Elliptic Curve Algorithms for Cryptographic Message Syntax (CMS) Asymmetric Key Package Content Type
updates
- rfc-5959 — Algorithms for Asymmetric Key Package Content Type
Extracted elements (9)
The document extends RFC 5959 rather than replacing it, adding only ECDSA and ECDH algorithm support to SignedData and EnvelopedData without defining any new algorithms, relying entirely on previously defined algorithm specifications.
The easiest way to implement SignedData and EnvelopedData is with public key certificates (RFC 5280, RFC 5480), making certificate-based public key representation the recommended implementation path for EC algorithms.
Standard (non-cofactor) ECDH is specified for EnvelopedData key agreement, distinguishing it from cofactor ECDH variants and constraining interoperability to the standard form as defined in RFC 6090 and RFC 5753.
If an implementation supports ECDSA or ECDH, then it MUST support keys on the P-256 curve.
If an implementation supports SignedData, then it MAY support ECDSA as defined in RFC 6090 and RFC 5753.
When key agreement is used in EnvelopedData, standard (as opposed to cofactor) ECDH MAY be supported per RFC 6090 and RFC 5753.
EnvelopedData with standard ECDH key agreement is used to protect the AsymmetricKeyPackage content type, referencing algorithm definitions in RFC 6090 and RFC 5753.
SignedData with ECDSA is used to protect the AsymmetricKeyPackage content type, referencing the ECDSA algorithm definitions in RFC 6090 and RFC 5753.
The security considerations from RFC 5280, RFC 5480, RFC 5652, RFC 5753, RFC 5959, and RFC 6090 all apply to this document's use of EC algorithms with the AsymmetricKeyPackage content type.