The Profile for Algorithms and Key Sizes for Use in the Resource Public Key Infrastructure
obsoletes
- rfc-6485 — The Profile for Algorithms and Key Sizes for Use in the Resource Public Key Infrastructure (RPKI)
updated by
Extracted elements (15)
RFC 6485 required sha256WithRSAEncryption as the OID for the CMS SignerInfo signatureAlgorithm field, but existing implementations use rsaEncryption because library support for rsaEncryption is broader. This document changed to follow existing practice rather than force an implementation switch; this is an identifier change only, not a cryptographic algorithm change.
The RPKI algorithm profile is anticipated to require updates over time as cryptographic security requirements evolve; the transition procedures for changing key sizes and algorithms are specified in RFC 6916 (algorithm agility). This document defers future algorithm transitions to that procedure rather than specifying them inline.
To avoid compatibility problems with objects produced by implementations conforming to RFC 6485 (which used sha256WithRSAEncryption), relying parties are still required to accept sha256WithRSAEncryption in the SignerInfo signatureAlgorithm field when verifying CMS SignedData objects.
For CMS SignedData, the SHA-256 OID and parameters as defined in RFC 5754 MUST be used for the digestAlgorithms field and the SignerInfo digestAlgorithm field.
In the subjectPublicKeyInfo algorithm field, the OID for RSA PKCS #1 v1.5 with SHA-256 MUST be used as specified in Section 5 of RFC 4055, along with the associated parameters.
RSA key pairs used to compute RPKI signatures MUST have a 2048-bit modulus and a public exponent (e) of 65,537.
RSAPublicKey MUST be used to encode the certificate's subjectPublicKey field, as specified in RFC 4055.
The hashing algorithm used in RPKI certificates, CRLs, CMS signed objects, and certification requests MUST be SHA-256, with the exception that SHA-1 is used when CAs generate authority and subject key identifiers.
The OID rsaEncryption (RFC 3370) MUST be used for the SignerInfo signatureAlgorithm field when generating CMS SignedData objects; however, RPKI implementations MUST accept either rsaEncryption or sha256WithRSAEncryption when verifying CMS SignedData objects.
The OID sha256WithRSAEncryption from RFC 4055 MUST be used in certificates, CRLs, and certification requests in all relevant algorithm identifier fields (signature, signatureAlgorithm, PKCS#10 signatureAlgorithm, and CRMF POPOSigningKey algorithmIdentifier).
The signature algorithm used in RPKI certificates, CRLs, CMS signed objects, and certification requests MUST be RSA PKCS #1 Version 1.5 (RSASSA-PKCS1-v1_5) as specified in Section 8.2 of RFC 3447.
Private key format is not mandated by this profile; local policy determines the private key format.
The RPKI public key format uses subjectPublicKeyInfo with two sub-fields: algorithm (AlgorithmIdentifier with RSA PKCS#1 v1.5 with SHA-256 OID) and subjectPublicKey (RSAPublicKey encoding).
The Security Considerations of RFC 4055, RFC 5280, and RFC 6487 apply to certificates and CRLs; those of RFC 2986, RFC 4211, and RFC 6487 apply to certification requests; and those of RFC 5754 apply to CMS signed objects. No new security threats are introduced by this specification.
The certificate signature field structure is as specified in Section 1.2 of RFC 4055. The signature field in CMS SignedData's SignerInfos is structured as specified in RFC 5652.