attributeSigning extendedKeyUsage value
draft-patterson-pkix-attribute-signing-eku-00

Abstract

This document specifies a value for the extendedKeyUsage X.509 extension that may be used to create a certificate that would be used to sign attribute assertions. This allows the differentiation of certificates used to identify a particular server (which would have a serverAuth EKU), from the certificate used by that server to sign attribute assertions, and would easily allow a policy to be developed for issuance of such a certificate to an identity provider.

Status of this Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on September 29, 2011.

Copyright Notice

Copyright (c) 2011 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Requirements notation
• 2. Introduction
• 3. IANA Considerations
• 4. Security Considerations
• 5. References
• Author's Address

1. Requirements notation

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].

2. Introduction

[RFC5280] defines the extendedKeyUsage X.509 extension for the PKIX Internet Certificate Profile. This document extends that definition, and defines a new value for extendedKeyUsage (id-kp-assertionSigning) which allows for a relying party to know that the holder of the Certificate has been certified according to the Issuing Certification Authority's (CA) requirements for a provider of attribute information.

This value MAY be used instead of requiring a dedicated Federation Enabler Certification Authority for issuing certificates to Identity Providers or Attribute Providers in a WS-Fed or SAML federation. A conformant CA MAY set up a particular Certificate Profile which is only issued after ensuring that the subject of the certificate is operating according to a given set of guidelines, as established by a given federation. By including this extendedKeyUsage, a conformant CA can distinguish certificates issued to an Identity Provider or Attribute Provider as distinct from any other certificates issued to devices such as web servers, etc. A Relying Party MAY use this to be certain that the presenter of the certificate containing this is an authorised Identity Provider within a given federation. Federation Realm determination is out of scope of this document.

If id-kp-assertionSigning is declared in extendedKeyUsage, then no other extendedKeyUsage values SHOULD be set. If id-kp-assertionSigning is declared in extendedKeyUsage, a conformant CA SHALL set the digitalSignature bit in the keyUsage extension. A conformant CA MAY also set the nonRepudiation bit of the keyUsage extension. A conformation CA SHOULD NOT set the keyEncipherment, keyAgreement, or dataEncipherment bits in keyUsage. The Certificate MUST NOT have crlSign, or certSign bits set in keyUsage.

Certificates with this bit set SHOULD NOT be used as the primary identity certificate for the identity provider (e.g.: Should not be the same Certificate as used for SSL Authentication).

3. IANA Considerations

This memo defines a new value 'id-kp-assertionSigning' to signify that the certificate that contains this value was issued to a provider of identity attribute information.

id-kp-assertionSigning OBJECT IDENTIFIER ::= {id-kp TBD}

4. Security Considerations

None.

5. References

Author's Address