rfc2875.txt

著名的RFC文档,其中有一些文档是已经翻译成中文的的.

   (imported from [PROFILE]).

5. Security Considerations

   In the static DH POP algorithm, an appropriate value can be produced
   by either party.  Thus this algorithm only provides integrity and not
   origination service.  The Discrete Logarithm algorithm provides both
   integrity checking and origination checking.








Prafullchandra & Schaad     Standards Track                     [Page 7]

RFC 2875     Diffie-Hellman Proof-of-Possession Algorithms     July 2000


   All the security in this system is provided by the secrecy of the
   private keying material. If either sender or recipient private keys
   are disclosed, all messages sent or received using that key are
   compromised. Similarly, loss of the private key results in an
   inability to read messages sent using that key.

   Selection of parameters can be of paramount importance.  In the
   selection of parameters one must take into account the
   community/group of entities that one wishes to be able to communicate
   with.  In choosing a set of parameters one must also be sure to avoid
   small groups.  [FIPS-186] Appendixes 2 and 3 contain information on
   the selection of parameters.  The practices outlined in this document
   will lead to better selection of parameters.

6. References

   [FIPS-186]  Federal Information Processing Standards Publication
               (FIPS PUB) 186, "Digital Signature Standard", 1994 May
               19.

   [RFC2314]   Kaliski, B., "PKCS #10: Certification Request Syntax
               v1.5", RFC 2314, October 1997.

   [RFC2104]   Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
               Hashing for Message Authentication", RFC 2104, February
               1997.

   [PROFILE]   Housley, R., Ford, W., Polk, W., and D. Solo, "Internet
               X.509 Public Key Infrastructure: Certificate and CRL
               Profile", RFC 2459, January 1999.

   [DH-X9.42]  Rescorla, E., "Diffie-Hellman Key Agreement Method", RFC
               2631, June 1999.

7. Authors' Addresses

   Hemma Prafullchandra
   Critical Path Inc.
   5150 El Camino Real, #A-32
   Los Altos, CA 94022

   Phone: [phone]
   EMail: [e-mail]


   Jim Schaad

   EMail: [e-mail]



Prafullchandra & Schaad     Standards Track                     [Page 8]

RFC 2875     Diffie-Hellman Proof-of-Possession Algorithms     July 2000


Appendix A.  ASN.1 Module

   DH-Sign DEFINITIONS IMPLICIT TAGS ::=

   BEGIN
   --EXPORTS ALL
   -- The types and values defined in this module are exported for use
   -- in the other ASN.1 modules. Other applications may use them
   -- for their own purposes.

   IMPORTS
      IssuerAndSerialNumber, MessageDigest
      FROM CryptographicMessageSyntax { iso(1) member-body(2)
           us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16)
           modules(0) cms(1) }

      Dss-Sig-Value, DomainParameters
      FROM PKIX1Explicit88 {iso(1) identified-organization(3) dod(6)
           internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
           id-pkix1-explicit-88(1)};

      id-dh-sig-hmac-sha1 OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 3}

      DhSigStatic ::= SEQUENCE {
          IssuerAndSerial IssuerAndSerialNumber OPTIONAL,
          hashValue       MessageDigest
      }

      id-alg-dh-pop OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 4}

   END




















Prafullchandra & Schaad     Standards Track                     [Page 9]

RFC 2875     Diffie-Hellman Proof-of-Possession Algorithms     July 2000


Appendix B. Example of Static DH Proof-of-Possession

   The following example follows the steps described earlier in section
   3.

   Step 1: Establishing common Diffie-Hellman parameters. Assume the
   parameters are as in the DER encoded certificate. The certificate
   contains a DH public key signed by a CA with a DSA signing key.

  0 30 939: SEQUENCE {
  4 30 872:   SEQUENCE {
  8 A0   3:     [0] {
 10 02   1:       INTEGER 2
          :       }
 13 02   6:     INTEGER
          :       00 DA 39 B6 E2 CB
 21 30  11:     SEQUENCE {
 23 06   7:       OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
 32 05   0:       NULL
          :       }
 34 30  72:     SEQUENCE {
 36 31  11:       SET {
 38 30   9:         SEQUENCE {
 40 06   3:           OBJECT IDENTIFIER countryName (2 5 4 6)
 45 13   2:           PrintableString 'US'
          :           }
          :         }
 49 31  17:       SET {
 51 30  15:         SEQUENCE {
 53 06   3:           OBJECT IDENTIFIER organizationName (2 5 4 10)
 58 13   8:           PrintableString 'XETI Inc'
          :           }
          :         }
 68 31  16:       SET {
 70 30  14:         SEQUENCE {
 72 06   3:           OBJECT IDENTIFIER organizationalUnitName (2 5 4
11)
 77 13   7:           PrintableString 'Testing'
          :           }
          :         }
 86 31  20:       SET {
 88 30  18:         SEQUENCE {
 90 06   3:           OBJECT IDENTIFIER commonName (2 5 4 3)
 95 13  11:           PrintableString 'Root DSA CA'
          :           }
          :         }
          :       }
108 30  30:     SEQUENCE {



Prafullchandra & Schaad     Standards Track                    [Page 10]

RFC 2875     Diffie-Hellman Proof-of-Possession Algorithms     July 2000


110 17  13:       UTCTime '990914010557Z'
125 17  13:       UTCTime '991113010557Z'
          :       }
140 30  70:     SEQUENCE {
142 31  11:       SET {
144 30   9:         SEQUENCE {
146 06   3:           OBJECT IDENTIFIER countryName (2 5 4 6)
151 13   2:           PrintableString 'US'
          :           }
          :         }
155 31  17:       SET {
157 30  15:         SEQUENCE {
159 06   3:           OBJECT IDENTIFIER organizationName (2 5 4 10)
164 13   8:           PrintableString 'XETI Inc'
          :           }
          :         }
174 31  16:       SET {
176 30  14:         SEQUENCE {
178 06   3:           OBJECT IDENTIFIER organizationalUnitName (2 5 4
11)
183 13   7:           PrintableString 'Testing'
          :           }
          :         }
192 31  18:       SET {
194 30  16:         SEQUENCE {
196 06   3:           OBJECT IDENTIFIER commonName (2 5 4 3)
201 13   9:           PrintableString 'DH TestCA'
          :           }
          :         }
          :       }
212 30 577:     SEQUENCE {
216 30 438:       SEQUENCE {
220 06   7:         OBJECT IDENTIFIER dhPublicKey (1 2 840 10046 2 1)
229 30 425:         SEQUENCE {
233 02 129:           INTEGER
          :             00 94 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7
          :             C5 A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1 4A 14 82
          :             F5 D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21
          :             51 63 02 86 AA 06 B8 21 36 B6 7F 36 DF D1 D6 68
          :             5B 79 7C 1D 5A 14 75 1F 6A 93 75 93 CE BB 97 72
          :             8A F0 0F 23 9D 47 F6 D4 B3 C7 F0 F4 E6 F6 2B C2
          :             32 E1 89 67 BE 7E 06 AE F8 D0 01 6B 8B 2A F5 02
          :             D7 B6 A8 63 94 83 B0 1B 31 7D 52 1A DE E5 03 85
          :             27
365 02 128:           INTEGER
          :             26 A6 32 2C 5A 2B D4 33 2B 5C DC 06 87 53 3F 90
          :             06 61 50 38 3E D2 B9 7D 81 1C 12 10 C5 0C 53 D4
          :             64 D1 8E 30 07 08 8C DD 3F 0A 2F 2C D6 1B 7F 57



Prafullchandra & Schaad     Standards Track                    [Page 11]

RFC 2875     Diffie-Hellman Proof-of-Possession Algorithms     July 2000


          :             86 D0 DA BB 6E 36 2A 18 E8 D3 BC 70 31 7A 48 B6
          :             4E 18 6E DD 1F 22 06 EB 3F EA D4 41 69 D9 9B DE
          :             47 95 7A 72 91 D2 09 7F 49 5C 3B 03 33 51 C8 F1
          :             39 9A FF 04 D5 6E 7E 94 3D 03 B8 F6 31 15 26 48
          :             95 A8 5C DE 47 88 B4 69 3A 00 A7 86 9E DA D1 CD
496 02  33:           INTEGER
          :             00 E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 78 94
          :             B1 85 01 E5 69 37 21 F7 25 B9 BA 71 4A FC 60 30
          :             FB
531 02  97:           INTEGER
          :             00 A3 91 01 C0 A8 6E A4 4D A0 56 FC 6C FE 1F A7
          :             B0 CD 0F 94 87 0C 25 BE 97 76 8D EB E5 A4 09 5D
          :             AB 83 CD 80 0B 35 67 7F 0C 8E A7 31 98 32 85 39
          :             40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D B6 76
          :             B4 61 2F 21 E1 4B 0E 68 FF 53 3E 87 DD D8 71 56
          :             68 47 DC F7 20 63 4B 3C 5F 78 71 83 E6 70 9E E2
          :             92
630 30  26:           SEQUENCE {
632 03  21:             BIT STRING 0 unused bits
          :             1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB
          :             09 E4 98 34
655 02   1:             INTEGER 55
          :             }
          :           }
          :         }
658 03 132:       BIT STRING 0 unused bits
          :         02 81 80 5F CF 39 AD 62 CF 49 8E D1 CE 66 E2 B1
          :         E6 A7 01 4D 05 C2 77 C8 92 52 42 A9 05 A4 DB E0
          :         46 79 50 A3 FC 99 3D 3D A6 9B A9 AD BC 62 1C 69
          :         B7 11 A1 C0 2A F1 85 28 F7 68 FE D6 8F 31 56 22
          :         4D 0A 11 6E 72 3A 02 AF 0E 27 AA F9 ED CE 05 EF
          :         D8 59 92 C0 18 D7 69 6E BD 70 B6 21 D1 77 39 21
          :         E1 AF 7A 3A CF 20 0A B4 2C 69 5F CF 79 67 20 31
          :         4D F2 C6 ED 23 BF C4 BB 1E D1 71 40 2C 07 D6 F0
          :         8F C5 1A
          :       }
793 A3  85:     [3] {
795 30  83:       SEQUENCE {
797 30  29:         SEQUENCE {
799 06   3:           OBJECT IDENTIFIER subjectKeyIdentifier (2 5 29
14)
804 04  22:           OCTET STRING
          :             04 14 80 DF 59 88 BF EB 17 E1 AD 5E C6 40 A3 42
          :             E5 AC D3 B4 88 78
          :           }
828 30  34:         SEQUENCE {
830 06   3:           OBJECT IDENTIFIER authorityKeyIdentifier (2 5 29
35)



Prafullchandra & Schaad     Standards Track                    [Page 12]

RFC 2875     Diffie-Hellman Proof-of-Possession Algorithms     July 2000


835 01   1:           BOOLEAN TRUE
838 04  24:           OCTET STRING
          :             30 16 80 14 6A 23 37 55 B9 FD 81 EA E8 4E D3 C9
          :             B7 09 E5 7B 06 E3 68 AA
          :           }
864 30  14:         SEQUENCE {
866 06   3:           OBJECT IDENTIFIER keyUsage (2 5 29 15)
871 01   1:           BOOLEAN TRUE
874 04   4:           OCTET STRING
          :             03 02 03 08
          :           }
          :         }
          :       }
          :     }
880 30  11:   SEQUENCE {
882 06   7:     OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3)
891 05   0:     NULL
          :     }
893 03  48:   BIT STRING 0 unused bits
          :     30 2D 02 14 7C 6D D2 CA 1E 32 D1 30 2E 29 66 BC
          :     06 8B 60 C7 61 16 3B CA 02 15 00 8A 18 DD C1 83
          :     58 29 A2 8A 67 64 03 92 AB 02 CE 00 B5 94 6A
          :   }


   Step 2. End Entity/User generates a Diffie-Hellman key-pair using the
   parameters from the CA certificate.

   EE DH public key: SunJCE Diffie-Hellman Public Key:

   Y: 13 63 A1 85 04 8C 46 A8 88 EB F4 5E A8 93 74 AE
      FD AE 9E 96 27 12 65 C4 4C 07 06 3E 18 FE 94 B8
      A8 79 48 BD 2E 34 B6 47 CA 04 30 A1 EC 33 FD 1A
      0B 2D 9E 50 C9 78 0F AE 6A EC B5 6B 6A BE B2 5C
      DA B2 9F 78 2C B9 77 E2 79 2B 25 BF 2E 0B 59 4A
      93 4B F8 B3 EC 81 34 AE 97 47 52 E0 A8 29 98 EC
      D1 B0 CA 2B 6F 7A 8B DB 4E 8D A5 15 7E 7E AF 33
      62 09 9E 0F 11 44 8C C1 8D A2 11 9E 53 EF B2 E8

   EE DH private key:

   X: 32 CC BD B4 B7 7C 44 26 BB 3C 83 42 6E 7D 1B 00
      86 35 09 71 07 A0 A4 76 B8 DB 5F EC 00 CE 6F C3

   Step 3. Compute K and the signature.

   LeadingInfo: DER encoded Subject/Requestor DN (as in the generated
   Certificate Signing Request)



Prafullchandra & Schaad     Standards Track                    [Page 13]

RFC 2875     Diffie-Hellman Proof-of-Possession Algorithms     July 2000


     30 4E 31 0B 30 09 06 03 55 04 06 13 02 55 53 31
     11 30 0F 06 03 55 04 0A 13 08 58 45 54 49 20 49
     6E 63 31 10 30 0E 06 03 55 04 0B 13 07 54 65 73
     74 69 6E 67 31 1A 30 18 06 03 55 04 03 13 11 50
     4B 49 58 20 45 78 61 6D 70 6C 65 20 55 73 65 72

   TrailingInfo: DER encoded Issuer/Recipient DN (from the certificate
   described in step 1)

     30 46 31 0B 30 09 06 03 55 04 06 13 02 55 53 31
     11 30 0F 06 03 55 04 0A 13 08 58 45 54 49 20 49
     6E 63 31 10 30 0E 06 03 55 04 0B 13 07 54 65 73
     74 69 6E 67 31 12 30 10 06 03 55 04 03 13 09 44
     48 20 54 65 73 74 43 41

   K:
     F4 D7 BB 6C C7 2D 21 7F 1C 38 F7 DA 74 2D 51 AD
     14 40 66 75

   TBS: the 魌ext