Additions to C509 Structures

Introduction defines C509 certificate structure, a compact CBOR encoding of X.509 certificates. C509 supports a large subset of the X.509 certificate profile defined in and is designed for use in constrained environments as well as general certificate-based protocols. The base C509 specification defines the public key as fields within the certificate structure. It also defines compact integer identifiers for selected X.509 RDN attribute types, CR attribute types, extension IDs, certificate policies, and extended key usages. This document defines additions to the C509 specification in four areas.

Defines a new structure C509SubjectPublicKeyInfo which corresponds to SubjectPublicKeyInfo in X.509 . This permits a C509 public key to be represented independently of a complete C509 certificate.
Defines the C509 representation of the X.509 SubjectDirectoryAttributes extension specified in .
Defines PEN-scoped identifiers. An organization that has been assigned a Private Enterprise Number (PEN) can assign integer values within its own namespace. Such identifiers can be used for RDN attribute types, CR attribute types, extension IDs, certificate policies, and extended key usages without requiring each identifier to be registered in a C509 IANA registry.
Defines PEM labels for C509 objects using the textual encoding framework specified by .

This document is intended to be used together with . It does not define a new certificate format; it adds types and encoding mechanisms to the C509 data model.

Notational Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

C509 Public Key This document defines the following reusable C509 subject public key type:

CDDL for C509SubjectPublicKeyInfo The subjectPublicKeyAlgorithm field has the same encoding and semantics as the subjectPublicKeyAlgorithm field of TBSCertificate in . The subjectPublicKey field has the same encoding and semantics as the subjectPublicKey field of TBSCertificate in . In particular, algorithm-specific C509 encodings defined by apply equally when the public key is represented using C509SubjectPublicKeyInfo. For example, the optimized RSA encoding and elliptic-curve public key encoding apply to C509SubjectPublicKeyInfo.

Extensions

Extension Subject Directory Attributes X.509 defines the SubjectDirectoryAttributes extension in . This document defines a C509 representation of that extension. The extension value is represented as SubjectDirectoryAttributes:

CDDL for SubjectDirectoryAttributes Each 'attributeType' is encoded either as a CBOR int (see ) or as an unwrapped CBOR OID .

If 'attributeType' is encoded as a CBOR int, it is followed by a CBOR item of any type other than undefined. The specific type of the item is determined by 'attributeType'.
If 'attributeType' is encoded as an unwrapped CBOR OID, it is followed by the DER-encoded 'values' (which is SET OF AttributeValue) encoded as a CBOR byte string.

DateOfBirth The personal data attribute 'DateOfBirth' is defined in as 'GeneralizedTime'. In C509, the 'attributeValue' field has type CBOR text represented as 'YYYYMMDD', where the first 4 digits are the year, followed by 2 digits for the month and 2 digits for the day.

PlaceOfBirth The personal data attribute 'PlaceOfBirth' is defined in as 'DirectoryString'. In C509, the 'attributeValue' field has type PlaceOfBirth. A UTF8 String is encoded as CBOR text, and a Printable String is tagged with number 121 (alternative 0, as defined in [IANA-CBOR-TAGS]). All other string types are not supported. For native certificates and certification requests, only UTF8 String is allowed. PlaceOfBirth = text / #6.121(text)

Gender The personal data attribute 'Gender' is defined in as 'PrintableString'. In C509, the 'attributeValue' field has type CBOR text.

CountryOfCitizenship The personal data attribute 'CountryOfCitizenship' is defined in as 'PrintableString'. In C509, only a single CountryOfCitizenship value is supported. The 'attributeValue' field has type CBOR text.

CountryOfResidence The personal data attribute 'CountryOfResidence' is defined in as 'PrintableString'. In C509, the 'attributeValue' field has type CBOR text.

PEN-Scoped Identifiers defines integer identifiers for commonly used RDN attributes, CR attributes, extensions, extended key usages, and certificate policies, and this document defines the subject directory attributes. These integer identifiers provide compact encodings. An organization may also need identifiers that are meaningful only within its own ecosystem. Requiring each such identifier to be allocated from an IANA registry is unnecessary when the organization already has a globally unique namespace through a Private Enterprise Number. This document therefore reserves two intervals for PEN-scoped identifiers for the RDN attributes, CR attributes, extensions, extended key usages, certificate policies, and subject directory attributes. Both the PEN and the internal ID are represented as 'bn ... b1 b0', where bn is the most significant bit and b0 is the least significant bit.

Interval [2^31, 2^32 - 1]: For PEN in [0, 2^21 - 1], and internal ID: [0, 2^10 - 1] The integer value is constructed as follows: b'1' || 21-bit PEN || 10-bit internal ID
Interval [2^47, 2^48-1]: For all identifiers that cannot be represented in the interval [2^31, 2^32 - 1]:
- PEN in the interval [2^21, 2^32 -1] and internal ID in [0, 2^15 - 1]
- PEN in [0, 2^21 - 1] and internal ID in [2^11, 2^15 - 1]
The integer value is constructed as follows: b'1' || 32-bit PEN || 15-bit internal ID

Textual Encoding (PEM) This section defines textual (PEM) encodings for C509 structures, following the conventions of . The textual encodings use base64-encoded binary data enclosed between "-----BEGIN LABEL-----" and "-----END LABEL-----" lines and carry CBOR-encoded C509 objects rather than DER-encoded ASN.1 objects.

General Rules Each C509 PEM block MUST conform to the following rules:

The binary payload is the CBOR encoding of the structure. CBOR encoding MUST be deterministic as specified in Sections and of .
The binary payload is base64-encoded according to (standard Base64 with padding characters =). Parsers SHOULD ignore whitespace and other non-base64 characters as per .
The encapsulation boundaries follow :
No header fields (as described in ) are defined for any of the labels in this document. Implementations MUST ignore any header fields encountered.
Explanatory text before the pre-encapsulation boundary is allowed. Implementations MUST NOT require or rely on such text.

C509 Certificate PEM label: C509 CERTIFICATE The payload is a CBOR-encoded C509Certificate as defined in .

C509 Certificate PEM Encoding

COSE_C509 PEM label: COSE C509 The payload is a CBOR-encoded COSE_C509 as defined in .

COSE_C509 PEM Encoding

C509 Certification Request PEM label: C509 CERTIFICATE REQUEST The payload is a CBOR-encoded C509CertificationRequest as defined in .

C509 Certification Request PEM Encoding

C509 Public Key PEM label: C509 PUBLIC KEY The payload is a CBOR-encoded C509SubjectPublicKeyInfo as defined in .

C509 Public Key PEM Encoding

C509 Private Key PEM label: C509 PRIVATE KEY The payload is a CBOR-encoded C509PrivateKey as defined in .

C509 Private Key PEM Encoding

C509 PEM PEM label: C509 PEM The payload is a CBOR-encoded C509PEM as defined in .

C509 PEM Encoding

PEM Label Summary The following table summarizes all PEM labels defined in this document and compares them with RFC 7468 labels for equivalent DER-encoded structures. PEM Labels Defined in This Document

PEM Label	C509 Structure	Defined in	RFC 7468 Label
`C509 CERTIFICATE`	`C509Certificate`		`CERTIFICATE`
`COSE C509`	`COSE_C509`		N/A
`C509 CERTIFICATE REQUEST`	`C509CertificationRequest`		`CERTIFICATE REQUEST`
`C509 PUBLIC KEY`	`C509PublicKey`	[[this document]]	`PUBLIC KEY`
`C509 PRIVATE KEY`	`C509PrivateKey`		`PRIVATE KEY`
`C509 PEM`	`C509PEM`		N/A

Security Considerations TODO

IANA Considerations

C509 Subject Directory Attributes Registry IANA has created a new registry titled "C509 Subject Directory Attributes" under the registry group "CBOR Encoded X.509 (C509)". The registry fields are Value, Name, Identifiers, OID, DER, Comments, attributeValue, and Reference, where Value is an integer in the interval [-2^63, 2^63 - 1], and the other columns are text strings. Name and Identifiers are informal descriptions. The fields Name, OID, and DER are mandatory. For Subject Directory Attributes specified only for CBOR encoded certificates where no OID is defined, the OID and DER fields are marked "N/A". If an OID is present, it is given in dotted decimal representation, and the DER column contains the hex string of the DER-encoded OID . If the attribute is not expected to be understood from the other information (for example, the OID), then the Comments field must contain a reference to where the Subject Directory Attribute is described. Values in the interval [32768, 65535] are reserved for Private Use, values in the intervals [2^31, 2^32 - 1] and [2^47, 2^48-1] are reserved for PEN identifiers as in , values in the intervals [65536, 2^31 -1], [2^32, 2^47 -1], and [2^48, 2^63 - 1] are reserved for Future Use. For values in the interval [-24, 23] the registration procedure is "IETF Review with Expert Review", and for all other values the registration procedure is "Expert Review". The initial contents of the registry are:

C509 Subject Directory Attributes

C509 RDN Attributes Registry This document updates the following ranges in the "C509 RDN Attributes" registry in the registry group "CBOR Encoded X.509 (C509)". The ranges[2^31, 2^32 -1] and [2^47, 2^48 -1] are reserved for PEN identifiers as in .

C509 CR Attributes Registry This document updates the following ranges in the "C509 CR Attributes" registry in the registry group "CBOR Encoded X.509 (C509)". The ranges[2^31, 2^32 -1] and [2^47, 2^48 -1] are reserved for PEN identifiers as in .

C509 Extensions Registry This document updates the following ranges in the "C509 Extensions" registry in the registry group "CBOR Encoded X.509 (C509)". The ranges[2^31, 2^32 -1] and [2^47, 2^48 -1] are reserved for PEN identifiers as in .

C509 Certificate Policies Registry This document updates the following ranges in the "C509 Certificate Policies" registry in the registry group "CBOR Encoded X.509 (C509)". The ranges[2^31, 2^32 -1] and [2^47, 2^48 -1] are reserved for PEN identifiers as in .

C509 Extended Key Usages Registry This document updates the following ranges in the "C509 Extended Key Usages" registry in the registry group "CBOR Encoded X.509 (C509)". The ranges[2^31, 2^32 -1] and [2^47, 2^48 -1] are reserved for PEN identifiers as in .

PEM Label Registry IANA is requested to register the following entries in the "Textual Encoding Label" registry under the registry group "PKIX Parameters" : PEM Label Registrations

Label	Reference
`C509 CERTIFICATE`	This document
`COSE C509`	This document
`C509 CERTIFICATE REQUEST`	This document
`C509 PUBLIC KEY`	This document
`C509 PRIVATE KEY`	This document
`C509 PEM`	This document

CoAP Content-Formats Registry IANA is requested to add an entry for application/cose-c509-pubkey+cbor to the "CoAP Content-Formats" registry in the registry group "Constrained RESTful Environments (CoRE) Parameters".

CoAP Content-Format IDs

Media Type Application Registry IANA is requested to assign the following entries into the "application" registry in the registry group "Media Types" with this document as reference.

Media Type application/cose-c509-pubkey+cbor When the 'application/cose-c509-pubkey+cbor' media type is used, the data is a C509SubjectPublicKeyInfo structure. Type name: application Subtype name: cose-c509-pubkey+cbor Required parameters: N/A Optional parameters: N/A Encoding considerations: binary Security considerations: See the Security Considerations section of [[this document]]. Interoperability considerations: N/A Published specification: [[this document]] Applications that use this media type: Applications that employ COSE and use C509 as a certificate type. Fragment identifier considerations: N/A Additional information:

Deprecated alias names for this type: N/A
Magic number(s): TBD2
File extension(s): .c509
Macintosh file type code(s): N/A

Person & email address to contact for further information: iesg@ietf.org Intended usage: COMMON Restrictions on usage: N/A Author: COSE WG Change controller: IETF