer ATTRIBUTE ::= { at-pskc-manufacturer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer } TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }
id-pskc-manufacturer OBJECT IDENTIFIER ::= { TBD } id-pskc-manufacturer OBJECT IDENTIFIER ::= { id-pskc 1 }
at-pskc-serialNo ATTRIBUTE ::= { at-pskc-serialNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-serialNo } TYPE UTF8String IDENTIFIED BY id-pskc-serialNo }
id-pskc-serialNo OBJECT IDENTIFIER ::= { TBD } id-pskc-serialNo OBJECT IDENTIFIER ::= { id-pskc 2 }
at-pskc-model ATTRIBUTE ::= { at-pskc-model ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-model } TYPE UTF8String IDENTIFIED BY id-pskc-model }
id-pskc-model OBJECT IDENTIFIER ::= { TBD } id-pskc-model OBJECT IDENTIFIER ::= { id-pskc 3 }
at-pskc-issueNo ATTRIBUTE ::= { at-pskc-issueNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issueNo } TYPE UTF8String IDENTIFIED BY id-pskc-issueNo }
id-pskc-issueNo OBJECT IDENTIFIER ::= { TBD } id-pskc-issueNo OBJECT IDENTIFIER ::= { id-pskc 4 }
at-pskc-deviceBinding ATTRIBUTE ::= { at-pskc-deviceBinding ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceBinding } TYPE UTF8String IDENTIFIED BY id-pskc-deviceBinding }
id-pskc-deviceBinding OBJECT IDENTIFIER ::= { TBD } id-pskc-deviceBinding OBJECT IDENTIFIER ::= { id-pskc 5 }
at-pskc-deviceStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceStartDate }
at-pskc-startDate ATTRIBUTE ::= { id-pskc-deviceStartDate OBJECT IDENTIFIER ::= { id-pskc 6 }
TYPE GeneralizedTime IDENTIFIED BY id-pskc-startDate }
id-pskc-startDate OBJECT IDENTIFIER ::= { TBD } at-pskc-deviceExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceExpiryDate }
at-pskc-expiryDate ATTRIBUTE ::= { id-pskc-deviceExpiryDate OBJECT IDENTIFIER ::= { id-pskc 7 }
TYPE GeneralizedTime IDENTIFIED BY id-pskc-expiryDate }
id-pskc-expiryDate OBJECT IDENTIFIER ::= { TBD } at-pskc-moduleId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-moduleId }
at-pskc-id ATTRIBUTE ::= { id-pskc-moduleId OBJECT IDENTIFIER ::= { id-pskc 8 }
TYPE UTF8String IDENTIFIED BY id-pskc-id }
id-pskc-id OBJECT IDENTIFIER ::= { TBD } at-pskc-keyId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyId }
id-pskc-keyId OBJECT IDENTIFIER ::= { id-pskc 9 }
at-pskc-algorithm ATTRIBUTE ::= { at-pskc-algorithm ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-algorithm } TYPE UTF8String IDENTIFIED BY id-pskc-algorithm }
id-pskc-algorithm OBJECT IDENTIFIER ::= { TBD } id-pskc-algorithm OBJECT IDENTIFIER ::= { id-pskc 10 }
at-pskc-issuer ATTRIBUTE ::= { at-pskc-issuer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-issuer } TYPE UTF8String IDENTIFIED BY id-pskc-issuer }
id-pskc-issuer OBJECT IDENTIFIER ::= { TBD } id-pskc-issuer OBJECT IDENTIFIER ::= { id-pskc 11 }
at-pskc-keyProfileId ATTRIBUTE ::= { at-pskc-keyProfileId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyProfileId } TYPE UTF8String IDENTIFIED BY id-pskc-keyProfileId }
id-pskc-keyProfileId OBJECT IDENTIFIER ::= { TBD } id-pskc-keyProfileId OBJECT IDENTIFIER ::= { id-pskc 12 }
at-pskc-keyReference ATTRIBUTE ::= { at-pskc-keyReference ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyReference } TYPE UTF8String IDENTIFIED BY id-pskc-keyReference }
id-pskc-keyReference OBJECT IDENTIFIER ::= { TBD } id-pskc-keyReference OBJECT IDENTIFIER ::= { id-pskc 13 }
at-pskc-friendlyName ATTRIBUTE ::= { at-pskc-friendlyName ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName } TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName }
id-pskc-friendlyName OBJECT IDENTIFIER ::= { TBD } id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }
at-pskc-algorithmParameters ATTRIBUTE ::= { at-pskc-algorithmParameters ATTRIBUTE ::= {
TYPE PSKCAlgorithmParameters TYPE PSKCAlgorithmParameters
IDENTIFIED BY id-pskc-algorithmParameters } IDENTIFIED BY id-pskc-algorithmParameters }
id-pskc-algorithmParameters OBJECT IDENTIFIER ::= { TBD } id-pskc-algorithmParameters OBJECT IDENTIFIER ::= { id-pskc 15 }
PSKCAlgorithmParameters ::= CHOICE { PSKCAlgorithmParameters ::= CHOICE {
challengeFormat [0] ChallengeFormat, challengeFormat [0] ChallengeFormat,
responseFormat [1] ResponseFormat, responseFormat [1] ResponseFormat,
... } ... }
ChallengeFormat ::= SEQUENCE { ChallengeFormat ::= SEQUENCE {
encoding Encoding, encoding Encoding,
checkDigit BOOLEAN DEFAULT FALSE, checkDigit BOOLEAN DEFAULT FALSE,
min INTEGER (0..MAX), min INTEGER (0..MAX),
skipping to change at page 24, line 24 skipping to change at page 25, line 34
ResponseFormat ::= SEQUENCE { ResponseFormat ::= SEQUENCE {
encoding Encoding, encoding Encoding,
length INTEGER (0..MAX), length INTEGER (0..MAX),
checkDigit BOOLEAN DEFAULT FALSE, checkDigit BOOLEAN DEFAULT FALSE,
... } ... }
at-pskc-counter ATTRIBUTE ::= { at-pskc-counter ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-counter } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-counter }
id-pskc-counter OBJECT IDENTIFIER ::= { TBD } id-pskc-counter OBJECT IDENTIFIER ::= { id-pskc 16 }
at-pskc-time ATTRIBUTE ::= { at-pskc-time ATTRIBUTE ::= {
TYPE BinaryTime IDENTIFIED BY id-pskc-time } TYPE BinaryTime IDENTIFIED BY id-pskc-time }
id-pskc-time OBJECT IDENTIFIER ::= { TBD } id-pskc-time OBJECT IDENTIFIER ::= { id-pskc 17 }
at-pskc-timeInterval ATTRIBUTE ::= { at-pskc-timeInterval ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-time } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeInterval }
id-pskc-timeInterval OBJECT IDENTIFIER ::= { TBD } id-pskc-timeInterval OBJECT IDENTIFIER ::= { id-pskc 18 }
at-pskc-timeDrift ATTRIBUTE ::= { at-pskc-timeDrift ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-time } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeDrift }
id-pskc-timeDrift OBJECT IDENTIFIER ::= { TBD }
id-pskc-timeDrift OBJECT IDENTIFIER ::= { id-pskc 19 }
at-pskc-valueMAC ATTRIBUTE ::= { at-pskc-valueMAC ATTRIBUTE ::= {
TYPE ValueMac IDENTIFIED BY id-pskc-valueMAC } TYPE ValueMac IDENTIFIED BY id-pskc-valueMAC }
id-pskc-valueMAC OBJECT IDENTIFIER ::= { TBD } id-pskc-valueMAC OBJECT IDENTIFIER ::= { id-pskc 20 }
ValueMac ::= SEQUENCE { ValueMac ::= SEQUENCE {
macAlgorithm UTF8String, macAlgorithm UTF8String,
mac UTF8String } mac UTF8String }
at-pskc-keyStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyStartDate }
id-pskc-keyStartDate OBJECT IDENTIFIER ::= { id-pskc 21 }
at-pskc-keyExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyExpiryDate }
id-pskc-keyExpiryDate OBJECT IDENTIFIER ::= { id-pskc 22 }
at-pskc-numberOfTransactions ATTRIBUTE ::= { at-pskc-numberOfTransactions ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-numberOfTransactions } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-numberOfTransactions }
id-pskc-numberOfTransactions OBJECT IDENTIFIER ::= { TBD } id-pskc-numberOfTransactions OBJECT IDENTIFIER ::= { id-pskc 23 }
at-pskc-keyUsage ATTRIBUTE ::= { at-pskc-keyUsage ATTRIBUTE ::= {
TYPE PSKCKeyUsages IDENTIFIED BY id-pskc-keyUsages } TYPE PSKCKeyUsages IDENTIFIED BY id-pskc-keyUsages }
id-pskc-keyUsages OBJECT IDENTIFIER ::= { TBD } id-pskc-keyUsages OBJECT IDENTIFIER ::= { id-pskc 24 }
PSKCKeyUsages ::= SEQUENCE OF PSKCKeyUsage PSKCKeyUsages ::= SEQUENCE OF PSKCKeyUsage
PSKCKeyUsage ::= UTF8String ("OTP" | "CR" | "Encrypt" | PSKCKeyUsage ::= UTF8String ("OTP" | "CR" | "Encrypt" |
"Integrity" | "Verify" | "Unlock" | "Decrypt" | "Integrity" | "Verify" | "Unlock" | "Decrypt" |
"KeyWrap" | "Unwrap" | "Derive" | "Generate") "KeyWrap" | "Unwrap" | "Derive" | "Generate")
at-pskc-pinPolicy ATTRIBUTE ::= { at-pskc-pinPolicy ATTRIBUTE ::= {
TYPE PINPolicy IDENTIFIED BY id-pskc-pinPolicy } TYPE PINPolicy IDENTIFIED BY id-pskc-pinPolicy }
id-pskc-pinPolicy OBJECT IDENTIFIER ::= { TBD } id-pskc-pinPolicy OBJECT IDENTIFIER ::= { id-pskc 25 }
PINPolicy ::= SEQUENCE { PINPolicy ::= SEQUENCE {
pinKeyId [0] UTF8String OPTIONAL, pinKeyId [0] UTF8String OPTIONAL,
pinUsageMode [1] PINUsageMode, pinUsageMode [1] PINUsageMode,
maxFailedAttempts [2] INTEGER (0..MAX) OPTIONAL, maxFailedAttempts [2] INTEGER (0..MAX) OPTIONAL,
minLength [3] INTEGER (0..MAX) OPTIONAL, minLength [3] INTEGER (0..MAX) OPTIONAL,
maxLength [4] INTEGER (0..MAX) OPTIONAL, maxLength [4] INTEGER (0..MAX) OPTIONAL,
pinEncoding [5] Encoding OPTIONAL } pinEncoding [5] Encoding OPTIONAL }
PINUsageMode ::= UTF8String ("Local" | "Prepend" | "Append"| PINUsageMode ::= UTF8String ("Local" | "Prepend" | "Append"|
"Algorithmic") "Algorithmic")
 End of changes. 120 change blocks. 
226 lines changed or deleted 289 lines changed or added

This html diff was produced by rfcdiff 1.38. The latest version is available from http://tools.ietf.org/tools/rfcdiff/