ESSCertIDv2 Update for RFC 3161
updates
- rfc-3161 — Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)
Extracted elements (12)
The update to RFC 3161 is motivated by interoperability requirements and the need to migrate away from SHA-1, rather than by any newly discovered security vulnerability in the original RFC 3161 mechanism.
For backwards compatibility, both ESSCertID and ESSCertIDv2 MAY be present in the same time-stamp token. Systems MAY ignore ESSCertIDv2 if RFC 5035 has not been implemented.
The certificate identifier (either ESSCertID or ESSCertIDv2) of the TSA certificate MUST be included as a signerInfo attribute inside a SigningCertificate attribute.
The SigningCertificateV2 attribute MUST be used if any algorithm other than SHA-1 is used to hash the TSA certificate identifier.
The SigningCertificateV2 attribute SHOULD NOT be used when SHA-1 is the hash algorithm; in that case SigningCertificate with ESSCertID should be preferred.
The time-stamp token MUST NOT contain any signatures other than the signature of the TSA.
The tsa field in TSTInfo, if present, MUST correspond to one of the subject names included in the certificate that is to be used to verify the token.
When the certReq field is present and set to true, the TSA's public key certificate referenced by ESSCertID inside a SigningCertificate attribute or by ESSCertIDv2 inside a SigningCertificateV2 attribute in the response MUST be provided by the TSA in the certificates field from the SignedData structure.
ESSCertIDv2, as defined in RFC 5035, is a certificate identifier that supports any hash algorithm and is carried inside a SigningCertificateV2 signed attribute within a CMS SignedData signerInfo. It replaces ESSCertID (SHA-1 only) when non-SHA-1 hashing is required.
The actual identification of the TSA that signed a time-stamp token always occurs through the certificate identifier — either ESSCertID inside SigningCertificate or ESSCertIDv2 inside SigningCertificateV2 — as part of signerInfo, not merely through the tsa hint field.
The SigningCertificateV2 attribute is the CMS signed attribute that carries ESSCertIDv2 and is used in place of (or alongside) SigningCertificate when the certificate hash is computed with an algorithm other than SHA-1.
ESSCertID relies solely on SHA-1 to identify the certificate used to verify a time-stamp signature. ESSCertIDv2 enables implementers to comply with policies that require phasing out all uses of SHA-1 by permitting any hash algorithm for certificate identification.