From 58b6d135b452bc7d142387b966dd3c7b5b004f67 Mon Sep 17 00:00:00 2001 From: Rohan Mahy Date: Mon, 23 Oct 2023 15:04:20 -0700 Subject: [PATCH] First version of draft-mahy-lamps-im-keyusage --- draft-mahy-lamps-im-keyusage.md | 12 +- versioned/draft-mahy-lamps-im-keyusage-00.xml | 261 ++++++++++++++++++ 2 files changed, 267 insertions(+), 6 deletions(-) create mode 100644 versioned/draft-mahy-lamps-im-keyusage-00.xml diff --git a/draft-mahy-lamps-im-keyusage.md b/draft-mahy-lamps-im-keyusage.md index de5d07a..a87ed5b 100644 --- a/draft-mahy-lamps-im-keyusage.md +++ b/draft-mahy-lamps-im-keyusage.md @@ -58,7 +58,8 @@ to validate a TLS connection because it has the KeyPurposeId `id-kp-serverAuth` `id-kp-clientAuth`. An explanation of MLS credentials as they apply to Instant Messaging is described -in {{?I-D.barnes-mimi-identity-arch}}. +in {{?I-D.barnes-mimi-identity-arch}}. These credentials are expected to be +heavily used in the More Instant Messaging Interoperability (MIMI) Working Group. # Conventions and Definitions @@ -68,7 +69,7 @@ in {{?I-D.barnes-mimi-identity-arch}}. # The IM URI Extended Key Usage This specification defines the KeyPurposeId id-kp-imUri, which is used -for signing messages to prove the identity of an Instant Messaging client. +for signing messages to prove the identity of an Instant Messaging client. ~~~ id-kp OBJECT IDENTIFIER ::= { @@ -91,9 +92,8 @@ IANA is requested to register the following OIDs in the "SMI Security for PKIX Extended Key Purpose" registry (1.3.6.1.5.5.7.3). These OIDs are defined in Section 4. - +=========+===============================+============+ - | Decimal | Description | References | - +=========+===============================+============+ - | TBD | id-kp-imUri | This-RFC | +| Decimal | Description | References | +|:--------|:--------------|:-----------| +| TBD | id-kp-imUri | This-RFC | --- back diff --git a/versioned/draft-mahy-lamps-im-keyusage-00.xml b/versioned/draft-mahy-lamps-im-keyusage-00.xml new file mode 100644 index 0000000..e89c75c --- /dev/null +++ b/versioned/draft-mahy-lamps-im-keyusage-00.xml @@ -0,0 +1,261 @@ + + + + + +]> + + + + + + X.509 Certificate Extended Key Usage (EKU) for Instant Messaging URIs + + + Wire +
+ rohan.mahy@wire.com +
+ + + SEC + LAMPS WG + x.509 + certificate + extended key usage + eku + instant messaging + im URI + + + +RFC 5280 specifies several extended key purpose identifiers +(KeyPurposeIds) for X.509 certificates. This document defines +Instant Messaging (IM) identity KeyPurposeIds for inclusion in +the Extended Key Usage (EKU) extension of X.509 v3 public key +certificates + + + About This Document + + The latest revision of this draft can be found at . + Status information for this document may be found at . + + + Discussion of this document takes place on the + LAMPS WG Working Group mailing list (), + which is archived at . + Subscribe at . + + Source for this draft and an issue tracker can be found at + . + + + + + +
+ Introduction + Instant Messaging (IM) systems using the Messaging Layer Security (MLS) + protocol can incorporate per-client identity certificate +credentials. The subjectAltName of these certificates can be an IM URI, for +example. Since IM clients could be very numerous, operators are +reticent to issue certificates for these users that might accidentally be used +to validate a TLS connection because it has the KeyPurposeId id-kp-serverAuth or +id-kp-clientAuth. + An explanation of MLS credentials as they apply to Instant Messaging is described +in . These credentials are expected to be +heavily used in the More Instant Messaging Interoperability (MIMI) Working Group. +
+
+ Conventions and Definitions + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL +NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", +"MAY", and "OPTIONAL" in this document are to be interpreted as +described in BCP 14 when, and only when, they +appear in all capitals, as shown here. + + +
+
+ The IM URI Extended Key Usage + This specification defines the KeyPurposeId id-kp-imUri, which is used +for signing messages to prove the identity of an Instant Messaging client. + +
+
+ Security Considerations + The Security Considerations of are applicable to this + document. This extended key purpose does not introduce new security + risks but instead reduces existing security risks by providing means + to identify if the certificate is generated to sign IM credentials. +
+
+ IANA Considerations + IANA is requested to register the following OIDs in the "SMI Security +for PKIX Extended Key Purpose" registry (1.3.6.1.5.5.7.3). These +OIDs are defined in Section 4. + + + + + + + + + + + + + + + +
DecimalDescriptionReferences
TBDid-kp-imUriThis-RFC
+
+ + + + References + + Normative References + + + Key words for use in RFCs to Indicate Requirement Levels + + + + In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. + + + + + + + + + Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words + + + + RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. + + + + + + + + + Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile + + + + + + + + + This memo profiles the X.509 v3 certificate and X.509 v2 certificate revocation list (CRL) for use in the Internet. An overview of this approach and model is provided as an introduction. The X.509 v3 certificate format is described in detail, with additional information regarding the format and semantics of Internet name forms. Standard certificate extensions are described and two Internet-specific extensions are defined. A set of required certificate extensions is specified. The X.509 v2 CRL format is described in detail along with standard and Internet-specific extensions. An algorithm for X.509 certification path validation is described. An ASN.1 module and examples are provided in the appendices. [STANDARDS-TRACK] + + + + + + + + Informative References + + + The Messaging Layer Security (MLS) Protocol + + + + + + + + + Messaging applications are increasingly making use of end-to-end security mechanisms to ensure that messages are only accessible to the communicating endpoints, and not to any servers involved in delivering messages. Establishing keys to provide such protections is challenging for group chat settings, in which more than two clients need to agree on a key but may not be online at the same time. In this document, we specify a key establishment protocol that provides efficient asynchronous group key establishment with forward secrecy (FS) and post-compromise security (PCS) for groups in size ranging from two to thousands. + + + + + + + + Identity for E2E-Secure Communications + + Cisco + + + Wire + + + + End-to-end (E2E) security is a critical property for modern user + communications systems. E2E security protects users' communications + from tampering or inspection by intermediaries that are involved in + delivering those communcations from one logical endpoint to another. + In addition to the much-discussed E2E encryption systems, true E2E + security requires an identity mechanism that prevents the + communications provider from impersonating participants in a session, + as a way to gain access to the session. This document describes a + high-level architecture for E2E identity, identifying the critical + mechanisms that need to be specified. + + + + + + + + + + + +