Trust Anchor Format
Extracted elements (26)
Extensions anticipated to be widely used (certificatePolicies, policyConstraints, inhibitAnyPolicy, nameConstraints, pathLenConstraint) are included directly in the CertPathControls structure to avoid the overhead and verbosity associated with use of the generic Extensions structure.
TrustAnchorInfo is designed as a more compact alternative to X.509 certificates for exchanging trust anchor information. It also provides a means of associating additional or alternative constraints with certificates without breaking the signature on the certificate itself.
When certPath is absent from TrustAnchorInfo, the trust anchor cannot be used to validate the signature on an X.509 certificate. This allows trust anchors to be defined for purposes other than X.509 path validation.
Correspondence between certificate extensions and TrustAnchorInfo fields is explicitly defined: id-ce-certificatePolicies maps to policySet; id-ce-policyConstraints maps to inhibitPolicyMapping and requireExplicitPolicy flags; id-ce-inhibitAnyPolicy maps to inhibitAnyPolicy; id-ce-nameConstraints maps to nameConstr; and id-ce-basicConstraints pathLenConstraint maps to CertPathControls.pathLenConstraint.
TrustAnchorChoice provides three options for representing a trust anchor—a bare Certificate, a TBSCertificate with modified extensions, or a TrustAnchorInfo—enabling interoperability with environments that use existing X.509 certificate representations while supporting the richer TrustAnchorInfo format.
An application validating a certification path SHOULD NOT ignore the limitations provided in CertPathControls, though it MAY impose additional restrictions. An application MAY supply a subset of policies, a TRUE flag value where appropriate, a subset of permitted names, additional excluded names, or a smaller pathLenConstraint.
Fields defined in TrustAnchorInfo (policySet, policyFlags, nameConstr, pathLenConstraint, exts) always override or supplement corresponding values in any enveloped certificate. TrustAnchorInfo fields are always enforced; certificate extensions are enforced only when no corresponding TrustAnchorInfo value exists.
If the optional certificate field is present within CertPathControls, the subject name in the certificate MUST exactly match taName, the public key MUST exactly match pubKey, and the subjectKeyIdentifier extension (if present) MUST exactly match keyId.
The following extension types MUST NOT appear in the TrustAnchorInfo exts field and are ignored if they do: id-ce-certificatePolicies, id-ce-policyConstraints, id-ce-inhibitAnyPolicy, and id-ce-nameConstraints. These are represented in the CertPathControls structure instead.
The requireExplicitPolicy bit in CertPolicyFlags MUST be set to FALSE if the policySet field is absent.
The taName field within CertPathControls MUST NOT be an empty sequence. It provides the X.500 distinguished name used to construct and validate an X.509 certification path.
Where the pathLenConstraint field appears, its value MUST be greater than or equal to zero. It gives the maximum number of non-self-issued intermediate CA certificates that may follow in a valid certification path.
Within policySet (CertificatePolicies), the OPTIONAL policyQualifiers structure MUST NOT be included in any PolicyInformation entry.
CertPathControls is an optional SEQUENCE providing inputs to the X.509 certification path validation algorithm (RFC 5280 Section 6). It contains taName (Name), optional certificate (Certificate), policySet (CertificatePolicies), policyFlags (CertPolicyFlags), nameConstr (NameConstraints), and pathLenConstraint (INTEGER). When absent, the trust anchor cannot validate X.509 certificate signatures.
keyId contains the public key identifier of the trust anchor public key. Common key identifier calculation methods are described in Section 4.2.1.2 of RFC 5280.
pubKey identifies the public key and algorithm of the trust anchor using SubjectPublicKeyInfo from RFC 5280. It contains an AlgorithmIdentifier (OID plus optional parameters) followed by the public key encoded as a BIT STRING.
The id-ct-trustAnchorList OID (1.2.840.113549.1.9.16.1.34) identifies TrustAnchorList payloads within CMS structures. The TrustAnchorList structure can be protected using the CMS SignedData structure defined in RFC 5652.
TrustAnchorInfo is the core ASN.1 SEQUENCE structure for representing a single trust anchor, containing version, pubKey (SubjectPublicKeyInfo), keyId (KeyIdentifier), optional taTitle, optional certPath (CertPathControls), optional extensions, and optional taTitleLangTag. Version defaults to v1.
TrustAnchorList is a SEQUENCE SIZE (1..MAX) OF TrustAnchorChoice, allowing a collection of trust anchors to be represented together. TrustAnchorChoice is a CHOICE among a bare Certificate, a TBSCertificate ([1] EXPLICIT), and a TrustAnchorInfo ([2] EXPLICIT).
RFC 5914 defines the object identifier id-ct-trustAnchorList as { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9) id-smime(16) id-ct(1) 34 } for use in identifying TrustAnchorList content within CMS.
Compromise of a CA private key leads to the same class of problems as trust anchor private key compromise. The unauthorized CA key holder is similarly limited by the certification path controls in the trust anchor's certPath field or extensions.
Compromise of a trust anchor private key permits unauthorized parties to masquerade as the trust anchor. The scope of damage is bounded by the certification path controls (certPath and exts fields), including any name constraints, associated with the trust anchor.
Usage of a certificate independently of the TrustAnchorInfo structure that envelopes it must be carefully managed to avoid violating constraints expressed in TrustAnchorInfo. When enveloping a certificate, values in the certificate should be evaluated for conflicts with TrustAnchorInfo values.
CertPolicyFlags is a BIT STRING with three named bits: inhibitPolicyMapping (bit 0), requireExplicitPolicy (bit 1), and inhibitAnyPolicy (bit 2). When absent, the certification path validation algorithm receives {FALSE, FALSE, FALSE}, the most permissive setting.
TrustAnchorInfo is encoded as an ASN.1 SEQUENCE with IMPLICIT TAGS. The pubKey field uses SubjectPublicKeyInfo (AlgorithmIdentifier followed by the public key as a BIT STRING). The exts field uses tag [1] EXPLICIT and taTitleLangTag uses tag [2] EXPLICIT.
TrustAnchorTitle is a UTF8String constrained to SIZE (1..64). The taTitleLangTag field identifies the language; when absent, English ('en') is assumed. Language tag values should conform to RFC 5646.