Internet X.509 Public Key Infrastructure: Additional Algorithms and Identifiers for DSA and ECDSA
updates
- rfc-3279 — Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Extracted elements (15)
DSA with SHA2 is only specified for SHA-224 and SHA-256, while ECDSA with SHA2 covers all four (SHA-224, SHA-256, SHA-384, SHA-512). This reflects the algorithm strength pairings in FIPS 186-3, which does not define DSA use with SHA-384 or SHA-512.
This document updates RFC 3279 Sections 2.1, 2.2.2, and 2.2.3. RFC 5480 separately updates Sections 2.3.5, 3, and 5 of RFC 3279. Implementors must consult all three documents together for a complete picture.
Conforming CA implementations MUST specify the hash algorithm explicitly using the defined OIDs when encoding ECDSA/SHA2 signatures in certificates and CRLs.
Conforming CA implementations SHOULD use SHA-224, SHA-256, SHA-384, or SHA-512 when generating certificates or CRLs, but MAY use SHA-1 only if they have a stated policy requiring that weaker algorithm.
Conforming CA implementations that generate DSA signatures for certificates or CRLs MUST generate those signatures in accordance with all requirements in Sections 4.1, 4.5, and 4.6 of FIPS 186-3.
Conforming CA implementations that generate ECDSA signatures in certificates or CRLs MUST generate them in accordance with all requirements specified in Sections 7.2 and 7.3 of X9.62 or Section 4.1.3 of SEC1.
Conforming client implementations that process ECDSA signatures with any SHA2 hash algorithm when processing certificates and CRLs MUST recognize the four corresponding OIDs specified in Section 3.2.
When any of the four SHA2 OIDs appears in an AlgorithmIdentifier, all implementations MUST accept both NULL and absent parameters as legal and equivalent encodings.
Four OIDs are defined for ECDSA combined with SHA2: ecdsa-with-SHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, and ecdsa-with-SHA512, all under the ANSI X9.62 arc (1.2.840.10045.4.3.1–4).
Four SHA2 hash algorithm OIDs are identified for use in X.509 certificates and CRLs: id-sha224 (2.16.840.1.101.3.4.2.4), id-sha256 (2.16.840.1.101.3.4.2.1), id-sha384 (2.16.840.1.101.3.4.2.2), and id-sha512 (2.16.840.1.101.3.4.2.3), all under the NIST algorithm arc.
The OIDs for SHA2 hash algorithms are defined in the RFC 4055 ASN.1 module; the OIDs for DSA with SHA-224/256 and ECDSA with SHA-224/256/384/512 are defined in the RFC 5480 ASN.1 module. No new ASN.1 module is introduced by this document.
Two OIDs are defined for DSA combined with SHA2: id-dsa-with-sha224 (2.16.840.1.101.3.4.3.1) and id-dsa-with-sha256 (2.16.840.1.101.3.4.3.2). DSA is only defined with SHA-224 and SHA-256, not SHA-384 or SHA-512.
NIST Special Publications 800-78-1, 800-57, and 800-107 define appropriate use of hash functions in terms of algorithm strengths and expected time frames for secure use, and can be used as guides to choose appropriate key sizes for various security scenarios.
When any ecdsa-with-SHA2 OID appears as an AlgorithmIdentifier, the encoding MUST omit the parameters field; the AlgorithmIdentifier SHALL be a SEQUENCE of one component, the OID.
When id-dsa-with-sha224 or id-dsa-with-sha256 appears as an AlgorithmIdentifier, the encoding SHALL omit the parameters field; the AlgorithmIdentifier SHALL be a SEQUENCE of exactly one component, the OID.