The Profile for Algorithms and Key Sizes for Use in the Resource Public Key Infrastructure (RPKI)
obsoleted by
- rfc-7935 — The Profile for Algorithms and Key Sizes for Use in the Resource Public Key Infrastructure
Extracted elements (12)
The private key format is explicitly left to local policy and is not specified by this profile. This avoids prescribing key storage or management mechanisms that are outside the scope of on-the-wire interoperability.
The RPKI is anticipated to require updated key sizes and different signature/hash algorithms over time to maintain acceptable cryptographic security. This profile is explicitly designed to be replaced by a successor document when such updates are needed, rather than being amended in place.
An exception to the general SHA-256 requirement exists: Certification Authorities MUST use SHA-1 when generating authority and subject key identifiers as specified in RFC 6487. This is the only permitted use of SHA-1 in the RPKI algorithm profile.
CAs and RPs SHOULD be capable of supporting a transition to accommodate phased introduction of additional encryption algorithms and key specifications, as well as orderly deprecation of previously specified ones. CAs and RPs SHOULD be capable of supporting multiple RPKI algorithm and key profiles simultaneously.
RSA key pairs used to compute RPKI signatures MUST have a 2048-bit modulus and a public exponent (e) of 65,537. No other key sizes or exponent values are permitted under this profile.
The OID sha256withRSAEncryption from RFC 4055 MUST be used when generating or verifying digital signatures in the RPKI. It appears in the certificate signature and signatureAlgorithm fields, the CRL signatureAlgorithm field, each CMS SignerInfo signatureAlgorithm field, and certification request signature fields.
The RSA PKCS#1 v1.5 with SHA-256 OID MUST be used in the public key algorithm field (per RFC 4055 Section 5), and RSAPublicKey MUST be used to encode the certificate's subjectPublicKey field.
When SHA-256 is used as a message digest in CMS SignedData, the object identifier and parameters for SHA-256 as defined in RFC 5754 MUST be used when populating the digestAlgorithms and digestAlgorithm fields.
The certificate signature field structure follows RFC 4055 Section 1.2. The CMS SignedData signature field structure follows RFC 3370. No additional encoding is introduced by this profile.
The signature algorithm used throughout the RPKI (certificates, CRLs, and signed objects) is RSA PKCS#1 Version 1.5 (RSASSA-PKCS1-v1_5) as defined in Section 5 of RFC 4055. The hash algorithm used is SHA-256 (FIPS 180-3). Together they are referred to as 'RSA with SHA-256'.
The subject's public key is carried in subjectPublicKeyInfo (RFC 5280), containing two sub-fields: algorithm and subjectPublicKey. The algorithm field uses the AlgorithmIdentifier type with the RSA PKCS#1 v1.5 with SHA-256 OID and its associated parameters from RFC 4055 Section 5.
The Security Considerations of RFC 4055, RFC 5280, and RFC 6487 apply to RPKI certificates and CRLs; those of RFC 5754 apply to signed objects. No new security threats are introduced by this algorithm profile specification.