X.509 Certificate Extended Key Usage (EKU) for Instant Messaging URIs
Extracted elements (8)
Organizations may be unwilling to issue certificates for an IM client using a general KeyPurposeId such as id-kp-serverAuth or id-kp-clientAuth because of the risk that such certificates could be abused in a cross-protocol attack. A dedicated IM URI EKU avoids this risk.
The id-kp-imUri EKU is intended for use in MLS per-client identity certificates, where the subjectAltName may be an IM URI (RFC 3860) or an XMPP URI (RFC 6121), as used in the MIMI Working Group.
Certificate issuers SHOULD NOT set both the id-kp-imUri extended key purpose and an id-kp-clientAuth or id-kp-serverAuth extended key purpose simultaneously, as that would defeat the improved specificity offered by id-kp-imUri.
The id-kp-imUri EKU extension MAY, at the option of the certificate issuer, be either critical or non-critical.
Defines the KeyPurposeId id-kp-imUri (OID 1.3.6.1.5.5.7.3.40) for inclusion in the Extended Key Usage extension of X.509 v3 public key certificates to identify certificates used to prove the identity of an IM client.
IANA registered OID decimal 40 (id-kp-imUri) in the 'SMI Security for PKIX Extended Key Purpose' registry (1.3.6.1.5.5.7.3), and OID decimal 113 (id-mod-im-eku) in the 'SMI Security for PKIX Module Identifier' registry (1.3.6.1.5.5.7.0).
The id-kp-imUri EKU reduces existing security risks by providing a means to identify whether a certificate is generated to sign IM identity credentials, mitigating cross-protocol attack risks that arise when general-purpose KeyPurposeIds like id-kp-serverAuth or id-kp-clientAuth are used for IM clients.
The id-kp-imUri OID is encoded in ASN.1 as an OBJECT IDENTIFIER within the id-kp arc: { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) 40 }, defined in the IM-EKU ASN.1 module with OID arc id-mod-im-eku(113).