Updates for RSAES-OAEP and RSASSA-PSS Algorithm Parameters
updates
- rfc-4055 — Additional Algorithms and Identifiers for RSA Cryptography for use in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Extracted elements (13)
RSAES-OAEP-params were prohibited from subjectPublicKeyInfo because (a) their absence does not affect interoperability and (b) it aligns with PKIX practice of not encoding usage limitations on public keys within subjectPublicKeyInfo. An implementer poll confirmed no objections.
The old text incorrectly referenced the 'publicKeyAlgorithms' field; this document corrects those references to the 'parameters' field within the subjectPublicKeyInfo algorithm field, and rewords the relevant paragraphs for clarity.
The PKIX WG ECC design team recommended that Key Derivation Functions (KDFs) should not be constrained within a certificate; KDF constraints should instead be negotiated in the protocols that use the certificates.
Similarly, the prohibition of parameters in the subjectPublicKeyInfo for RSAES-OAEP (Section 4.1 update) was confirmed by implementer poll to have no impact on existing implementations.
The prohibition of RSAES-OAEP-params in subjectPublicKeyInfo does not affect interoperability; a poll of implementers confirmed the change does not affect current implementations.
All certificates and CRLs signed by a CA that supports id-RSASSA-PSS MUST include RSASSA-PSS-params in the signatureAlgorithm parameters in the Certificate and CertList structures, respectively.
CAs that issue certificates with the id-RSAES-OAEP algorithm identifier MUST NOT include parameters in the subjectPublicKeyInfo algorithm field.
When id-RSAES-OAEP is used in an AlgorithmIdentifier, the parameters MUST employ the RSAES-OAEP-params syntax, MUST be absent when used in the subjectPublicKeyInfo field, and MUST be present when used in the algorithm identifier associated with an encrypted value.
When id-RSASSA-PSS appears in the subjectPublicKeyInfo algorithm field of end-entity (EE) certificates, the parameters field MAY include the RSASSA-PSS-params structure.
When the id-RSASSA-PSS object identifier appears in the TBSCertificate or TBSCertList signature algorithm field, the RSASSA-PSS-params structure MUST be included in the corresponding signature parameters field.
RSAES-OAEP-params are prohibited from the subjectPublicKeyInfo algorithm field entirely but are required in the AlgorithmIdentifier associated with any encrypted value.
RSASSA-PSS-params placement rules differ by certificate type and field: mandatory in signature/signatureAlgorithm fields, SHOULD for CA subjectPublicKeyInfo, and MAY for EE subjectPublicKeyInfo.
The security considerations from RFC 4055 apply. If RSAES-OAEP-params are negotiated, the negotiation mechanism must provide integrity for those parameters; for example, an S/MIME agent can advertise capabilities via the SMIMECapabilities attribute as a signed attribute or certificate extension.