Cryptographic Message Syntax (CMS) Symmetric Key Package Content Type
Extracted elements (26)
A straightforward type-mapping from XML Schema (RFC 6030) to ASN.1 is employed: xs:string maps to UTF8String, xs:dateTime maps to GeneralizedTime, and XML integer types map to INTEGER or BinaryTime (RFC 6019), minimizing implementation divergence between XML-based PSKC and ASN.1-based symmetric key packages.
Two parties receiving the same key as an sKey OCTET STRING must interpret and load the key bytes in exactly the same way to interoperate; Sections 4.1 and 4.2 establish the normative byte-order correspondence between sKey and the AES and Triple-DES algorithm specifications.
Date/time attributes (Device Start Date, Device Expiry Date, Key Start Date, Key Expiry Date) MUST be represented matching the XML Schema dateTime canonical representation; implementations SHOULD NOT rely on time resolution finer than milliseconds and MUST NOT generate time instants that specify leap seconds.
For this version of the specification, the version field default value, v1, MUST be used.
If a PSKC key package is used in multiple provisioning interactions referencing the same key, the KeyId value MUST remain identical across all interactions (e.g., for subsequent metadata updates the same KeyId used at initial provisioning MUST be reused).
If an attribute appears in sKeyPkgAttrs, it MUST NOT also be included in sKeyAttrs, and vice versa; each attribute must appear in exactly one location.
If pinUsageMode is 'Local', the device MUST enforce the restrictions in maxFailedAttempts, minLength, maxLength, and pinEncoding; otherwise these constraints MUST be enforced on the server side.
In ChallengeFormat, the checkDigit field MUST NOT be present if the encoding value is anything other than 'DECIMAL'; the Luhn check digit is only meaningful for decimal-encoded challenges.
Manufacturer attribute values MUST be taken from the OATH Manufacturer Prefix list (prefixed with 'oath.') or from the IANA Private Enterprise Number Registry (prefixed with 'iana.'); no other values are permitted.
Of all PSKC attributes, only the Key Identifier (Section 3.2.1) and Algorithm (Section 3.2.2) key attributes MUST be included in sKeyAttrs; all other attributes are OPTIONAL.
Systems SHOULD NOT rely upon the device to enforce key usage date restrictions, because some devices such as smart cards do not have an internal clock; enforcement MAY occur only on the validation server.
The encoding field in ChallengeFormat and ResponseFormat MUST be one of the following values: DECIMAL, HEXADECIMAL, ALPHANUMERIC, BASE64, or BINARY; BASE64 encoding follows Section 4 of RFC 4648.
The friendlyNameLangTag field in FriendlyName MUST be a language tag as described in RFC 5646; when absent, English ('en') is assumed.
The OneSymmetricKey field MUST include sKeyAttrs, sKey, or both sKeyAttrs and sKey; an empty OneSymmetricKey is not permitted.
The recipient MUST enforce the Key Usage attribute constraints; permitted values include OTP, CR, Encrypt, Integrity, Verify, Unlock, Decrypt, KeyWrap, Unwrap, Derive, and Generate, each restricting key use to a single purpose.
The symmetric key package content type MUST be Distinguished Encoding Rules (DER) encoded per X.690.
When loading keys using the Device Binding attribute, the attribute's value MUST be checked against information provided to the user via out-of-band mechanisms to ensure the correct device or class of device is being provisioned.
OneSymmetricKey is an ASN.1 SEQUENCE carrying optional per-key attributes (sKeyAttrs, a SEQUENCE OF Attribute constrained to SKeyAttributes) and an optional sKey OCTET STRING containing the raw key value. At least one of sKeyAttrs or sKey MUST be present.
The PINPolicy attribute is a SEQUENCE containing pinKeyId (optional, identifies the PIN key in the container), pinUsageMode (Local, Prepend, Append, or Algorithmic), maxFailedAttempts, minLength, maxLength, and pinEncoding fields for associating PIN policy with a key.
The PSKCAlgorithmParameters attribute is a CHOICE of a suite UTF8String, a ChallengeFormat SEQUENCE (encoding, checkDigit, min, max), or a ResponseFormat SEQUENCE (encoding, length, checkDigit), allowing specification of OTP/CR algorithm parameters such as challenge encoding and response format.
The SymmetricKeyPackage content type (OID id-ct-KP-sKeyPackage, arc iso.member-body.us.rsadsi.pkcs.pkcs9.smime.ct.25) is the top-level container for transferring one or more plaintext symmetric keys. It comprises an optional version field (default v1), optional package-level attributes (sKeyPkgAttrs), and a sequence of one or more OneSymmetricKey values.
The ValueMac attribute is a SEQUENCE containing a macAlgorithm UTF8String and a base64-encoded mac UTF8String, providing a MAC over the encrypted key value for encryption algorithms that do not natively support integrity (e.g., AES-CBC).
Object identifiers for the ct-symmetric-key-package content type and all PSKC attribute types are assigned within the SMIME arc (id-smime, delegated by RSADSI). The content type OID is iso.member-body.us.rsadsi.pkcs.pkcs9.smime.ct.25; PSKC attribute OIDs are under id-smime.12 (id-pskc), numbered 1–27.
The symmetric key package content type provides no inherent protection; implementers MUST combine it with a CMS protecting content type (e.g., signed, authenticated, or encrypted via RFC 5652) or an equivalent security protocol such as DSKPP (RFC 6063) to protect the key material in transit.
AES key encoding: the first octet of sKey (OCTET STRING) SHALL become key byte index 0 as used in FIPS 197 key expansion; successive octets map to increasing key byte indices. Conformance SHALL be verified against the FIPS 197 Appendix A test vector (TLV: 04 10 2b7e151628aed2a6abf7158809cf4f3c).
Triple-DES key encoding: the sKey OCTET STRING packs Key1, Key2, Key3 (each 64 bits including 8 parity bits) contiguously, MSB first; for two-key Triple-DES Key1 equals Key3 and sKey is 16 bytes, for three-key it is 24 bytes. Conformance SHALL be verified against SP 800-67 Appendix B test vectors.