rfc2985.txt

RFC 的详细文档！

Network Working Group                                           M. Nystrom
Request for Comments: 2985                                      B. Kaliski
Category: Informational                                       RSA Security
                                                             November 2000


          PKCS #9: Selected Object Classes and Attribute Types
                              Version 2.0

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2000).  All Rights Reserved.

Abstract

   This memo represents a republication of PKCS #9 v2.0 from RSA
   Laboratories' Public-Key Cryptography Standards (PKCS) series, and
   change control is retained within the PKCS process.  The body of this
   document, except for the security considerations section, is taken
   directly from that specification.

   This memo provides a selection of object classes and attribute types
   for use in conjunction with public-key cryptography and Lightweight
   Directory Access Protocol (LDAP) accessible directories.  It also
   includes ASN.1 syntax for all constructs.

Table of Contents

   1.  Introduction ................................................. 2
   2.  Definitions, notation and document convention ................ 2
   2.1  Definitions ................................................. 2
   2.2  Notation and document convention ............................ 3
   3.  Overview ..................................................... 4
   4.  Auxiliary object classes ..................................... 5
   4.1  The "pkcsEntity" auxiliary object class ..................... 5
   4.2  The "naturalPerson" auxiliary object class .................. 6
   5.  Selected attribute types ..................................... 6
   5.1  Attribute types for use with the "pkcsEntity" object class .. 6
   5.2  Attribute types for use with the "naturalPerson" object class 7
   5.3  Attribute types for use in PKCS #7 data .................... 12
   5.4  Attribute types for use in PKCS #10 certificate requests ... 16




Nystrom & Kaliski            Informational                      [Page 1]

RFC 2985      Selected Object Classes and Attribute Types  November 2000


   5.5  Attribute types for use in PKCS #12 "PFX" PDUs or PKCS #15
        tokens ..................................................... 17
   5.6  Attributes defined in S/MIMIE .............................. 18
   6.  Matching rules .............................................. 19
   6.1  Case ignore match .......................................... 19
   6.2  Signing time match ......................................... 20
   7.  Security Considerations ..................................... 20
   8.  Authors' Addresses .......................................... 21
   A.  ASN.1 module ................................................ 22
   B.  BNF schema summary .......................................... 30
   B.1  Syntaxes ................................................... 30
   B.2  Object classes ............................................. 31
   B.3  Attribute types ............................................ 32
   B.4  Matching rules ............................................. 36
   C.  Intellectual property considerations ........................ 37
   D.  Revision history ............................................ 37
   E.  References .................................................. 39
   F.  Contact information & About PKCS ............................ 41
   Full Copyright Statement ........................................ 41

1. Introduction

   This document defines two new auxiliary object classes, pkcsEntity
   and naturalPerson, and selected attribute types for use with these
   classes.  It also defines some attribute types for use in conjunction
   with PKCS #7 [14] (and S/MIME CMS [3]) digitally signed messages,
   PKCS #10 [16] certificate-signing requests, PKCS #12 [17] personal
   information exchanges and PKCS #15 [18] cryptographic tokens.
   Matching rules for use with these attributes are also defined,
   whenever necessary.

2. Definitions, notation and document conventions

 2.1 Definitions

   For the purposes of this document, the following definitions apply.

   ASN.1           Abstract Syntax Notation One, as defined in [5].

   Attributes      An ASN.1 type that specifies a set of attributes.
                   Each attribute contains an attribute type (specified
                   by object identifier) and one or more attribute
                   values.  Some attribute types are restricted in their
                   definition to have a single value; others may have
                   multiple values.  This type is defined in [7].






Nystrom & Kaliski            Informational                      [Page 2]

RFC 2985      Selected Object Classes and Attribute Types  November 2000


   CertificationRequestInfo
                   An ASN.1 type that specifies a subject name, a public
                   key, and a set of attributes.  This type is defined
                   in [16].

   ContentInfo     An ASN.1 type that specifies content exchanged
                   between entities.  The contentType field, which has
                   type OBJECT IDENTIFIER, specifies the content type,
                   and the content field, whose type is defined by the
                   contentType field, contains the content value.  This
                   type is defined in [14] and [3].

   PrivateKeyInfo  A type that specifies a private key and a set of
                   extended attributes.  This type and the associated
                   EncryptedPrivateKeyInfo type are defined in [15].

   SignerInfo      A type that specifies per-signer information in the
                   signed-data content type, including a set of
                   attributes authenticated by the signer, and a set of
                   attributes not authenticated by the signer.  This
                   type is defined in [14] and [3].

   DER             Distinguished Encoding Rules for ASN.1, as defined in
                   [6].

   UCS             Universal Multiple-Octet Coded Character Set, as
                   defined in [11].

   UTF8String      UCS Transformation Format encoded string.  The UTF-8
                   encoding is defined in [11].

 2.2 Notation and document conventions

   In this document, all attribute type and object class definitions are
   written in the ASN.1 value notation defined in [5].  Appendix B
   contains most of these definitions written in the augmented BNF
   notation defined in [2] as well.  This has been done in an attempt to
   simplify the task of integrating this work into LDAP [22] development
   environments.

   The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [1].








Nystrom & Kaliski            Informational                      [Page 3]

RFC 2985      Selected Object Classes and Attribute Types  November 2000


3. Overview

   This document specifies two new auxiliary object classes, pkcsEntity
   and naturalPerson, and some new attribute types and matching rules.
   All ASN.1 object classes, attributes, matching rules and types are
   exported for use in other environments.

   Attribute types defined in this document that are useful in
   conjunction with storage of PKCS-related data and the pkcsEntity
   object class includes PKCS #12 PFX PDUs, PKCS #15 tokens and
   encrypted private keys.

   Attribute types defined in this document that are useful in
   conjunction with PKCS #10 certificate requests and the naturalPerson
   object class includes electronic-mail address, pseudonym,
   unstructured name, and unstructured address.

   Attribute types defined in this document that are useful in PKCS #7
   digitally signed messages are content type, message digest, signing
   time, sequence number, random nonce and countersignature.  The
   attributes would be used in the authenticatedAttributes and
   unauthenticatedAttributes fields of a SignerInfo or an
   AuthenticatedData ([3]) value.

   Attribute types that are useful especially in PKCS #10 certification
   requests are the challenge password and the extension-request
   attribute.  The attributes would be used in the attributes field of a
   CertificationRequestInfo value.

   Note - The attributes types (from [8]) in Table 1, and probably
   several others, might also be helpful in PKCS #10, PKCS #12 and PKCS
   #15-aware applications.



















Nystrom & Kaliski            Informational                      [Page 4]

RFC 2985      Selected Object Classes and Attribute Types  November 2000


       businessCategory            preferredDeliveryMethod
       commonName                  presentationAddress
       countryName                 registeredAddress
       description                 roleOccupant
       destinationIndicator        serialNumber
       facsimileTelephoneNumber    stateOrProvinceName
       iSDNAddress                 streetAddress
       localityName                supportedApplicationContext
       member                      surname
       objectClass                 telephoneNumber
       organizationName            teletexTerminalIdentifier
       physicalDeliveryOfficeName  telexNumber
       postalAddress               title
       postalCode                  x121Address
       postOfficeBox

   Table 1: ISO/IEC 9594-6 attribute types useful in PKCS documents

4. Auxiliary object classes

   This document defines two new auxiliary object classes: pkcsEntity
   and naturalPerson.

 4.1 The pkcsEntity auxiliary object class

   The pkcsEntity object class is a general-purpose auxiliary object
   class that is intended to hold attributes about PKCS-related
   entities.  It has been designed for use within directory services
   based on the LDAP protocol [22] and the X.500 family of protocols,
   where support for PKCS-defined attributes is considered useful.

   pkcsEntity OBJECT-CLASS ::=     {
           SUBCLASS OF { top }
           KIND auxiliary
           MAY CONTAIN { PKCSEntityAttributeSet }
           ID pkcs-9-oc-pkcsEntity
   }

   PKCSEntityAttributeSet ATTRIBUTE ::= {
           pKCS7PDU |
           userPKCS12 |
           pKCS15Token |
           encryptedPrivateKeyInfo,
           ... -- For future extensions
   }

   Attributes in the PKCSEntityAttributeSet are defined in Section 5.




Nystrom & Kaliski            Informational                      [Page 5]

RFC 2985      Selected Object Classes and Attribute Types  November 2000


 4.2 The naturalPerson auxiliary object class

   The naturalPerson object class is a general-purpose auxiliary object
   class that is intended to hold attributes about human beings.  It has
   been designed for use within directory services based on the LDAP
   protocol [22] and the X.500 family of protocols, where support for
   these attributes is considered useful.

   naturalPerson OBJECT-CLASS      ::=     {
           SUBCLASS OF { top }
           KIND auxiliary
           MAY CONTAIN { NaturalPersonAttributeSet }
           ID pkcs-9-oc-naturalPerson
   }

   NaturalPersonAttributeSet ATTRIBUTE ::= {
           emailAddress |
           unstructuredName |
           unstructuredAddress |
           dateOfBirth |
           placeOfBirth |
           gender |
           countryOfCitizenship |
           countryOfResidence |
           pseudonym |
           serialNumber,
           ... -- For future extensions
   }

   Attributes in the NaturalPersonAttributeSet are defined in Section 5.

5. Selected attribute types

 5.1 Attribute types for use with the "pkcsEntity" object class

  5.1.1 PKCS #7 PDU

   PKCS #7 provides several formats for enveloped, signed and otherwise
   protected data.  When such information is stored in a directory
   service, the pKCS7PDU attribute may be used.

   pKCS7PDU ATTRIBUTE ::= {
           WITH SYNTAX ContentInfo
           ID pkcs-9-at-pkcs7PDU
   }






Nystrom & Kaliski            Informational                      [Page 6]

RFC 2985      Selected Object Classes and Attribute Types  November 2000


  5.1.2 PKCS #12 token

   PKCS #12 provides a format for exchange of personal identity
   information.  When such information is stored in a directory service,
   the userPKCS12 attribute should be used.

   userPKCS12 ATTRIBUTE ::= {
           WITH SYNTAX PFX
           ID pkcs-9-at-userPKCS12
   }

   This type was originally defined in [20].

  5.1.3 PKCS #15 token

   PKCS #15 provides a format for cryptographic tokens.  When software
   variants of such tokens are stored in a directory service, the
   pKCS15Token attribute should be used.

   pKCS15Token ATTRIBUTE ::= {
           WITH SYNTAX PKCS15Token
           ID pkcs-9-at-pkcs15Token
   }

  5.1.4 PKCS #8 encrypted private key information

   PKCS #8 provides a format for encrypted private keys.  When such
   information is stored in a directory service, the
   encryptedPrivateKeyInfo attribute should be used.

   encryptedPrivateKeyInfo ATTRIBUTE ::= {
           WITH SYNTAX EncryptedPrivateKeyInfo
           ID pkcs-9-at-encryptedPrivateKeyInfo
   }

 5.2 Attribute types for use with the "naturalPerson" object class

  5.2.1 Electronic-mail address

   The emailAddress attribute type specifies the electronic-mail address
   or addresses of a subject as an unstructured ASCII string.  The
   interpretation of electronic-mail addresses is intended to be
   specified by certificate issuers etc.; no particular interpretation
   is required.







Nystrom & Kaliski            Informational                      [Page 7]

RFC 2985      Selected Object Classes and Attribute Types  November 2000


   emailAddress ATTRIBUTE ::= {
           WITH SYNTAX IA5String (SIZE(1..pkcs-9-ub-emailAddress))
           EQUALITY MATCHING RULE pkcs9CaseIgnoreMatch
           ID pkcs-9-at-emailAdress
   }

   An electronic-mail address attribute can have multiple attribute
   values.  When comparing two email addresses, case is irrelevant.  The
   pkcs9CaseIgnoreMatch is defined in Section 6.

   Note - It is likely that other standards bodies overseeing
   electronic-mail systems will, or have, registered electronic-mail