draft-ietf-keyprov-symmetrickeyformat-08.txt   draft-ietf-keyprov-symmetrickeyformat-09.txt 
KEYPROV Working Group Sean Turner, IECA KEYPROV Working Group Sean Turner
Internet Draft Russ Housley, Vigil Security Internet Draft IECA
Intended Status: Standards Track April 26, 2010 Intended Status: Standards Track Russ Housley
Expires: October 26, 2010 Expires: January 10, 2010 Vigil Security
June 10, 2010
Symmetric Key Package Content Type Symmetric Key Package Content Type
draft-ietf-keyprov-symmetrickeyformat-08.txt draft-ietf-keyprov-symmetrickeyformat-09.txt
Abstract Abstract
This document defines the symmetric key format content type. It is This document defines the symmetric key format content type. It is
transport independent. The Cryptographic Message Syntax can be used transport independent. The Cryptographic Message Syntax can be used
to digitally sign, digest, authenticate, or encrypt this content to digitally sign, digest, authenticate, or encrypt this content
type. type.
Status of this Memo Status of this Memo
skipping to change at page 1, line 38 skipping to change at page 1, line 39
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html http://www.ietf.org/shadow.html
This Internet-Draft will expire on October 26, 2010. This Internet-Draft will expire on January 6, 2010.
Copyright Notice Copyright Notice
Copyright (c) 2010 IETF Trust and the persons identified as the Copyright (c) 2010 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 21 skipping to change at page 2, line 24
Table of Contents Table of Contents
1. Introduction...................................................3 1. Introduction...................................................3
1.1. Requirements Terminology..................................3 1.1. Requirements Terminology..................................3
1.2. ASN.1 Syntax Notation.....................................3 1.2. ASN.1 Syntax Notation.....................................3
2. Symmetric Key Package Content Type.............................3 2. Symmetric Key Package Content Type.............................3
3. PSKC Attributes................................................5 3. PSKC Attributes................................................5
3.1. PSKC Key Package Attributes...............................5 3.1. PSKC Key Package Attributes...............................5
3.1.1. Device Information Attributes........................5 3.1.1. Device Information Attributes........................5
3.1.2. Cryptographic Module Information Attributes..........7 3.1.2. Cryptographic Module Information Attributes..........8
3.2. PSKC Key Attributes.......................................8 3.2. PSKC Key Attributes.......................................8
3.2.1. Key Identifier.......................................8 3.2.1. Key Identifier.......................................9
3.2.2. Algorithm............................................8 3.2.2. Algorithm............................................9
3.2.3. Issuer...............................................8 3.2.3. Issuer...............................................9
3.2.4. Key Profile Identifier...............................8 3.2.4. Key Profile Identifier...............................9
3.2.5. Key Reference Identifier.............................9 3.2.5. Key Reference Identifier............................10
3.2.6. Friendly Name........................................9 3.2.6. Friendly Name.......................................10
3.2.7. Algorithm Parameters.................................9 3.2.7. Algorithm Parameters................................10
3.2.8. Counter.............................................11 3.2.8. Counter.............................................13
3.2.9. Time................................................12 3.2.9. Time................................................13
3.2.10. Time Interval......................................12 3.2.10. Time Interval......................................13
3.2.11. Time Drift.........................................12 3.2.11. Time Drift.........................................13
3.2.12. Value MAC..........................................12 3.2.12. Value MAC..........................................14
3.3. Key Policy Attributes....................................13 3.2.13. Key User Id........................................14
3.3.1. Key Start Date......................................13 3.3. Key Policy Attributes....................................15
3.3.2. Key Expiry Date.....................................13 3.3.1. Key Start Date......................................15
3.3.3. Number of Transactions..............................14 3.3.2. Key Expiry Date.....................................15
3.3.4. Key Usage...........................................14 3.3.3. Number of Transactions..............................15
3.3.5. PIN Policy..........................................15 3.3.4. Key Usage...........................................16
4. Key Encoding..................................................16 3.3.5. PIN Policy..........................................17
4.1. AES Key Encoding.........................................16 4. Key Encoding..................................................18
4.2. Triple DES Key Encoding..................................17 4.1. AES Key Encoding.........................................18
5. Security Considerations.......................................17 4.2. Triple DES Key Encoding..................................18
6. IANA Considerations...........................................18
7. References....................................................18
7.1. Normative References.....................................18
7.2. Non-Normative References.................................20
APPENDIX A: ASN.1 Module.........................................20 5. Security Considerations.......................................19
A.1. Symmetric Key Package ASN.1 Module.......................20 6. IANA Considerations...........................................19
A.2. PSKC ASN.1 Module........................................22 7. References....................................................20
7.1. Normative References.....................................20
7.2. Informative References...................................21
APPENDIX A: ASN.1 Module.........................................22
A.1. Symmetric Key Package ASN.1 Module.......................22
A.2. PSKC ASN.1 Module........................................24
1. Introduction 1. Introduction
This document defines the symmetric key format content type. It is This document defines the symmetric key format content type. It is
transport independent. The Cryptographic Message Syntax (CMS) transport independent. The Cryptographic Message Syntax (CMS)
[RFC5652] can be used to digitally sign, digest, authenticate, or [RFC5652] can be used to digitally sign, digest, authenticate, or
encrypt this content type. encrypt this content type.
The use cases that motivated the attributes in this work are The use cases that motivated the attributes in this work are
elaborated in [PSKC]. They are omitted to avoid duplication. elaborated in [PSKC]. They are omitted to avoid duplication.
skipping to change at page 5, line 41 skipping to change at page 5, line 44
3.1. PSKC Key Package Attributes 3.1. PSKC Key Package Attributes
PSKC key package attributes apply to an entire key package. These PSKC key package attributes apply to an entire key package. These
attributes can be categorized by two different attribute collections: attributes can be categorized by two different attribute collections:
device information and cryptographic module attributes. All of these device information and cryptographic module attributes. All of these
key package attributes are OPTIONAL. key package attributes are OPTIONAL.
3.1.1. Device Information Attributes 3.1.1. Device Information Attributes
Device Information attributes when taken together uniquely identify a Device Information attributes when taken together MUST uniquely
device to which the Symmetric Key Package is provisioned. identify a device to which the Symmetric Key Package is provisioned.
3.1.1.1. Manufacturer 3.1.1.1. Manufacturer
The Manufacturer attribute indicates the manufacturer of the device. The Manufacturer attribute indicates the manufacturer of the device.
The attribute definition is as follows: Values for Manufacturer SHOULD be taken from either [OATHMAN]
prefixes (i.e., the left column) or they SHOULD be taken from IANA
Private Enterprise Number Registry [IANAPENREG], using the
Organisation value. The attribute definition is as follows:
at-pskc-manufacturer ATTRIBUTE ::= { at-pskc-manufacturer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer } TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }
id-pskc-manufacturer OBJECT IDENTIFIER ::= { id-pskc 1 } id-pskc-manufacturer OBJECT IDENTIFIER ::= { id-pskc 1 }
3.1.1.2. Serial Number 3.1.1.2. Serial Number
The Serial Number attribute indicates the serial number of the The Serial Number attribute indicates the serial number of the
device. The attribute definition is as follows: device. The attribute definition is as follows:
skipping to change at page 7, line 8 skipping to change at page 7, line 13
or class of device is being used with respect to the provisioned key. or class of device is being used with respect to the provisioned key.
at-pskc-deviceBinding ATTRIBUTE ::= { at-pskc-deviceBinding ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceBinding } TYPE UTF8String IDENTIFIED BY id-pskc-deviceBinding }
id-pskc-deviceBinding OBJECT IDENTIFIER ::= { id-pskc 5 } id-pskc-deviceBinding OBJECT IDENTIFIER ::= { id-pskc 5 }
3.1.1.6. Device Start Date 3.1.1.6. Device Start Date
When included in sKeyPkgAttrs, the Device Start Date attribute When included in sKeyPkgAttrs, the Device Start Date attribute
indicates the start date for a device. The date MUST be expressed in indicates the start date for a device. The date MUST be represented
UTC form with no time zone component. Implementations SHOULD NOT in a form that matches the dateTime production from [PSKC]. The date
rely on time resolution finer than milliseconds and MUST NOT generate MUST be expressed in UTC form with no time zone component.
time instants that specify leap seconds. The attribute definition is Implementations SHOULD NOT rely on time resolution finer than
as follows: milliseconds and MUST NOT generate time instants that specify leap
seconds. Keys that are on the device SHOULD only be used when the
current date is on or after the device start date. The attribute
definition is as follows:
at-pskc-deviceStartDate ATTRIBUTE ::= { at-pskc-deviceStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceStartDate } TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceStartDate }
id-pskc-deviceStartDate OBJECT IDENTIFIER ::= { id-pskc 6 } id-pskc-deviceStartDate OBJECT IDENTIFIER ::= { id-pskc 6 }
Note that usage enforcement of the keys with respect to the dates MAY
only happen on the validation server as some devices such as smart
cards do not have an internal clock. Systems thus SHOULD NOT rely
upon the device to enforce key usage date restrictions.
3.1.1.7. Device Expiry Date 3.1.1.7. Device Expiry Date
When included in sKeyPkgAttrs, the Device Expiry Date attribute When included in sKeyPkgAttrs, the Device Expiry Date attribute
indicates the expiry date for a device. The date MUST be expressed indicates the expiry date for a device. The date MUST be represented
in UTC form with no time zone component. Implementations SHOULD NOT in a form that matches the dateTime production from [XMLSCHEMA]. The
rely on time resolution finer than milliseconds and MUST NOT generate date MUST be expressed in UTC form with no time zone component.
time instants that specify leap seconds. The attribute definition is Implementations SHOULD NOT rely on time resolution finer than
as follows: milliseconds and MUST NOT generate time instants that specify leap
seconds. Keys that are on the device SHOULD only be used when the
current date is before the device expiry date. The attribute
definition is as follows:
at-pskc-deviceExpiryDate ATTRIBUTE ::= { at-pskc-deviceExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceExpiryDate } TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceExpiryDate }
id-pskc-deviceExpiryDate OBJECT IDENTIFIER ::= { id-pskc 7 } id-pskc-deviceExpiryDate OBJECT IDENTIFIER ::= { id-pskc 7 }
Note that usage enforcement of the keys with respect to the dates MAY
only happen on the validation server as some devices such as smart
cards do not have an internal clock. Systems thus SHOULD NOT rely
upon the device to enforce key usage date restrictions.
3.1.1.8. Device User Id
The Device User Id attribute indicates the user with whom the device
is associated with using a distinguished name, as defined in
[RFC4514]. For example: UID=jsmith,DC=example,DC=net. The attribute
definition is as follows:
at-pskc-deviceUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceUserId }
id-pskc-deviceUserId OBJECT IDENTIFIER ::= { id-pskc 26 }
As specified in [PSKC], there are no semantics associated with this
element, i.e., there are no checks enforcing that only a specific
user can use this device. As such, this element is for informational
purposes only.
3.1.2. Cryptographic Module Information Attributes 3.1.2. Cryptographic Module Information Attributes
Cryptographic Module attributes uniquely identify a cryptographic Cryptographic Module attributes uniquely identify a cryptographic
module. This is useful when the device contains more than one module. This is useful when the device contains more than one
cryptographic module. At this time only one attribute is defined. cryptographic module. At this time only one attribute is defined.
3.1.2.1. Cryptographic Module Identifier 3.1.2.1. Cryptographic Module Identifier
When included in sKeyPkgAttrs, the Cryptographic Module Identifier When included in sKeyPkgAttrs, the Cryptographic Module Identifier
attribute uniquely identifies the cryptographic module to which the attribute uniquely identifies the cryptographic module to which the
skipping to change at page 8, line 13 skipping to change at page 9, line 7
id-pskc-moduleId OBJECT IDENTIFIER ::= { id-pskc 8 } id-pskc-moduleId OBJECT IDENTIFIER ::= { id-pskc 8 }
3.2. PSKC Key Attributes 3.2. PSKC Key Attributes
PSKC key attributes apply to a specific key. As noted earlier, the PSKC key attributes apply to a specific key. As noted earlier, the
Key Identifier (Sec 3.2.1) and Algorithm (Sec 3.2.2) key attributes Key Identifier (Sec 3.2.1) and Algorithm (Sec 3.2.2) key attributes
are REQUIRED. All other attributes are OPTIONAL. are REQUIRED. All other attributes are OPTIONAL.
3.2.1. Key Identifier 3.2.1. Key Identifier
When included in sKeyAttrs, the Key Identifier attribute uniquely When included in sKeyAttrs, the Key Identifier attribute identifies
identifies the key. The attribute definition is as follows: the key in the context of key provisioning exchanges between two
parties. This means that if PSKC is used in multiple interactions
between a sending and receiving party, using different containers
referencing the same keys, the KeyId MUST use the same KeyId values
(e.g. after initial provisioning, if a system wants to update key
meta data values in the other system the KeyId value of the key where
the meta data is to be updates MUST be the same as the original KeyId
value provisioned). The attribute definition is as follows:
at-pskc-keyId ATTRIBUTE ::= { at-pskc-keyId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyId } TYPE UTF8String IDENTIFIED BY id-pskc-keyId }
id-pskc-keyId OBJECT IDENTIFIER ::= { id-pskc 9 } id-pskc-keyId OBJECT IDENTIFIER ::= { id-pskc 9 }
3.2.2. Algorithm 3.2.2. Algorithm
The Algorithm attribute uniquely identifies the PSKC algorithm The Algorithm attribute uniquely identifies the PSKC algorithm
profile. [PSKC] defines two algorithm profiles "HOTP" and profile. [PSKC] defines two algorithm profiles "HOTP" and "PIN".
"KEYPROV-PIN". The attribute definition is as follows: The attribute definition is as follows:
at-pskc-algorithm ATTRIBUTE ::= { at-pskc-algorithm ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-algorithm } TYPE UTF8String IDENTIFIED BY id-pskc-algorithm }
id-pskc-algorithm OBJECT IDENTIFIER ::= { id-pskc 10 } id-pskc-algorithm OBJECT IDENTIFIER ::= { id-pskc 10 }
3.2.3. Issuer 3.2.3. Issuer
The Issuer attribute names the entity that issued the key. The The Issuer attribute names the entity that issued the key. The
attribute definition is as follows: attribute definition is as follows:
skipping to change at page 9, line 25 skipping to change at page 10, line 28
TYPE UTF8String IDENTIFIED BY id-pskc-keyReference } TYPE UTF8String IDENTIFIED BY id-pskc-keyReference }
id-pskc-keyReference OBJECT IDENTIFIER ::= { id-pskc 13 } id-pskc-keyReference OBJECT IDENTIFIER ::= { id-pskc 13 }
3.2.6. Friendly Name 3.2.6. Friendly Name
The Friendly Name attribute contains a human readable name for the The Friendly Name attribute contains a human readable name for the
secret key. The attribute definition is as follows: secret key. The attribute definition is as follows:
at-pskc-friendlyName ATTRIBUTE ::= { at-pskc-friendlyName ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName } TYPE FriendlyName IDENTIFIED BY id-pskc-friendlyName }
id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 } id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }
The Friendly Name attribute has the following syntax:
FriendlyName ::= SEQUENCE {
friendlyName UTF8String,
friendlyNameLangTag UTF8String OPTIONAL }
The text is encoded in UTF-8 [RFC3629], which accommodates most of The text is encoded in UTF-8 [RFC3629], which accommodates most of
the world's writing systems. The friendlyNameLangTag field the world's writing systems. The friendlyNameLangTag field
identifies the language used to express the friendlyName. When identifies the language used to express the friendlyName. When
friendlyNameLangTag is absent, English is used. The value of the friendlyNameLangTag is absent, English, whose associated language tag
friendlyNameLangTag should be a language tag as described in is "en", is used. The value of the friendlyNameLangTag MUST be a
[RFC5646]. language tag as described in [RFC5646].
3.2.7. Algorithm Parameters 3.2.7. Algorithm Parameters
The Algorithm Parameters attribute contains parameters that influence The Algorithm Parameters attribute contains parameters that influence
the result of the algorithmic computation, for example response the result of the algorithmic computation, for example response
truncation and format in One-Time Password (OTP) and Challenge- truncation and format in One-Time Password (OTP) and Challenge-
Response (CR) algorithms. Response (CR) algorithms.
at-pskc-algorithmParameters ATTRIBUTE ::= { at-pskc-algorithmParameters ATTRIBUTE ::= {
TYPE PSKCAlgorithmParameters TYPE PSKCAlgorithmParameters
skipping to change at page 10, line 4 skipping to change at page 11, line 10
The Algorithm Parameters attribute contains parameters that influence The Algorithm Parameters attribute contains parameters that influence
the result of the algorithmic computation, for example response the result of the algorithmic computation, for example response
truncation and format in One-Time Password (OTP) and Challenge- truncation and format in One-Time Password (OTP) and Challenge-
Response (CR) algorithms. Response (CR) algorithms.
at-pskc-algorithmParameters ATTRIBUTE ::= { at-pskc-algorithmParameters ATTRIBUTE ::= {
TYPE PSKCAlgorithmParameters TYPE PSKCAlgorithmParameters
IDENTIFIED BY id-pskc-algorithmParams } IDENTIFIED BY id-pskc-algorithmParams }
id-pskc-algorithmParams OBJECT IDENTIFIER ::= { id-pskc 15 } id-pskc-algorithmParams OBJECT IDENTIFIER ::= { id-pskc 15 }
The Algorithm Parameters attribute has the following syntax: The Algorithm Parameters attribute has the following syntax:
PSKCAlgorithmParameters ::= CHOICE { PSKCAlgorithmParameters ::= CHOICE {
suite UTF8String OPTIONAL,
challengeFormat [0] ChallengeFormat, challengeFormat [0] ChallengeFormat,
responseFormat [1] ResponseFormat, responseFormat [1] ResponseFormat,
... } ... }
ChallengeFormat ::= SEQUENCE { ChallengeFormat ::= SEQUENCE {
encoding Encoding, encoding Encoding,
checkDigit BOOLEAN DEFAULT FALSE, checkDigit BOOLEAN DEFAULT FALSE,
min INTEGER (0..MAX), min INTEGER (0..MAX),
max INTEGER (0..MAX), max INTEGER (0..MAX),
... } ... }
skipping to change at page 10, line 29 skipping to change at page 11, line 37
"ALPHANUMERIC" |"BASE64" |"BINARY") "ALPHANUMERIC" |"BASE64" |"BINARY")
ResponseFormat ::= SEQUENCE { ResponseFormat ::= SEQUENCE {
encoding Encoding, encoding Encoding,
length INTEGER (0..MAX), length INTEGER (0..MAX),
checkDigit BOOLEAN DEFAULT FALSE, checkDigit BOOLEAN DEFAULT FALSE,
... } ... }
The fields in PSKCAlgorithmParameters have the following meanings: The fields in PSKCAlgorithmParameters have the following meanings:
o Suite defines additional characteristics of the algorithm used,
which are algorithm specific. For example in HMAC based OTP
algorithm it could designate the strength of the hash algorithm
used (SHA1, SHA256, etc). Please refer to algorithm profile
specification [PSKC] for the exact semantic of the value for each
algorithm profile.
o ChallengeFormat defines the characteristics of the challenge in a o ChallengeFormat defines the characteristics of the challenge in a
CR usage scenario whereby the following fields are defined: CR usage scenario whereby the following fields are defined:
o encoding specifies the encoding of the challenge accepted by o encoding specifies the encoding of the challenge accepted by
the device and MUST be one of the following values: DECIMAL, the device and MUST be one of the following values: DECIMAL,
HEXADECIMAL, ALPHANUMERIC, BASE64, or BINARY. The BASE64 HEXADECIMAL, ALPHANUMERIC, BASE64, or BINARY. The BASE64
encoding is done as in Section 4 of [RFC4648]. encoding is done as in Section 4 of [RFC4648].
o checkDigit indicates whether a device needs to check the o checkDigit indicates whether a device needs to check the
appended Luhn check digit, as defined in [LUHN], contained in a appended Luhn check digit, as defined in [LUHN], contained in a
skipping to change at page 12, line 9 skipping to change at page 13, line 19
at-pskc-counter ATTRIBUTE ::= { at-pskc-counter ATTRIBUTE ::= {
TYPE INTEGER(0..MAX) IDENTIFIED BY id-pskc-counter } TYPE INTEGER(0..MAX) IDENTIFIED BY id-pskc-counter }
id-pskc-counter OBJECT IDENTIFIER ::= { id-pskc 16 } id-pskc-counter OBJECT IDENTIFIER ::= { id-pskc 16 }
3.2.9. Time 3.2.9. Time
The Time attribute conveys the time for time-based OTP algorithms. The Time attribute conveys the time for time-based OTP algorithms.
If the Time Interval attribute is included, then this element carries If the Time Interval attribute is included, then this element carries
the number of time intervals passed for a specific start point. It the number of time intervals passed for a specific start point. If
uses the BinaryTime syntax from [RFC4049]. The attribute definition time interval is used, then this element carries the number of time
is as follows: intervals passed from a specific start point, normally algorithm
dependent. It uses the BinaryTime syntax from [RFC4049]. The
attribute definition is as follows:
at-pskc-time ATTRIBUTE ::= { at-pskc-time ATTRIBUTE ::= {
TYPE BinaryTime IDENTIFIED BY id-pskc-time } TYPE BinaryTime IDENTIFIED BY id-pskc-time }
id-pskc-time OBJECT IDENTIFIER ::= { id-pskc 17 } id-pskc-time OBJECT IDENTIFIER ::= { id-pskc 17 }
3.2.10. Time Interval 3.2.10. Time Interval
The Time Interval attribute conveys the time interval value for time- The Time Interval attribute conveys the time interval value for time-
based OTP algorithms. It is an integer. The attribute definition is based OTP algorithms in seconds (e.g., a value of 30 for this would
as follows: indicate a time interval of 30 seconds). It is an integer. The
attribute definition is as follows:
at-pskc-timeInterval ATTRIBUTE ::= { at-pskc-timeInterval ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeInterval } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeInterval }
id-pskc-timeInterval OBJECT IDENTIFIER ::= { id-pskc 18 } id-pskc-timeInterval OBJECT IDENTIFIER ::= { id-pskc 18 }
3.2.11. Time Drift 3.2.11. Time Drift
The Time Drift attribute contains the device clock drift value, the The Time Drift attribute contains the device clock drift value for
number of seconds per day the device clocks drifts, for time-based time-based OTP algorithms. It is an integer either positive or
OTP algorithms. It is an integer. The attribute definition is as negative that indicates the number of time intervals that a
validation server has established the device clock drifted after the
last successful authentication. The attribute definition is as
follows: follows:
at-pskc-timeDrift ATTRIBUTE ::= { at-pskc-timeDrift ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeDrift } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeDrift }
id-pskc-timeDrift OBJECT IDENTIFIER ::= { id-pskc 19 } id-pskc-timeDrift OBJECT IDENTIFIER ::= { id-pskc 19 }
3.2.12. Value MAC 3.2.12. Value MAC
The Value MAC attribute is a Message Authentication Code (MAC) The Value MAC attribute is a Message Authentication Code (MAC)
skipping to change at page 13, line 19 skipping to change at page 14, line 35
mac UTF8String } mac UTF8String }
The fields in ValueMac have the following meanings: The fields in ValueMac have the following meanings:
o macAlgorithm identifies the MAC algorithm used to generate the o macAlgorithm identifies the MAC algorithm used to generate the
value placed in digest. value placed in digest.
o mac is the base64 encoded, as specified in Section 4 of [RFC4648], o mac is the base64 encoded, as specified in Section 4 of [RFC4648],
mac value. mac value.
3.2.13. Key User Id
The Key User Id attribute indicates the user with whom the key is
associated using a distinguished name, as defined in [RFC4514]. For
example: UID=jsmith,DC=example,DC=net. The attribute definition is as
follows:
at-pskc-keyUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyUserId }
id-pskc-keyUserId OBJECT IDENTIFIER ::= { id-pskc 27 }
As specified in [PSKC], there are no semantics associated with this
element, i.e., there are no checks enforcing that only a specific
user can use this key. As such, this element is for informational
purposes only.
3.3. Key Policy Attributes 3.3. Key Policy Attributes
Key policy attributes indicate a policy that can be attached to a Key policy attributes indicate a policy that can be attached to a
key. These attributes are defined in the subsections that follow. key. These attributes are defined in the subsections that follow.
3.3.1. Key Start Date 3.3.1. Key Start Date
When included in sKeyAttrs, the Key Start Date attribute indicates When included in sKeyAttrs, the Key Start Date attribute indicates
the start of the keys validity. The date MUST be expressed in UTC the start of the key's validity period. The date MUST be represented
form with no time zone component. Implementations SHOULD NOT rely on in a form that matches the dateTime production from [XMLSCHEMA]. The
time resolution finer than milliseconds and MUST NOT generate time date MUST be expressed in UTC form with no time zone component.
instants that specify leap seconds. The attribute definition is as Implementations SHOULD NOT rely on time resolution finer than
follows: milliseconds and MUST NOT generate time instants that specify leap
seconds. The attribute definition is as follows:
at-pskc-keyStartDate ATTRIBUTE ::= { at-pskc-keyStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyStartDate } TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyStartDate }
id-pskc-keyStartDate OBJECT IDENTIFIER ::= { id-pskc 21 } id-pskc-keyStartDate OBJECT IDENTIFIER ::= { id-pskc 21 }
3.3.2. Key Expiry Date 3.3.2. Key Expiry Date
When included in sKeyAttrs, the Key Expiry Date attribute indicates When included in sKeyAttrs, the Key Expiry Date attribute indicates
the end of the key's validity period. The date MUST be expressed in the end of the key's validity period. The date MUST be represented
UTC form with no time zone component. Implementations SHOULD NOT in a form that matches the dateTime production from [XMLSCHEMA]. The
rely on time resolution finer than milliseconds and MUST NOT generate date MUST be expressed in UTC form with no time zone component.
time instants that specify leap seconds. The attribute definition is Implementations SHOULD NOT rely on time resolution finer than
as follows: milliseconds and MUST NOT generate time instants that specify leap
seconds. The attribute definition is as follows:
at-pskc-keyExpiryDate ATTRIBUTE ::= { at-pskc-keyExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyExpiryDate } TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyExpiryDate }
id-pskc-keyExpiryDate OBJECT IDENTIFIER ::= { id-pskc 22 } id-pskc-keyExpiryDate OBJECT IDENTIFIER ::= { id-pskc 22 }
3.3.3. Number of Transactions 3.3.3. Number of Transactions
The Number of Transactions attribute indicates the maximum number of The Number of Transactions attribute indicates the maximum number of
times a key carried within the package can be used. When this times a key carried within the package can be used. When this
skipping to change at page 16, line 7 skipping to change at page 17, line 41
o pinKeyId uniquely identifies the key held within this container o pinKeyId uniquely identifies the key held within this container
that contains the value of the PIN that protects the key. that contains the value of the PIN that protects the key.
o pinUsageMode indicates the way the PIN is used during the o pinUsageMode indicates the way the PIN is used during the
usage of the key. The following values are defined in [PSKC]: usage of the key. The following values are defined in [PSKC]:
Local, Prepend, Append, Algorithmic. Local, Prepend, Append, Algorithmic.
o maxFailedAttempts indicates the maximum number of times the PIN o maxFailedAttempts indicates the maximum number of times the PIN
may be entered wrongly before it MUST NOT be possible to use the may be entered wrongly before it MUST NOT be possible to use the
key anymore. key anymore (reasonable values are in the positive integer range
of at least 2 and no more than 10).
o minLength indicates the minimum length of a PIN that can be set to o minLength indicates the minimum length of a PIN that can be set to
protect the associated key. It MUST NOT be possible to set a PIN protect the associated key. It MUST NOT be possible to set a PIN
shorter than this value. If pinEncoding is 'DECIMAL', shorter than this value. If pinEncoding is 'DECIMAL',
'HEXADECIMAL' or 'ALPHANUMERIC' this value indicates the number of 'HEXADECIMAL' or 'ALPHANUMERIC' this value indicates the number of
digits/ characters. If pinEncoding is 'BASE64' or 'BINARY', this digits/ characters. If pinEncoding is 'BASE64' or 'BINARY', this
value indicates the number of bytes of the unencoded value. value indicates the number of bytes of the unencoded value.
o maxLength indicates the maximum length of a PIN that can be set to o maxLength indicates the maximum length of a PIN that can be set to
protect this key. It MUST NOT be possible to set a PIN longer protect this key. It MUST NOT be possible to set a PIN longer
skipping to change at page 16, line 46 skipping to change at page 18, line 35
ensure that, it is necessary to define a correspondence between the ensure that, it is necessary to define a correspondence between the
abstract syntax of sKey and the notation in the standard algorithm abstract syntax of sKey and the notation in the standard algorithm
description that defines how the key is used. The next sections description that defines how the key is used. The next sections
establish that correspondence for the algorithms AES [FIPS197] and establish that correspondence for the algorithms AES [FIPS197] and
TDEA [SP800-67]. TDEA [SP800-67].
4.1. AES Key Encoding 4.1. AES Key Encoding
[FIPS197] section 5.2, titled Key Expansion, uses the input key as an [FIPS197] section 5.2, titled Key Expansion, uses the input key as an
array of bytes indexed starting at 0. The first octet of sKey SHALL array of bytes indexed starting at 0. The first octet of sKey SHALL
become the key byte in AES labeled index 0 in [FIPS197]; it SHALL be become the key byte in AES labeled index 0 in [FIPS197]; the
the first octet of sKey, and the other key bytes SHALL follow in succeeding octets of sKey SHALL become key bytes in AES in increasing
index order. index order.
Proper parsing and key load of the contents of sKey for AES SHALL be Proper parsing and key load of the contents of sKey for AES SHALL be
determined by using the following sKey octet string to generate and determined by using the following sKey octet string to generate and
match the key expansion test vectors in [FIPS197] Appendix A for AES match the key expansion test vectors in [FIPS197] Appendix A for AES
Cipher Key: 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c Cipher Key: 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c
Tag Length Value Tag Length Value
04 16 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c 04 16 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c
4.2. Triple DES Key Encoding 4.2. Triple DES Key Encoding
A Triple-DES key consists of three keys for the cryptographic engine A Triple-DES key consists of three keys for the cryptographic engine
(Key1, Key2, and Key3) that are each 64 bits (even though only 56 are (Key1, Key2, and Key3) that are each 64 bits (56 key bits and 8
used); the three keys are also referred to as a key bundle (KEY) parity bits); the three keys are also collectively referred to as a
[SP800-67]. A key bundle may employ either two or three mutually key bundle [SP800-67]. A key bundle may employ either two or three
independent keys. When only two are employed (called two-key Triple independent keys. When only two independent keys are employed
DES), then Key1 = Key3. (called two-key Triple DES), then the same value is used for Key1 and
Key3.
Each key in a Triple-DES key bundle is expanded into a key schedule Each key in a Triple-DES key bundle is expanded into a key schedule
according to a procedure defined in [SP800-67] Appendix A. That according to a procedure defined in [SP800-67] Appendix A. That
procedure numbers the bits in the key from 1 to 64, with number 1 procedure numbers the bits in the key from 1 to 64, with number 1
being the left-most, or most significant bit (MSB). The first octet being the left-most, or most significant bit (MSB). The first octet
of sKey SHALL be bits 1 through 8 of Key1 with bit 1 being the MSB. of sKey SHALL be bits 1 through 8 of Key1 with bit 1 being the MSB.
The second octet of sKey SHALL be bits 9 through 16 of Key1, and so The second octet of sKey SHALL be bits 9 through 16 of Key1, and so
forth, so that the trailing octet of sKEY SHALL be bits 57 through 64 forth, so that the trailing octet of sKEY SHALL be bits 57 through 64
of Key3 (or Key2 for two-key Triple DES). of Key3 (or Key2 for two-key Triple DES).
skipping to change at page 18, line 14 skipping to change at page 20, line 4
place of a PSKC package in [DSKPP] exchanges. In this case, the place of a PSKC package in [DSKPP] exchanges. In this case, the
algorithm requirements are found in those documents. Another algorithm requirements are found in those documents. Another
possibility is to encapsulate this content type in a CMS [RFC5652] possibility is to encapsulate this content type in a CMS [RFC5652]
protecting content type. protecting content type.
6. IANA Considerations 6. IANA Considerations
This document makes use of object identifiers to identify a CMS This document makes use of object identifiers to identify a CMS
content type (Appendix A.1), the ASN.1 version of the PSKC attributes content type (Appendix A.1), the ASN.1 version of the PSKC attributes
(Appendix A.2), and the ASN.1 modules found in Appendix A.1 and A.2. (Appendix A.2), and the ASN.1 modules found in Appendix A.1 and A.2.
All OIDs are registered in an arc delegated by IANA to the SMIME
Working Group. No further action by IANA is necessary for this All OIDs are registered in an arc delegated by RSADSI to the SMIME
document or any anticipated updates. Working Group. The current contents of the arc are located here:
http://www.imc.org/ietf-smime/sm-oid.asn
They were obtained by sending a request to
ietf-smime-oid-reg@imc.org. When the SMIME WG closes, this arc and
registration procedures will be transferred to IANA. No further
action by IANA is necessary for this document or any anticipated
updates.
7. References 7. References
7.1. Normative References 7.1. Normative References
[FIPS197] National Institute of Standards. "FIPS Pub 197: [FIPS197] National Institute of Standards. "FIPS Pub 197:
Advanced Encryption Standard (AES)", 26 November 2001. Advanced Encryption Standard (AES)", 26 November 2001.
[LUHN] Luhn, H., "Luhn algorithm", US Patent 2950048, August [IANAPENREG] IANA, "IANA Private Enterprise Number Registry",
1960, http://patft.uspto.gov/netacgi/nph- <http://www.iana.org/assignments/enterprise-numbers/>.
Parser?patentnumber=2950048.
[LUHN] ISO/IEC 7812-1:2006 Identification cards -
Identification of issuers - Part 1: Numbering system.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO
10646", STD 63, RFC 3629, November 2003. 10646", STD 63, RFC 3629, November 2003.
[RFC4049] Housley, R., "BinaryTime: An Alternate Format for [RFC4049] Housley, R., "BinaryTime: An Alternate Format for
Representing Date and Time in ASN.1", RFC 4049, April Representing Date and Time in ASN.1", RFC 4049, April
2005. 2005.
[RFC4514] Zeilenga, K., "Lightweight Directory Access Protocol
(LDAP): String Representation of Distinguished Names",
RFC 4514, June 2006.
[RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data
Encodings", RFC 4648, October 2006. Encodings", RFC 4648, October 2006.
[RFC5646] Phillips, A. and M. Davis, "Tags for Identifying [RFC5646] Phillips, A. and M. Davis, "Tags for Identifying
Languages", BCP 47, RFC 5646, September 2009. Languages", BCP 47, RFC 5646, September 2009.
[RFCTBD1] Schaad, J., and P. Hoffman, "New ASN.1 Modules for [RFC5911] Hoffman, P., and J. Schaad, "New ASN.1 Modules for
PKIX", draft-ietf-pkix-new-asn1-08.txt, work-in- Cryptographic Message Syntax (CMS) and S/MIME", RFC
progress. 5911, June 2010.
//** RFC EDITOR: Please replace [DSKPP] with [RFCXXXX] where XXXX is
the draft-ietf-pkix-new-asn1's RFC #. Make the replacements here and
elsewhere in the document. **//
[RFCTBD2] Schaad, J., and P. Hoffman, "New ASN.1 Modules for [RFC5912] Hoffman, P., and J. Schaad, "New ASN.1 Modules for the
SMIME", draft-ietf-smime-new-asn1-07.txt, work-in- Public Key Infrastructure Using X.509 (PKIX)", RFC
progress. 5912, June 2010.
//** RFC EDITOR: Please replace [DSKPP] with [RFCXXXX] where XXXX is [OATHMAN] OATH Manufacturer prefixes:
the draft-ietf-smime-new-asn1's RFC #. Make the replacements here http://www.openauthentication.org/oath-id/prefixes/
and elsewhere in the document. **//
[PSKC] Hoyer, P., Pei, M., and S. Machani, "Portable Symmetric [PSKC] Hoyer, P., Pei, M., and S. Machani, "Portable Symmetric
Key Container (PSKC), draft-ietf-keyprov-pskc-05.txt, Key Container (PSKC), draft-ietf-keyprov-pskc-07.txt,
work-in-progress. work-in-progress.
//** RFC EDITOR: Please replace [PSKC] with [RFCXXXX] where XXXX is //** RFC EDITOR: Please replace [PSKC] with [RFCXXXX] where XXXX is
the draft-ietf-keyprov-pskc's RFC #. Make the replacements here and the draft-ietf-keyprov-pskc's RFC #. Make the replacements here and
elsewhere in the document. **// elsewhere in the document. **//
[X.680] ITU-T Recommendation X.680 (2002) | ISO/IEC 8824- [X.680] ITU-T Recommendation X.680 (2002) | ISO/IEC 8824-
1:2002. Information Technology - Abstract Syntax 1:2002. Information Technology - Abstract Syntax
Notation One. Notation One.
skipping to change at page 20, line 29 skipping to change at page 22, line 23
Management - Part 1: General (Revised)", NIST Special Management - Part 1: General (Revised)", NIST Special
Publication 800-57, March 2007. Publication 800-57, March 2007.
[RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", RFC [RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", RFC
5652, September 2009. 5652, September 2009.
APPENDIX A: ASN.1 Module APPENDIX A: ASN.1 Module
This appendix provides the normative ASN.1 definitions for the This appendix provides the normative ASN.1 definitions for the
structures described in this specification using ASN.1 as defined in structures described in this specification using ASN.1 as defined in
[X.680] through [X.683]. [X.680], [X.681], [X.682], and [X.683].
A.1. Symmetric Key Package ASN.1 Module A.1. Symmetric Key Package ASN.1 Module
SymmetricKeyPackageModulev1 SymmetricKeyPackageModulev1
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-symmetricKeyPkgV1(33) } smime(16) modules(0) id-mod-symmetricKeyPkgV1(33) }
DEFINITIONS IMPLICIT TAGS ::= DEFINITIONS IMPLICIT TAGS ::=
BEGIN BEGIN
-- EXPORTS ALL -- EXPORTS ALL
IMPORTS IMPORTS
-- From New PKIX ASN.1 [RFCTBD1] -- From New PKIX ASN.1 [RFC5912]
ATTRIBUTE ATTRIBUTE
FROM PKIX-CommonTypes-2009 FROM PKIX-CommonTypes-2009
{ iso(1) identified-organization(3) dod(6) internet(1) { iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) } id-mod-pkixCommon-02(57) }
-- From New SMIME ASN.1 [RFCTBD2] -- From New SMIME ASN.1 [RFC5911]
CONTENT-TYPE, Attribute{} CONTENT-TYPE, Attribute{}
FROM CryptographicMessageSyntax-2009 FROM CryptographicMessageSyntax-2009
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-cms-2004-02(41) } smime(16) modules(0) id-mod-cms-2004-02(41) }
; ;
ContentSet CONTENT-TYPE ::= { ContentSet CONTENT-TYPE ::= {
ct-symmetric-key-package, ct-symmetric-key-package,
skipping to change at page 22, line 19 skipping to change at page 24, line 19
smime(16) modules(0) id-mod-pskcAttributesModule(53) } smime(16) modules(0) id-mod-pskcAttributesModule(53) }
DEFINITIONS IMPLICIT TAGS ::= DEFINITIONS IMPLICIT TAGS ::=
BEGIN BEGIN
-- EXPORTS ALL -- EXPORTS ALL
IMPORTS IMPORTS
-- From New PKIX ASN.1 [RFCTBD1] -- From New PKIX ASN.1 [RFC5912]
ATTRIBUTE ATTRIBUTE
FROM PKIX-CommonTypes-2009 FROM PKIX-CommonTypes-2009
{ iso(1) identified-organization(3) dod(6) internet(1) { iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0) security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) } id-mod-pkixCommon-02(57) }
-- From BinaryTime [RFC4049] -- From BinaryTime [RFC4049]
BinaryTime BinaryTime
FROM BinarySigningTimeModule FROM BinarySigningTimeModule
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-binarySigningTime(27) } smime(16) modules(0) id-mod-binarySigningTime(27) }
-- From New SMIME ASN.1 [RFC5911]
id-smime id-smime
FROM SecureMimeMessageV3dot1-2009 FROM SecureMimeMessageV3dot1-2009
{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
smime(16) modules(0) id-mod-msg-v3dot1-02(39) } smime(16) modules(0) id-mod-msg-v3dot1-02(39) }
; ;
-- --
-- PSKC Attributes OIDs are taken from the SMIME Arc. -- PSKC Attributes OIDs are taken from the SMIME Arc.
-- --
id-pskc OBJECT IDENTIFIER ::= { id-smime 12 } id-pskc OBJECT IDENTIFIER ::= { id-smime 12 }
-- --
-- Merge SKeyPKGAttributes to the set of attributes for sKeyPkgAttrs -- Merge SKeyPKGAttributes to the set of attributes for sKeyPkgAttrs
-- --
SKeyPkgAttributes ATTRIBUTE ::= { SKeyPkgAttributes ATTRIBUTE ::= {
at-pskc-manufacturer | at-pskc-serialNo | at-pskc-model | at-pskc-manufacturer | at-pskc-serialNo | at-pskc-model |
at-pskc-issueNo | at-pskc-deviceBinding | at-pskc-issueNo | at-pskc-deviceBinding |
at-pskc-deviceStartDate | at-pskc-deviceExpiryDate | at-pskc-deviceStartDate | at-pskc-deviceExpiryDate |
at-pskc-moduleId, ... } at-pskc-moduleId | at-deviceUserId, ... }
-- --
-- Merge SKeyAttributes to the set of attributes for sKeyAttrs -- Merge SKeyAttributes to the set of attributes for sKeyAttrs
-- --
SKeyAttributes ATTRIBUTE ::= { SKeyAttributes ATTRIBUTE ::= {
at-pskc-keyId | at-pskc-algorithm | at-pskc-issuer | at-pskc-keyId | at-pskc-algorithm | at-pskc-issuer |
at-pskc-keyProfileId | at-pskc-keyReference | at-pskc-keyProfileId | at-pskc-keyReference |
at-pskc-friendlyName | at-pskc-algorithmParameters | at-pskc-friendlyName | at-pskc-algorithmParameters |
at-pskc-counter | at-pskc-time | at-pskc-timeInterval | at-pskc-counter | at-pskc-time | at-pskc-timeInterval |
at-pskc-timeDrift | at-pskc-valueMAC | at-pskc-keyStartDate | at-pskc-timeDrift | at-pskc-valueMAC | at-keyUserId |
at-pskc-keyExpiryDate | at-pskc-numberOfTransactions | at-pskc-keyStartDate | at-pskc-keyExpiryDate |
at-pskc-keyUsage | at-pskc-pinPolicy, ... } at-pskc-numberOfTransactions | at-pskc-keyUsage |
at-pskc-pinPolicy,... }
at-pskc-manufacturer ATTRIBUTE ::= { at-pskc-manufacturer ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer } TYPE UTF8String IDENTIFIED BY id-pskc-manufacturer }
id-pskc-manufacturer OBJECT IDENTIFIER ::= { id-pskc 1 } id-pskc-manufacturer OBJECT IDENTIFIER ::= { id-pskc 1 }
at-pskc-serialNo ATTRIBUTE ::= { at-pskc-serialNo ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-serialNo } TYPE UTF8String IDENTIFIED BY id-pskc-serialNo }
id-pskc-serialNo OBJECT IDENTIFIER ::= { id-pskc 2 } id-pskc-serialNo OBJECT IDENTIFIER ::= { id-pskc 2 }
skipping to change at page 24, line 19 skipping to change at page 26, line 22
at-pskc-deviceExpiryDate ATTRIBUTE ::= { at-pskc-deviceExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceExpiryDate } TYPE GeneralizedTime IDENTIFIED BY id-pskc-deviceExpiryDate }
id-pskc-deviceExpiryDate OBJECT IDENTIFIER ::= { id-pskc 7 } id-pskc-deviceExpiryDate OBJECT IDENTIFIER ::= { id-pskc 7 }
at-pskc-moduleId ATTRIBUTE ::= { at-pskc-moduleId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-moduleId } TYPE UTF8String IDENTIFIED BY id-pskc-moduleId }
id-pskc-moduleId OBJECT IDENTIFIER ::= { id-pskc 8 } id-pskc-moduleId OBJECT IDENTIFIER ::= { id-pskc 8 }
at-pskc-deviceUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-deviceUserId }
id-pskc-deviceUserId OBJECT IDENTIFIER ::= { id-pskc 26 }
at-pskc-keyId ATTRIBUTE ::= { at-pskc-keyId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyId } TYPE UTF8String IDENTIFIED BY id-pskc-keyId }
id-pskc-keyId OBJECT IDENTIFIER ::= { id-pskc 9 } id-pskc-keyId OBJECT IDENTIFIER ::= { id-pskc 9 }
at-pskc-algorithm ATTRIBUTE ::= { at-pskc-algorithm ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-algorithm } TYPE UTF8String IDENTIFIED BY id-pskc-algorithm }
id-pskc-algorithm OBJECT IDENTIFIER ::= { id-pskc 10 } id-pskc-algorithm OBJECT IDENTIFIER ::= { id-pskc 10 }
skipping to change at page 24, line 43 skipping to change at page 27, line 4
at-pskc-keyProfileId ATTRIBUTE ::= { at-pskc-keyProfileId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyProfileId } TYPE UTF8String IDENTIFIED BY id-pskc-keyProfileId }
id-pskc-keyProfileId OBJECT IDENTIFIER ::= { id-pskc 12 } id-pskc-keyProfileId OBJECT IDENTIFIER ::= { id-pskc 12 }
at-pskc-keyReference ATTRIBUTE ::= { at-pskc-keyReference ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyReference } TYPE UTF8String IDENTIFIED BY id-pskc-keyReference }
id-pskc-keyReference OBJECT IDENTIFIER ::= { id-pskc 13 } id-pskc-keyReference OBJECT IDENTIFIER ::= { id-pskc 13 }
at-pskc-friendlyName ATTRIBUTE ::= { at-pskc-friendlyName ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-friendlyName } TYPE FriendlyName IDENTIFIED BY id-pskc-friendlyName }
id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 } id-pskc-friendlyName OBJECT IDENTIFIER ::= { id-pskc 14 }
FriendlyName ::= SEQUENCE {
friendlyName UTF8String,
friendlyNameLangTag UTF8String OPTIONAL }
at-pskc-algorithmParameters ATTRIBUTE ::= { at-pskc-algorithmParameters ATTRIBUTE ::= {
TYPE PSKCAlgorithmParameters TYPE PSKCAlgorithmParameters
IDENTIFIED BY id-pskc-algorithmParameters } IDENTIFIED BY id-pskc-algorithmParameters }
id-pskc-algorithmParameters OBJECT IDENTIFIER ::= { id-pskc 15 } id-pskc-algorithmParameters OBJECT IDENTIFIER ::= { id-pskc 15 }
PSKCAlgorithmParameters ::= CHOICE { PSKCAlgorithmParameters ::= CHOICE {
suite UTF8String OPTIONAL,
challengeFormat [0] ChallengeFormat, challengeFormat [0] ChallengeFormat,
responseFormat [1] ResponseFormat, responseFormat [1] ResponseFormat,
... } ... }
ChallengeFormat ::= SEQUENCE { ChallengeFormat ::= SEQUENCE {
encoding Encoding, encoding Encoding,
checkDigit BOOLEAN DEFAULT FALSE, checkDigit BOOLEAN DEFAULT FALSE,
min INTEGER (0..MAX), min INTEGER (0..MAX),
max INTEGER (0..MAX), max INTEGER (0..MAX),
... } ... }
skipping to change at page 25, line 40 skipping to change at page 28, line 4
at-pskc-counter ATTRIBUTE ::= { at-pskc-counter ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-counter } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-counter }
id-pskc-counter OBJECT IDENTIFIER ::= { id-pskc 16 } id-pskc-counter OBJECT IDENTIFIER ::= { id-pskc 16 }
at-pskc-time ATTRIBUTE ::= { at-pskc-time ATTRIBUTE ::= {
TYPE BinaryTime IDENTIFIED BY id-pskc-time } TYPE BinaryTime IDENTIFIED BY id-pskc-time }
id-pskc-time OBJECT IDENTIFIER ::= { id-pskc 17 } id-pskc-time OBJECT IDENTIFIER ::= { id-pskc 17 }
at-pskc-timeInterval ATTRIBUTE ::= { at-pskc-timeInterval ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeInterval } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeInterval }
id-pskc-timeInterval OBJECT IDENTIFIER ::= { id-pskc 18 } id-pskc-timeInterval OBJECT IDENTIFIER ::= { id-pskc 18 }
at-pskc-timeDrift ATTRIBUTE ::= { at-pskc-timeDrift ATTRIBUTE ::= {
TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeDrift } TYPE INTEGER (0..MAX) IDENTIFIED BY id-pskc-timeDrift }
id-pskc-timeDrift OBJECT IDENTIFIER ::= { id-pskc 19 } id-pskc-timeDrift OBJECT IDENTIFIER ::= { id-pskc 19 }
at-pskc-valueMAC ATTRIBUTE ::= { at-pskc-valueMAC ATTRIBUTE ::= {
TYPE ValueMac IDENTIFIED BY id-pskc-valueMAC } TYPE ValueMac IDENTIFIED BY id-pskc-valueMAC }
id-pskc-valueMAC OBJECT IDENTIFIER ::= { id-pskc 20 } id-pskc-valueMAC OBJECT IDENTIFIER ::= { id-pskc 20 }
ValueMac ::= SEQUENCE { ValueMac ::= SEQUENCE {
macAlgorithm UTF8String, macAlgorithm UTF8String,
mac UTF8String } mac UTF8String }
at-pskc-keyStartDate ATTRIBUTE ::= { at-pskc-keyUserId ATTRIBUTE ::= {
TYPE UTF8String IDENTIFIED BY id-pskc-keyUserId }
id-pskc-keyUserId OBJECT IDENTIFIER ::= { id-pskc 27 }
at-pskc-keyStartDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyStartDate } TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyStartDate }
id-pskc-keyStartDate OBJECT IDENTIFIER ::= { id-pskc 21 } id-pskc-keyStartDate OBJECT IDENTIFIER ::= { id-pskc 21 }
at-pskc-keyExpiryDate ATTRIBUTE ::= { at-pskc-keyExpiryDate ATTRIBUTE ::= {
TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyExpiryDate } TYPE GeneralizedTime IDENTIFIED BY id-pskc-keyExpiryDate }
id-pskc-keyExpiryDate OBJECT IDENTIFIER ::= { id-pskc 22 } id-pskc-keyExpiryDate OBJECT IDENTIFIER ::= { id-pskc 22 }
at-pskc-numberOfTransactions ATTRIBUTE ::= { at-pskc-numberOfTransactions ATTRIBUTE ::= {
skipping to change at page 27, line 25 skipping to change at page 29, line 34
END END
Authors' Addresses Authors' Addresses
Sean Turner Sean Turner
IECA, Inc. IECA, Inc.
3057 Nutley Street, Suite 106 3057 Nutley Street, Suite 106
Fairfax, VA 22031 Fairfax, VA 22031
USA USA
Email: turners@ieca.com EMail: turners@ieca.com
Russ Housley Russ Housley
Vigil Security, LLC Vigil Security, LLC
918 Spring Knoll Drive 918 Spring Knoll Drive
Herndon, VA 20170 Herndon, VA 20170
USA USA
EMail: housley@vigilsec.com EMail: housley@vigilsec.com
 End of changes. 53 change blocks. 
116 lines changed or deleted 229 lines changed or added

This html diff was produced by rfcdiff 1.38. The latest version is available from http://tools.ietf.org/tools/rfcdiff/