Algorithm Requirements Update to the Internet X.509 Public Key Infrastructure Certificate Request Message Format (CRMF)
updates
- rfc-4211 — Internet X.509 Public Key Infrastructure Certificate Request Message Format (CRMF)
Extracted elements (22)
AES-GMAC with a 128-bit key was chosen as the SHOULD-level MAC replacement because it is a NIST-standardized authenticated encryption primitive providing strong integrity guarantees and broad hardware support, in contrast to the deprecated DES-MAC and Triple-DES-MAC.
RFC 4211's original algorithm choices (HMAC-SHA1, DES-MAC, Triple-DES-MAC) were appropriate in 2005 but are no longer best choices: HMAC-SHA1 has stronger alternatives, DES-MAC provides only 56 bits of security (withdrawn by NIST), and Triple-DES-MAC provides only 112 bits (deprecated by NIST SP 800-131A).
SHA-1 was replaced by SHA-256 as the mandatory one-way function because stronger alternatives exist and SHA-1's security margin has diminished, per RFC 6194 security considerations.
The iteration count recommendation was raised from a minimum of 100 to typically at least 10,000 (per NIST SP 800-63B), while allowing lower counts when automated generation produces high-entropy secrets, reflecting the trade-off between brute-force resistance and server CPU cost.
All implementations MUST continue to support id-PasswordBasedMAC from RFC 4211 for backward compatibility. Support for PBMAC1 (RFC 8018, Section 7.1) is optional (MAY), enabling a migration path to the newer algorithm.
A nonce value of 12 octets can be processed more efficiently, so that length for the nonce value is RECOMMENDED. For use with CRMF, the maximum MAC length of 16 octets MUST be used.
All implementations MUST support HMAC-SHA256 as the MAC algorithm, replacing the previous requirement for HMAC-SHA1. All implementations SHOULD support AES-GMAC with a 128-bit key.
All implementations MUST support id-PasswordBasedMAC as presented in Section 4.4 of RFC 4211. Implementations MAY also support PBMAC1 as presented in Section 7.1 of RFC 8018.
All implementations MUST support SHA-256 as the one-way function (owf) used to compute the key in the MAC process, replacing the previous requirement for SHA-1.
The GMACParameters nonce may have any number of bits between 8 and (2^64)-1, but it MUST be a multiple of 8 bits. Within the scope of any GMAC key, the nonce value MUST be unique.
The iterationCount MUST be a minimum of 100; however, it SHOULD be as large as server performance will allow, typically at least 10,000 per NIST SP 800-63B. An iteration count smaller than 10,000 may be used when automated generation produces shared secrets with high entropy.
The password used to compute the Password-Based MAC SHOULD NOT be used for any other purpose, to prevent cross-protocol compromise of the shared secret.
When the AES-GMAC algorithm identifier (id-aes128-GMAC) is used, the parameters MUST be present and MUST contain a GMACParameters structure with a nonce and optional length field.
When the HMAC-SHA256 algorithm identifier (id-hmacWithSHA256) is used, parameters SHOULD be present, and when present, they MUST contain a type of NULL as specified in RFC 4231.
The ASN.1 OID for AES-GMAC with a 128-bit key is id-aes128-GMAC ::= { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) aes(1) 9 }, defined in RFC 9044.
The ASN.1 OID for HMAC-SHA256 is id-hmacWithSHA256 ::= { iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 9 }, defined in RFC 4231 and used as the mandatory MAC algorithm in updated CRMF.
The Password-Based MAC (id-PasswordBasedMAC) computes a symmetric key from a shared password using a one-way function iterated multiple times, then applies a MAC algorithm over the data. It is designed to resist dictionary attacks against the password.
Cryptographic algorithms age as cryptanalysis improves and computing power increases; the algorithm requirements for CRMF are updated by this specification to replace algorithms no longer considered adequate for security.
Hardware support for hash computation is available at very low cost, which reduces the protection provided by a high iterationCount value, making password entropy the dominant security factor for the Password-Based MAC.
Implementations must protect both the password and the MAC key; compromise of either may allow an attacker to undermine authentication. Using a one-time password increases security, assuming the integrity-protected transaction completes before an attacker can mount an offline attack.
The entropy of the password is crucial for Password-Based MAC security because hardware hash acceleration is available at low cost, reducing the protection afforded by high iteration counts. Real-world passwords have a median entropy of only ~27 bits; randomly generated strings of 10+ characters from a large alphabet are recommended.
GMACParameters is an ASN.1 SEQUENCE containing a nonce (OCTET STRING) and an optional length (MACLength, DEFAULT 12). MACLength is an INTEGER constrained to values 12, 13, 14, 15, or 16 octets.