Internet X.509 Public Key Infrastructure: Logotypes in X.509 Certificates
obsoleted by
- rfc-9399 — Internet X.509 Public Key Infrastructure: Logotypes in X.509 Certificates
updated by
- rfc-6170 — Internet X.509 Public Key Infrastructure -- Certificate Image
Extracted elements (29)
Both direct and indirect addressing are supported to handle different scale requirements: direct addressing works well for one or a few image/audio variants, while indirect addressing through an external LTD file supports cases where each logotype has many alternative files.
Logotype data is referenced via URI plus hash rather than embedded directly in the certificate, to avoid significantly increasing certificate size. The hash ensures integrity of the externally fetched image or audio file.
The community logotype concept mirrors the credit card industry model, where local independent issuers co-brand with a globally recognized mark (e.g., VISA, MasterCard) to gain broad recognition for local service provision.
The logotype extension MAY be included in both public key certificates (RFC 3280) and attribute certificates (RFC 3281). The extension is applicable to end-entity certificates, CA certificates, and attribute certificates.
All URIs MUST use either the HTTP scheme or the FTP scheme. At least one URI in each sequence MUST use the HTTP scheme. Clients MUST support retrieval of referenced LogotypeData with HTTP/1.1.
CAs MUST include a SHA-1 hash value for each referenced file, calculated on the whole file. Clients MUST support SHA-1 and MUST discard logotype data if the computed hash does not match the value in the certificate extension.
Clients MUST support both direct and indirect addressing. Certificate issuing applications MUST support direct addressing and SHOULD support indirect addressing.
Each logotype present in a certificate MUST be represented by at least one image data file. Compliant applications MUST NOT display more than one image and MUST NOT play more than one audio sequence for any logotype type at the same time.
If a client is unable to support a provided logotype, the client MUST NOT report an error; rather the client MUST behave as though no logotype extension was included in the certificate.
If issuerLogo is present, the logotype MUST represent the issuer's organization and MUST be consistent with, and require the presence of, an organization name in the issuer field. If subjectLogo is present, the logotype MUST represent the subject's organization.
If the relying party software is unable to successfully validate a particular certificate, it MUST NOT display any logotype data associated with that certificate.
Implementations MUST support both JPEG and GIF image formats. Implementations that support audio MUST support the MP3 audio format.
Implementations MUST support image data in logotypes; support for audio data is OPTIONAL.
The client MUST include the ability to disable the fetching of logotypes. A client MUST NOT play more than one logotype audio sequence at the same time.
The logotype extension MUST NOT be an active component in automated certification path validation. Logotypes are solely for human interpretation and MUST NOT be part of certification path validation or any type of automated processing.
The logotype extension MUST NOT be marked critical.
LogotypeAudioInfo optionally describes an audio file's fileSize in octets, playTime in milliseconds, channels (1=mono, 2=stereo, 4=quad), optional sampleRate in samples per second, and optional RFC 3066 language tag.
LogotypeDetails carries the MIME media type as an IA5String, one or more HashAlgAndValue entries (logotypeHash), and one or more URI strings (logotypeURI) for retrieving the logotype file.
LogotypeImageInfo optionally describes an image's type (grayScale or color), fileSize in octets, xSize and ySize in pixels, resolution (numBits or tableSize), and an RFC 3066 language tag.
LogotypeInfo is a CHOICE between direct (LogotypeData) and indirect (LogotypeReference) addressing, allowing logotype data to be embedded by reference with either per-file URIs or a single external data structure URI.
LogotypeReference provides indirect addressing by specifying one or more hash values (refStructHash) and URIs (refStructURI) pointing to an external DER-encoded LogotypeData file, which SHOULD have a .LTD file extension.
The LogotypeExtn ASN.1 structure contains four optional fields: communityLogos (SEQUENCE OF LogotypeInfo), issuerLogo (LogotypeInfo), subjectLogo (LogotypeInfo), and otherLogos (SEQUENCE OF OtherLogotypeInfo). At least one of these MUST be present.
Three standard logotype types are defined: community logotype (identifies a service community with which the issuer is affiliated), issuer organization logotype (represents the issuer's organization), and subject organization logotype (represents the subject's organization).
Two additional 'other' logotype types are defined: id-logo-loyalty ({ id-logo 1 }) for loyalty program logotypes, and id-logo-background ({ id-logo 2 }) for a graphical certificate background image or general audio sequence.
A malicious CA can comply with name and policy constraints imposed by a parent CA while including inappropriate or fraudulent logotypes in issued certificates that will still pass certification path validation. No technical mechanism prevents subordinate CAs from inserting arbitrary logotype content; parent CAs must rely on contractual agreements, monitoring, and revocation.
Implementations that simultaneously display multiple logotype types MUST ensure there is no ambiguity about the binding between an image and the logotype type it represents, to prevent user confusion or social engineering attacks.
Logotype data is fetched from a server when needed, enabling network observers to determine which clients are using certificates containing particular logotype data, introducing privacy concerns. Caching mitigates frequency of exposure but cannot eliminate it entirely.
HashAlgAndValue is a SEQUENCE of an AlgorithmIdentifier (hashAlg) and an OCTET STRING (hashValue), used to authenticate referenced logotype data files.
The logotype extension is identified by OID id-pe-logotype { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-pe(1) 12 } and its value is a DER-encoded LogotypeExtn SEQUENCE.