rfc2986.txt

著名的RFC文档,其中有一些文档是已经翻译成中文的的.


RFC 2986       Certification Request Syntax Specification  November 2000


   The signature process consists of two steps:

        1. The value of the certificationRequestInfo component is DER
           encoded, yielding an octet string.

        2. The result of step 1 is signed with the certification request
           subject's private key under the specified signature
           algorithm, yielding a bit string, the signature.

   Note - An equivalent syntax for CertificationRequest could be
   written:

   CertificationRequest ::= SIGNED { EncodedCertificationRequestInfo }
        (CONSTRAINED BY { -- Verify or sign encoded
         -- CertificationRequestInfo -- })

   EncodedCertificationRequestInfo ::=
        TYPE-IDENTIFIER.&Type(CertificationRequestInfo)

   SIGNED { ToBeSigned } ::= SEQUENCE {
        toBeSigned ToBeSigned,
        algorithm  AlgorithmIdentifier { {SignatureAlgorithms} },
        signature  BIT STRING
   }

5. Security Considerations

   Security issues are discussed throughout this memo.

6. Authors' Addresses

   Magnus Nystrom
   RSA Security
   Box 10704
   S-121 29 Stockholm
   Sweden

   EMail: [e-mail]


   Burt Kaliski
   RSA Security
   20 Crosby Drive
   Bedford, MA 01730 USA

   EMail: [e-mail]





Nystrom & Kaliski            Informational                      [Page 8]

RFC 2986       Certification Request Syntax Specification  November 2000


APPENDICES

A. ASN.1 Module

   This appendix includes all of the ASN.1 type and value definitions
   contained in this document in the form of the ASN.1 module PKCS-10.

   PKCS-10 {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
   pkcs-10(10) modules(1) pkcs-10(1)}

   DEFINITIONS IMPLICIT TAGS ::=

   BEGIN

   -- EXPORTS All --

   -- All types and values defined in this module are exported for use
   -- in other ASN.1 modules.

   IMPORTS

   informationFramework, authenticationFramework
        FROM UsefulDefinitions {joint-iso-itu-t(2) ds(5) module(1)
        usefulDefinitions(0) 3}

   ATTRIBUTE, Name
        FROM InformationFramework informationFramework

   ALGORITHM
        FROM AuthenticationFramework authenticationFramework;

   -- Certificate requests
   CertificationRequestInfo ::= SEQUENCE {
        version       INTEGER { v1(0) } (v1,...),
        subject       Name,
        subjectPKInfo SubjectPublicKeyInfo{{ PKInfoAlgorithms }},
        attributes    [0] Attributes{{ CRIAttributes }}
   }

   SubjectPublicKeyInfo {ALGORITHM: IOSet} ::= SEQUENCE {
        algorithm        AlgorithmIdentifier {{IOSet}},
        subjectPublicKey BIT STRING
   }

   PKInfoAlgorithms ALGORITHM ::= {
        ...  -- add any locally defined algorithms here -- }

   Attributes { ATTRIBUTE:IOSet } ::= SET OF Attribute{{ IOSet }}



Nystrom & Kaliski            Informational                      [Page 9]

RFC 2986       Certification Request Syntax Specification  November 2000


   CRIAttributes  ATTRIBUTE  ::= {
        ... -- add any locally defined attributes here -- }

   Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
        type   ATTRIBUTE.&id({IOSet}),
        values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type})
   }

   CertificationRequest ::= SEQUENCE {
        certificationRequestInfo CertificationRequestInfo,
        signatureAlgorithm AlgorithmIdentifier{{ SignatureAlgorithms }},
        signature          BIT STRING
   }

   AlgorithmIdentifier {ALGORITHM:IOSet } ::= SEQUENCE {
        algorithm  ALGORITHM.&id({IOSet}),
        parameters ALGORITHM.&Type({IOSet}{@algorithm}) OPTIONAL
   }

   SignatureAlgorithms ALGORITHM ::= {
        ... -- add any locally defined algorithms here -- }

   END

B. Intellectual property considerations

   RSA Security makes no patent claims on the general constructions
   described in this document, although specific underlying techniques
   may be covered.

   License to copy this document is granted provided that it is
   identified as "RSA Security Inc.  Public-Key Cryptography Standards
   (PKCS)" in all material mentioning or referencing this document.

   RSA Security makes no representations regarding intellectual property
   claims by other parties.  Such determination is the responsibility of
   the user.

C. Revision history

   Version 1.0

         Version 1.0 was the previous version of this document (also
         published as "version 1.5" in [6]).







Nystrom & Kaliski            Informational                     [Page 10]

RFC 2986       Certification Request Syntax Specification  November 2000


   Version 1.7

         This version incorporates several editorial changes, including
         updates to the references, and changes to ASN.1 type
         definitions.  The following substantive changes have been made:

         - This version refers to X.680-X.690, the current international
           standards for ASN.1 and its encoding rules.  All references
           to X.208 and X.209 have been eliminated.

         - The X.690 standard requires that the encoded values of SET OF
           components be sorted in ascending order under DER.
           Regardless of this, applications should not rely on the
           ordering of attribute components.

         - All references to PKCS #6 Extended-Certificate Syntax
           Standard have been removed.  With the addition of extensions
           to X.509 version 3 certificates, RSA Laboratories is
           withdrawing support for PKCS #6.

   Note - The reason for using version 1.7 for this document is to avoid
   confusion with [6], which is named version 1.5, and an unsupported
   PKCS #10 version named Version 1.6.

D. References

   [1]  RSA Laboratories. PKCS #1: RSA Encryption Standard. Version 2.0,
        October 1998.

   [2]  RSA Laboratories. PKCS #7: Cryptographic Message Syntax
        Standard.  Version 1.5, November 1993.

   [3]  RSA Laboratories. PKCS #9: Selected Attribute Types. Version
        2.0, February 2000.

   [4]  Adams, C. and S. Farrell, "Internet X.509 Public Key
        Infrastructure - Certificate Management Protocols", RFC 2510,
        March 1999.

   [5]  Kaliski, B., "Privacy Enhancement for Internet Electronic Mail:
        Part IV: Key Certification and Related Services", RFC 1424,
        February 1993.

   [6]  Kaliski, B., "PKCS #10: Certification Request Syntax Version
        1.5", RFC 2314, March 1998.






Nystrom & Kaliski            Informational                     [Page 11]

RFC 2986       Certification Request Syntax Specification  November 2000


   [7]  ITU-T Recommendation X.500 (1997) | ISO/IEC 9594-1:1998,
        Information technology - Open Systems Interconnection - The
        Directory: Overview of concepts, models and services.

   [8]  ITU-T Recommendation X.501 (1993) | ISO/IEC 9594-2:1995,
        Information technology - Open Systems Interconnection - The
        Directory: Models.

   [9]  ITU-T Recommendation X.509 (1997) | ISO/IEC 9594-8:1998,
        Information technology - Open Systems Interconnection -The
        Directory:  Authentication framework.

   [10] ITU-T Recommendation X.680 (1997) | ISO/IEC 8824-1:1998,
        Information Technology - Abstract Syntax Notation One (ASN.1):
        Specification of Basic Notation.

   [11] ITU-T Recommendation X.681 (1997) | ISO/IEC 8824-2:1998,
        Information Technology - Abstract Syntax Notation One (ASN.1):
        Information Object Specification.

   [12] ITU-T Recommendation X.682 (1997) | ISO/IEC 8824-3:1998,
        Information Technology - Abstract Syntax Notation One (ASN.1):
        Constraint Specification.

   [13] ITU-T Recommendation X.683 (1997) | ISO/IEC 8824-4:1998,
        Information Technology - Abstract Syntax Notation One (ASN.1):
        Parameterization of ASN.1 Specifications.

   [14] ITU-T Recommendation X.690 (1997) | ISO/IEC 8825-1:1998,
        Information Technology - ASN.1 Encoding Rules: Specification of
        Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and
        Distinguished Encoding Rules (DER).

E. Contact Information & About PKCS

   The Public-Key Cryptography Standards are specifications produced by
   RSA Laboratories in cooperation with secure systems developers
   worldwide for the purpose of accelerating the deployment of public-
   key cryptography.  First published in 1991 as a result of meetings
   with a small group of early adopters of public-key technology, the
   PKCS documents have become widely referenced and implemented.
   Contributions from the PKCS series have become part of many formal
   and de facto standards, including ANSI X9 documents, PKIX, SET,
   S/MIME, and SSL.







Nystrom & Kaliski            Informational                     [Page 12]

RFC 2986       Certification Request Syntax Specification  November 2000


   Further development of PKCS occurs through mailing list discussions
   and occasional workshops, and suggestions for improvement are
   welcome.  For more information, contact:

        PKCS Editor
        RSA Laboratories
        20 Crosby Drive
        Bedford, MA  01730 USA
        [e-mail]
        http://www.rsasecurity.com/rsalabs/pkcs









































Nystrom & Kaliski            Informational                     [Page 13]

RFC 2986       Certification Request Syntax Specification  November 2000


Full Copyright Statement

   Copyright (C) The Internet Society 2000. All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others provided that the above copyright notice and this paragraph
   are included on all such copies.  However, this document itself may
   not be modified in any way, such as by removing the copyright notice
   or references to the Internet Society or other Internet
   organizations, except as required to translate it into languages
   other than English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR  IMPLIED, INCLUDING
   BUT NOT  LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY  IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.

























Nystrom & Kaliski            Informational                     [Page 14]