rfc2314.txt

著名的RFC文档,其中有一些文档是已经翻译成中文的的.


RFC 2314         PKCS #10: Certification Request Syntax       March 1998


        2.   The signature on the certification request
             prevents an entity from requesting a certificate with
             another party's public key. Such an attack would give the
             entity the minor ability to pretend to be the originator of
             any message signed by the other party. This attack is
             significant only if the entity does not know the message
             being signed, and the signed part of the message does not
             identify the signer. The entity would still not be able to
             decrypt messages intended for the other party, of course.

        3.   How the entity sends the certification request to
             a certification authority is outside the scope of this
             document. Both paper and electronic forms are possible.

        4.   This document is not compatible with the
             certification request syntax for Privacy-Enhanced Mail, as
             described in RFC 1424. The syntax in this document differs
             in three respects: It allows a set of attributes; it does
             not include issuer name, serial number, or validity period;
             and it does not require an "innocuous" message to be
             signed. The syntax in this document is designed to minimize
             request size, an important constraint for those
             certification authorities accepting requests on paper.

6.1 CertificationRequestInfo

   Certification request information shall have ASN.1 type
   CertificationRequestInfo:

   CertificationRequestInfo ::= SEQUENCE {
     version Version,
     subject Name,
     subjectPublicKeyInfo SubjectPublicKeyInfo,
     attributes [0] IMPLICIT Attributes }

   Version ::= INTEGER

   Attributes ::= SET OF Attribute

   The fields of type CertificationRequestInfo have the following
   meanings:

        o    version is the version number, for compatibility
             with future revisions of this document. It shall be 0 for
             this version of the document.






Kaliski                      Informational                      [Page 5]

RFC 2314         PKCS #10: Certification Request Syntax       March 1998


        o    subject is the distinguished name of the
             certificate subject (the entity whose public key is to be
             certified).

        o    subjectPublicKeyInfo contains information about
             the public key being certified. The information identifies
             the entity's public-key algorithm (and any associated
             parameters); examples of public-key algorithms include
             X.509's rsa and PKCS #1's rsaEncryption. The information
             also includes a bit-string representation of the entity's
             public key.  For both public-key algorithms just mentioned,
             the bit string contains the BER encoding of a value of
             X.509/PKCS #1 type RSAPublicKey.

        o    attributes is a set of attributes providing
             additional information about the subject of the
             certificate. Some attribute types that might be useful here
             are defined in PKCS #9. An example is the challenge-
             password attribute, which specifies a password by which the
             entity may request that the certificate revocation. Another
             example is the extended-certificate-attributes attribute,
             which specifies attributes for a PKCS #6 extended
             certificate.

6.2 CertificationRequest

   A certification request shall have ASN.1 type CertificationRequest:

   CertificationRequest ::= SEQUENCE {
     certificationRequestInfo CertificationRequestInfo,
     signatureAlgorithm SignatureAlgorithmIdentifier,
     signature Signature }

   SignatureAlgorithmIdentifier ::= AlgorithmIdentifier

   Signature ::= BIT STRING

   The fields of type CertificationRequest have the following meanings:

        o    certificateRequestInfo is the "certification
             request information." It is the value being
             signed.

        o    signatureAlgorithm identifies the signature
             algorithm (and any associated parameters) under
             which the certification-request information is
             signed. Examples include PKCS #1's
             md2WithRSAEncryption and md5WithRSAEncryption.



Kaliski                      Informational                      [Page 6]

RFC 2314         PKCS #10: Certification Request Syntax       March 1998


        o    signature is the result of signing the
             certification request information with the
             certification request subject's private key.

   The signature process consists of two steps:

        1.   The value of the certificationRequestInfo field is
             DER encoded, yielding an octet string.

        2.   The result of step 1 is signed with the
             certification request subject's private key under
             the specified signature algorithm, yielding a bit
             string, the signature.

   Note. The syntax for CertificationRequest could equivalently be
   written with the X.509 SIGNED macro:

   CertificationRequest ::= SIGNED CertificateRequestInfo

Security Considerations

   Security issues are discussed throughout this memo.

Revision history

   Version 1.0

   Version 1.0 is the initial version.

Acknowledgements

   This document is based on a contribution of RSA Laboratories, a
   division of RSA Data Security, Inc.  Any substantial use of the text
   from this document must acknowledge RSA Data Security, Inc. RSA Data
   Security, Inc.  requests that all material mentioning or referencing
   this document identify this as "RSA Data Security, Inc. PKCS #10".

Author's Address

   Burt Kaliski
   RSA Laboratories East
   20 Crosby Drive
   Bedford, MA  01730

   Phone: [phone]
   EMail: [e-mail]





Kaliski                      Informational                      [Page 7]

RFC 2314         PKCS #10: Certification Request Syntax       March 1998


Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
























Kaliski                      Informational                      [Page 8]