draft-ietf-pkix-rsa-pkalgs-00.txt

PKIX的RFC英文文档

         implementations MAY support other one-way hash functions listed
         in section 2.1.  The MGF1 algorithm identifier is comprised of
         the id-mgf1 object identifier and a parameter that contains the
         algorithm identifier of the one-way hash function employed with
         MGF1.  The SHA-1 algorithm identifier is comprised of the id-
         sha1 object identifier and a parameter of NULL.
         Implementations that perform encryption MUST omit the
         maskGenFunc field when MGF1 with SHA-1 is used, indicating that
         the default algorithm was used.  Implementations that perform
         decryption MUST recognize both the id-mgf1 and id-sha1 object
         identifiers as well as an absent maskGenFunc field as an
         indication that MGF1 with SHA-1 was used.

      pSourceFunc

         The pSourceFunc field identifies the source (and possibly the
         value) of the encoding parameters, commonly called P.
         Implementations MUST represent P by an algorithm identifier,
         id-pSpecified, indicating that P is explicitly provided as an
         OCTET STRING in the parameters.  The default value for P is an
         empty string.  In this case, pHash in EME-OAEP contains the
         hash of a zero length string.  Implementations MUST support a
         zero length P value.  Implementations that perform encryption
         MUST omit the pSourceFunc field when a zero length P value is
         used, indicating that the default value was used.
         Implementations that perform decryption MUST recognize both the
         id-pSpecified object identifier and an absent pSourceFunc field
         as an indication that a zero length P value was used.
         Implementations that perform decryption MUST support a zero
         length P value, and they MAY support other values.

   If the default values of the hashFunc, maskGenFunc, and pSourceFunc
   fields of RSAES-OAEP-params are used, then the algorithm identifier
   will have the following value:

      rSAES-OAEP-Default-Identifier  AlgorithmIdentifier  ::=
                            { id-RSAES-OAEP,
                               { sha1Identifier,
                                 mgf1SHA1Identifier,
                                 pSpecifiedEmptyIdentifier  }  }

5  PKCS #1 Version 1.5 Signature Algorithm


   RFC 2313 [P1v1.5] specifies the PKCS #1 Version 1.5 signature
   algorithm.  This specification is also included in PKCS #1 Version
   2.1 [P1v2.1].  RFC 3279 [PKALGS] specifies the use of the PKCS #1
   Version 1.5 signature algorithm with the MD2, MD5, and the SHA-1 one-



Housley & Kaliski                                              [Page 12]

INTERNET DRAFT                                             December 2002


   way hash functions.  This section specifies the algorithm identifiers
   for using the SHA-256, SHA-384, and SHA-512 one-way hash functions
   with the PKCS #1 version 1.5 signature algorithm.

   The RSASSA-PSS signature algorithm is preferred over the PKCS #1
   Version 1.5 signature algorithm.  Although no attacks are known
   against PKCS #1 Version 1.5 signature algorithm, in the interest of
   increased robustness, RSASSA-PSS signature algorithm is recommended
   for eventual adoption, especially by new applications.  This section
   is included for compatibility with existing applications, and while
   still appropriate for new applications, a gradual transition to the
   RSASSA-PSS signature algorithm is encouraged.

   The PKCS #1 Version 1.5 signature algorithm with these one-way hash
   functions and the RSA encryption algorithm is implemented using the
   padding and encoding conventions described in RFC 2313 [P1v1.5].  The
   message digest is computed using the SHA-256, SHA-384, or SHA-512
   one-way hash function.

   The PKCS #1 version 1.5 signature algorithm, as specified in RFC 2313
   includes a data encoding step.  In this step, the message digest and
   the object identifier for the one-way hash function used to compute
   the message digest are combined.  When performing the data encoding
   step, the id-sha256, id-sha384, and id-sha512 object identifiers (see
   section 2.1) MUST be used to specify the SHA-256, SHA-384, and
   SHA-512 one-way hash functions, respectively.

   The object identifier used to identify the PKCS #1 version 1.5
   signature algorithm with SHA-256 is:

      sha256WithRSAEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 11 }

   The object identifier used to identify the PKCS #1 version 1.5
   signature algorithm with SHA-384 is:

      sha384WithRSAEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 12 }

   The object identifier used to identify the PKCS #1 version 1.5
   signature algorithm with SHA-512 is:

      sha512WithRSAEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 13 }

   When any of these three object identifiers appears within an
   AlgorithmIdentifier, the parameters MUST be NULL.

   The RSA signature generation process and the encoding of the result
   is described in detail in RFC 2313 [P1v1.5].




Housley & Kaliski                                              [Page 13]

INTERNET DRAFT                                             December 2002


6  ASN.1 Module

   PKIX1-PSS-OAEP-Algorithms
     { iso(1) identified-organization(3) dod(6)
       internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
       id-mod-pkix1-rsa-pkalgs(TBD) }

   DEFINITIONS EXPLICIT TAGS ::= BEGIN

   -- EXPORTS All;

   IMPORTS
      AlgorithmIdentifier
          FROM PKIX1Explicit88 -- RFC 3280
          { iso(1) identified-organization(3) dod(6) internet(1)
            security(5) mechanisms(5) pkix(7) id-mod(0)
            id-pkix1-explicit(18) };


   -- ============================
   --   Basic object identifiers
   -- ============================

   pkcs-1  OBJECT IDENTIFIER  ::=  { iso(1) member-body(2)
                           us(840) rsadsi(113549) pkcs(1) 1 }


   -- When rsaEncryption is used in an AlgorithmIdentifier the
   -- parameters MUST be present and MUST be NULL.

   rsaEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 1 }


   -- When id-RSAES-OAEP is used in an AlgorithmIdentifier the
   -- parameters MUST be present and MUST be RSAES-OAEP-params.

   id-RSAES-OAEP  OBJECT IDENTIFIER  ::=  { pkcs-1 7 }


   -- When id-pSpecified is used in an AlgorithmIdentifier the
   -- parameters MUST be an OCTET STRING.

   id-pSpecified  OBJECT IDENTIFIER  ::=  { pkcs-1 9 }








Housley & Kaliski                                              [Page 14]

INTERNET DRAFT                                             December 2002


   -- When id-RSASSA-PSS is used in an AlgorithmIdentifier the
   -- parameters MUST be present and MUST be RSASSA-PSS-params.

   id-RSASSA-PSS  OBJECT IDENTIFIER  ::=  { pkcs-1 10 }


   -- When id-mgf1 is used in an AlgorithmIdentifier the parameters
   -- MUST be present and MUST be a HashAlgorithm.

   id-mgf1  OBJECT IDENTIFIER  ::=  { pkcs-1 8 }


   -- When the following OIDs are used in an AlgorithmIdentifier the
   -- parameters MUST be present and MUST be NULL.

   sha256WithRSAEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 11 }


   sha384WithRSAEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 12 }


   sha512WithRSAEncryption  OBJECT IDENTIFIER  ::=  { pkcs-1 13 }


   -- When the following OIDs are used in an AlgorithmIdentifier the
   -- parameters SHOULD be absent, but if the parameters are present,
   -- they MUST be NULL.

   id-sha1  OBJECT IDENTIFIER  ::=  { iso(1)
                        identified-organization(3) oiw(14)
                        secsig(3) algorithms(2) 26 }

   id-sha256  OBJECT IDENTIFIER  ::=  { joint-iso-itu-t(2)
                        country(16) us(840) organization(1) gov(101)
                        csor(3) nistalgorithm(4) hashalgs(2) 1 }

   id-sha384  OBJECT IDENTIFIER  ::=  { joint-iso-itu-t(2)
                        country(16) us(840) organization(1) gov(101)
                        csor(3) nistalgorithm(4) hashalgs(2) 2 }

   id-sha512  OBJECT IDENTIFIER  ::=  { joint-iso-itu-t(2)
                        country(16) us(840) organization(1) gov(101)
                        csor(3) nistalgorithm(4) hashalgs(2) 3 }








Housley & Kaliski                                              [Page 15]

INTERNET DRAFT                                             December 2002


   -- =============
   --   Constant
   -- =============

   nullOctetString  OCTET STRING (SIZE (0))  ::=  { ''H }


   -- =========================
   --   Algorithm Identifiers
   -- =========================

   sha1Identifier  AlgorithmIdentifier  ::=  { id-sha1, NULL }

   sha256Identifier  AlgorithmIdentifier  ::=  { id-sha256, NULL }

   sha384Identifier  AlgorithmIdentifier  ::=  { id-sha384, NULL }

   sha512Identifier  AlgorithmIdentifier  ::=  { id-sha512, NULL }

   mgf1SHA1Identifier  AlgorithmIdentifier  ::=
                        { id-mgf1, sha1Identifier }

   mgf1SHA256Identifier  AlgorithmIdentifier  ::=
                        { id-mgf1, sha256Identifier }

   mgf1SHA384Identifier  AlgorithmIdentifier  ::=
                        { id-mgf1, sha384Identifier }

   mgf1SHA512Identifier  AlgorithmIdentifier  ::=
                        { id-mgf1, sha512Identifier }

   pSpecifiedEmptyIdentifier  AlgorithmIdentifier  ::=
                        { id-pSpecified, nullOctetString }

   rSASSA-PSS-Default-Identifier  AlgorithmIdentifier  ::=  {
                        { id-RSASSA-PSS,
                           { sha1Identifier,
                             mgf1SHA1Identifier,
                             20,
                             1  }  }

   rSASSA-PSS-SHA256-Identifier  AlgorithmIdentifier  ::=  {
                        { id-RSASSA-PSS,
                           { sha256Identifier,
                             mgf1SHA256Identifier,
                             20,
                             1  }  }




Housley & Kaliski                                              [Page 16]

INTERNET DRAFT                                             December 2002


   rSASSA-PSS-SHA384-Identifier  AlgorithmIdentifier  ::=  {
                        { id-RSASSA-PSS,
                           { sha384Identifier,
                             mgf1SHA384Identifier,
                             20,
                             1  }  }

   rSASSA-PSS-SHA512-Identifier  AlgorithmIdentifier  ::=  {
                        { id-RSASSA-PSS,
                           { sha512Identifier,
                             mgf1SHA512Identifier,
                             20,
                             1  }  }

   rSAES-OAEP-Default-Identifier  AlgorithmIdentifier  ::=
                        { id-RSAES-OAEP,
                           { sha1Identifier,
                             mgf1SHA1Identifier,
                             pSpecifiedEmptyIdentifier  }  }

   rSAES-OAEP-SHA256-Identifier  AlgorithmIdentifier  ::=
                        { id-RSAES-OAEP,
                           { sha256Identifier,
                             mgf1SHA256Identifier,
                             pSpecifiedEmptyIdentifier  }  }

   rSAES-OAEP-SHA384-Identifier  AlgorithmIdentifier  ::=