Additional XML Security Uniform Resource Identifiers (URIs)
obsoletes
- rfc-6931 — Additional XML Security Uniform Resource Identifiers (URIs)
Extracted elements (28)
Because SHA-384 requires approximately the same computational effort as SHA-512, RSA-SHA512 is suggested over RSA-SHA384 where possible. Similarly, RSA-SHA256 is suggested over RSA-SHA224 for the same efficiency reason.
Minimal Canonicalization (URI: xmldsig#minimal) was dropped from XML Digital Signatures when advanced from RFC 3075 to RFC 3275 Draft Standard because two independent interoperable implementations were not announced, but the URI is retained here for reference due to continued interest.
SHA-256 (not SHA-1) is chosen as the default for RSASSA-PSS in this document due to the discovered weakness of SHA-1 (RFC 6194), overriding the RFC 8017 default. This is explicitly non-backwards-compatible with RFC 8017 defaults.
Specification of a URI for an algorithm does not imply endorsement of the algorithm for any particular purpose; a protocol specification (not this document) must give algorithm and implementation requirements. Security considerations for algorithms are constantly evolving.
This document fixes three errata against RFC 6931: Errata IDs 3597, 3965, and 4004, and obsoletes RFC 6931 entirely.
RFC 6931 accidentally included an erroneous URI for RSA-SHA224 (http://www.w3.org/2007/05/xmldsig-more#rsa-sha224) and for Canonical XML 1.1 (2006/12/xmlc12n11#). Implementations SHOULD only generate the correct URI but SHOULD understand both the correct and erroneous URI.
For RSA-MD5 signatures, the value input to the signature function MUST contain a prepended ASN.1 algorithm object identifier for the hash function. The FF octet in PKCS #1 v1.5 padding MUST be repeated enough times so the quantity being encrypted is exactly one octet shorter than the RSA modulus.
For RSASSA-PSS SignatureMethod identifiers, if no hash function is specified, SHA-256 is the default (not SHA-1 as in RFC 8017). The default salt length SHALL be the number of octets in the hash value of the digest method if SaltLength is not specified. The TrailerField defaults to 1 (0xBC) when omitted.
Implementations SHOULD only generate the correct URI but SHOULD understand both the correct and erroneous URI for algorithm identifiers that had bad values in RFC 6931.
New entries to the IANA XML Security URIs registry require Specification Required (RFC 8126). The designated expert must assess: (1) sufficient documentation for interoperability and XML syntax, and (2) sufficient importance as shown by inclusion in an approved W3C Note/Proposed Recommendation/Recommendation or approved RFC.
Camellia block encryption in CBC mode (URIs: xmldsig-more#camellia128-cbc, #camellia192-cbc, #camellia256-cbc) uses a 128-bit block with 128-bit IV prefixed to the ciphertext, then base64-encoded if in XML output. Key sizes are 128, 192, and 256 bits.
ChaCha20 encryption (URI: 2021/04/xmldsig-more#chacha20) uses a 256-bit key, 96-bit Nonce and 32-bit Counter represented as hex in child elements Nonce and Counter of EncryptionMethod.
ChaCha20+Poly1305 AEAD (URI: 2021/04/xmldsig-more#chacha20poly1305) uses a 256-bit key, 96-bit Nonce, and variable-length AAD. CipherData is the concatenation of encrypted ChaCha20 output and the 128-bit Poly1305 tag.
DigestMethod algorithms defined include MD5 (128-bit, 16-octet, URI: xmldsig-more#md5), SHA-224 (224-bit, 28-octet), SHA-384 (384-bit, 48-octet), Whirlpool (512-bit, 64-octet), and SHA-3 variants (224/256/384/512-bit). DigestValue content SHALL be base64 encoding of the digest.
Edwards-curve Digital Signature (EdDSA) identifiers are defined for Ed25519 (32-octet public keys, 64-octet signatures, ~128-bit security, uses SHA-512 internally) and Ed448 (57-octet public keys, 114-octet signatures, ~224-bit security, uses SHAKE256 internally), with variants for ph (prehash) and ctx (context) under the 2021/04/xmldsig-more# namespace.
Four URI namespaces are used for XML security algorithm identifiers: the original xmldsig# (2000/09), xmldsig-more# (2001/04, frozen with RFC 4051), xmldsig-more# (2007/05, frozen with RFC 6931), and the new xmldsig-more# (2021/04) assigned by W3C for algorithms added in this document.
HKDF key derivation (URI: 2021/04/xmldsig-more#hkdf) maps its inputs to existing AgreementMethod child elements: hash via DigestMethod, salt via Salt element (hex), IKM via OriginatorKeyInfo (hex), info via KA-Nonce (hex), and output size via KeySize (decimal).
RetrievalMethod Type attribute URIs are defined for KeyName, KeyValue, PKCS7signedData, rawPGPKeyPacket, rawPKCS7signedData, rawSPKISexp, rawX509CRL, and RetrievalMethod. Raw key types require a Type attribute because they are not unambiguously parsable.
RSASSA-PSS with Parameters (URI: xmldsig-more#rsa-pss) uses an RSAPSSParams XML element containing optional DigestMethod, MaskGenerationFunction, SaltLength (integer), and TrailerField (integer) child elements. The schema namespace is http://www.w3.org/2007/05/xmldsig-more#.
The PKCS7signedData KeyInfo element (URI: xmldsig-more#PKCS7signedData) wraps a base64-encoded binary PKCS #7 RFC 2315 signedData structure for use as a bag of certificates and/or CRLs within KeyInfo; any signer information present is ignored.
The XPointer Transform (URI: xmldsig-more#xptr) takes an XPointer as an explicit parameter in a child XPointer element. Input is an octet stream parsed as XML; output is a node set processed as defined for same-document XPointer in RFC 3275.
X25519 and X448 key agreement algorithms (URI: 2021/04/xmldsig-more#x25519 and #x448) are defined for use as KeyAgreementMethod per XMLENC11 and are specified in RFC 7748.
XMSS (eXtended Merkle Signature Scheme) and XMSSMT (Multi-Tree) are stateful hash-based post-quantum signature schemes identified by URIs under the 2021/04/xmldsig-more# namespace. URI fragment names are formed by replacing underscores and slashes in IANA registry names with hyphens.
IANA maintains an "XML Security URIs" registry updated by this document to correspond to Section 4.2, with all references to RFC 6931 replaced by RFC 9231. New entries are added based on Specification Required per RFC 8126.
ARCFOUR (RC4-compatible) stream cipher is identified at xmldsig-more#arcfour but RC4 has been found to have weaknesses and its use is prohibited in several IETF protocols including TLS (RFC 7465). This document does not remove the identifier but notes the security concern.
MD5 (as DigestMethod) and HMAC-MD5 and RSA-MD5 are defined with URI identifiers but RFC 6151 documents MD5 security considerations that implementers must consult. The document specifies URIs without endorsing the algorithms for any particular purpose.
XMSS and XMSSMT are stateful signature schemes requiring careful state management to maintain their security strength; their security is believed to depend only on the security of underlying hash functions and is expected to resist large-scale quantum computers. See NIST SP 800-208 for intended usage and state management requirements.
ECDSA signature value encodes the pair (r, s) as base64 of the concatenation of two octet streams, each produced by I2OSP per RFC 8017 with l equal to the base point order size in octets (e.g., 32 octets for P-256, 66 for P-521).