Use of the SHA3 One-Way Hash Functions in the Cryptographic Message Syntax (CMS)
Extracted elements (25)
This document explicitly covers only the fixed-output SHA3 hash functions (SHA3-224/256/384/512), not the SHAKE extensible-output functions; RFC 8702 separately defines the SHAKE family for CMS to keep the two specifications cleanly separated.
CMS values are encoded using ASN.1 BER and DER per X.680 and X.690; implementers must use these encoding rules when generating or parsing algorithm identifiers and associated structures defined in this document.
For KMAC128-KDF/KMAC256-KDF, the input key K length MUST be less than 2^2040, the output length L MUST be >= 0 and less than 2^2040, and the customization label S length MUST be less than 2^2040.
The ECParameters associated with the ECDSA public key in the signer's certificate SHALL apply to the verification of the signature.
When id-alg-hkdf-with-sha3-* is used in an algorithm identifier, the parameters field MUST be absent, not NULL but absent.
When id-kmac128 or id-kmac256 is used, the parameters field MUST be absent when there is no customization label S; if S is provided, the parameters field MUST be present and contain S encoded as Customization (OCTET STRING).
When signing with ECDSA, the two output values r and s MUST be ASN.1 encoded using the ECDSA-Sig-Value SEQUENCE { r INTEGER, s INTEGER } defined in RFC 3279.
When the id-ecdsa-with-sha3-* algorithm identifiers are used, the parameters field MUST be absent, not NULL but absent.
When the id-hmacWithSHA3-* algorithm identifiers are used, the parameters field MUST be absent, not NULL but absent.
When the rsaEncryption algorithm identifier is used, the RSA public key MUST be encoded using the RSAPublicKey type (a SEQUENCE of modulus INTEGER and publicExponent INTEGER) as specified in RFC 3279.
When the rsaEncryption, id-rsassa-pkcs1-v1-5-with-sha3-224, id-rsassa-pkcs1-v1-5-with-sha3-256, id-rsassa-pkcs1-v1-5-with-sha3-384, or id-rsassa-pkcs1-v1-5-with-sha3-512 algorithm identifiers are used, the AlgorithmIdentifier parameters field MUST contain NULL.
When using id-sha3-224, id-sha3-256, id-sha3-384, or id-sha3-512 algorithm identifiers, the parameters field MUST be absent — not NULL, but absent.
ECDSA combined with SHA3 is identified by four OIDs under sigAlgs: id-ecdsa-with-sha3-224 { sigAlgs 9 }, id-ecdsa-with-sha3-256 { sigAlgs 10 }, id-ecdsa-with-sha3-384 { sigAlgs 11 }, id-ecdsa-with-sha3-512 { sigAlgs 12 }.
HKDF with SHA3 is assigned four OIDs under the S/MIME id-alg arc: id-alg-hkdf-with-sha3-224 { id-alg 32 }, id-alg-hkdf-with-sha3-256 { id-alg 33 }, id-alg-hkdf-with-sha3-384 { id-alg 34 }, id-alg-hkdf-with-sha3-512 { id-alg 35 }, for use with the CMS KEMRecipientInfo structure.
HMAC with SHA3 is identified by four OIDs under hashAlgs: id-hmacWithSHA3-224 { hashAlgs 13 }, id-hmacWithSHA3-256 { hashAlgs 14 }, id-hmacWithSHA3-384 { hashAlgs 15 }, id-hmacWithSHA3-512 { hashAlgs 16 }. These identifiers are placed in the AuthenticatedData macAlgorithm field.
KDF2 and KDF3 (from ANSI X9.44) are identified by id-kdf-kdf2 and id-kdf-kdf3 under the x9-44-components arc; their algorithm identifier parameters carry a message digest algorithm identifier (from Section 2) to indicate the SHA3 hash function being used.
KMAC128-KDF and KMAC256-KDF are defined as KMAC128(K, X, L, S) and KMAC256(K, X, L, S), identified by id-kmac128 { hashAlgs 21 } and id-kmac256 { hashAlgs 22 }, for use as KDFs in CMS (e.g., with KEMRecipientInfo).
RSASSA PKCS#1 v1.5 combined with SHA3 is identified by four OIDs under the NIST sigAlgs arc: id-rsassa-pkcs1-v1-5-with-sha3-224 { sigAlgs 13 }, id-rsassa-pkcs1-v1-5-with-sha3-256 { sigAlgs 14 }, id-rsassa-pkcs1-v1-5-with-sha3-384 { sigAlgs 15 }, id-rsassa-pkcs1-v1-5-with-sha3-512 { sigAlgs 16 }.
SHA3-224, SHA3-256, SHA3-384, and SHA3-512 are assigned OIDs under the NIST hashAlgs arc: id-sha3-224 { hashAlgs 7 }, id-sha3-256 { hashAlgs 8 }, id-sha3-384 { hashAlgs 9 }, id-sha3-512 { hashAlgs 10 }. These identifiers are used in digestAlgorithms, digestAlgorithm, and related CMS fields.
IANA assigned four OIDs (id-alg 32–35) for HKDF-with-SHA3-224/256/384/512 in the 'SMI Security for S/MIME Algorithms (1.2.840.113549.1.9.16.3)' registry.
IANA assigned OID id-mod-sha3-oids-2023 (value 78) in the 'SMI Security for S/MIME Module Identifiers (1.2.840.113549.1.9.16.0)' registry for the ASN.1 module defined in Appendix A.
Cryptographic algorithms weaken over time as new cryptanalysis techniques and computing improvements emerge; implementations should be modular to allow new algorithms to be readily inserted and should plan for regular algorithm updates.
Implementations must protect the signer's private key and the key-derivation key; compromise of either permits masquerade or derivation of keying material, resulting in loss of confidentiality, integrity, or authentication.
Implementations must randomly generate message-authentication keys and one-time values (e.g., the ECDSA per-message k value); use of inadequate PRNGs can result in little or no security. RFC 4086 provides guidance on randomness requirements.
When more than two parties share the same message-authentication key, data origin authentication is not assured because any party that knows the key can compute a valid MAC.