Lightweight Certificate Management Protocol (CMP) Profile

3.6.1. Reporting Error Conditions Upstream

An EE SHALL NOT send error messages. PKI management entities SHALL NOT send error messages in upstream direction, either.¶

In case an EE rejects a newly issued certificate contained in an ip, cp, or kup message and implicit confirmation has not been granted, the EE MUST report this using a certConf message with "rejection" status and await the pkiConf response as described in Section 4.1.1.¶

On all other error conditions regarding response messages, the EE or PKI management entity MUST regard the current PKI management operation as terminated with failure. The error conditions include¶

• invalid response message header, body type, protection, or extraCerts according to the checks described in Section 3.5,¶
• any issue detected with response message contents,¶
• receipt of an error message from upstream,¶
• timeout occurred while waiting for a response,¶
• rejection of a newly issued certificate while implicit confirmation has been granted.¶

Upstream PKI management entities will not receive any CMP message to learn that the PKI management operation has been terminated. In case they expect a further message from the EE, a connection interruption or timeout will occur. Then they also MUST regard the current PKI management operation as terminated with failure and MUST NOT attempt to send an error message downstream.¶

3.6.2. Reporting Error Conditions Downstream

In case the PKI management entity detects an error condition, e.g., rejecting the request due to policy decision, in the body of an ir, cr, p10cr, kur, or rr message received from downstream, it SHOULD report the error in the specific response message, i.e., an ip, cp, kup, or rp with "rejection" status, as described in Section 4.1.1 and Section 4.2. This can also happen in case of polling.¶

In case the PKI management entity detects any other error condition on requests, including pollReq, certConf, genm, and nested messages, received from downstream and on responses received from upstream, such as invalid message header, body type, protection, or extraCerts according to the checks described in Section 3.5 it MUST report them downstream in the form of an error message as described in Section 3.6.4.¶

3.6.3. Handling Error Conditions on Nested Messages Used for Batching

Batching of messages using nested messages as described in Section 5.2.2.2 requires special error handling.¶

If the error condition is on an upstream nested message containing batched requests, it MUST NOT attempt to respond to the individual requests included in it.¶

In case a PKI management entity receives an error message in response to a nested message, it must propagate the error by responding with an error message to each of the request messages contained in the nested message.¶

In case a PKI management entity detects an error condition on the downstream nested message received in response to a nested message sent before, it MAY ignore this error condition and handle the response as described in Section 5.2.2.2. Otherwise, it MUST propagate the error by responding with an error message to each of the requests contained in the nested message it sent originally.¶

3.6.4. PKIStatusInfo and Error Messages

When sending any kind of negative response, including error messages, a PKI entity MUST indicate the error condition in the PKIStatusInfo structure of the respective message as described below. It then MUST regard the current PKI management operation as terminated with failure.¶

The PKIStatusInfo structure is used to report errors. It may be part of various message types, in particular: certConf, ip, cp, kup, and error. The PKIStatusInfo structure consists of the following fields:¶

• status: Here the PKIStatus value "rejection" MUST be used.¶

  Note: When a PKI management entity indicates delayed delivery of a CMP response message to the EE with an error message as described in Section 4.4, the status "waiting" is used there.¶

• statusString: Here any human-readable valid value for logging or to display via a user interface SHOULD be added.¶

• failInfo: Here the PKIFailureInfo bits MAY be used in the way explained in Appendix F of RFC 4210 [RFC4210]. PKIFailureInfo bits regarding the validation described in Section 3.5 are referenced there. The PKIFailureInfo bits referenced in Section 5.1 and Section 6 are described here:¶

  • badCertId: A kur, certConf, or rr message references an unknown certificate¶
  • badPOP: An ir/cr/p10cr/kur contains an invalid proof-of-possession¶
  • certRevoked: Revocation requested for a certificate already revoked¶
  • badCertTemplate: The contents of a certificate request are not accepted, e.g., a field is missing or has a non-acceptable value or the given public key is already in use in some other certificate (depending on policy).¶
  • transactionIdInUse: This is sent by a PKI management entity in case the received request contains a transactionID that has already been used for another transaction. An EE receiving such error message SHOULD resend the request in a new transaction using a different transactionID.¶
  • notAuthorized: The sender of a request message is not authorized for requesting the operation.¶
  • systemUnavail: This is sent by a PKI management entity in case a back-end system is not available.¶
  • systemFailure: This is sent by a PKI management entity in case a back-end system is currently not functioning correctly.¶

An EE receiving a systemUnavail or systemFailure failInfo SHOULD resend the request in a new transaction after some time.¶

Detailed Message Description:¶

Error Message -- error

Field                         Value

header
    -- As described in Section 3.1

body
    -- The message indicating the error that occurred
  error                       REQUIRED
    pKIStatusInfo             REQUIRED
      status                  REQUIRED
    -- MUST have the value "rejection"
      statusString            RECOMMENDED
    -- SHOULD be any human-readable text for debugging, logging
    -- or to display in a GUI
      failInfo                OPTIONAL
    -- MAY be present and contain the relevant PKIFailureInfo bits

protection                    RECOMMENDED
    -- As described in Section 3.2
    -- MAY be omitted if protection is technically not feasible

extraCerts                    RECOMMENDED
    -- As described in Section 3.3

Note: Protecting the error message may not be technically feasible if it is not clear which credential the recipient will be able to use when validating this protection, e.g., in case the request message was fundamentally broken.¶

4.1.1. Enrolling an End Entity to a New PKI

This PKI management operation should be used by an EE to request a certificate from a new PKI using an existing certificate from an external PKI, e.g., a manufacturer-issued IDevID certificate [IEEE.802.1AR_2018], to authenticate itself to the new PKI.¶

Note: In Bootstrapping Remote Secure Key Infrastructure (BRSKI) [RFC8995] environments, BRSKI Asynchronous Enrollment (BRSKI-AE) [I-D.ietf-anima-brski-ae] describes a generalization regarding enrollment protocols alternative to EST [RFC7030]. As replacement of EST simpleenroll, BRSKI-AE uses this PKI management operation for bootstrapping LDevID certificates.¶

Specific prerequisites augmenting the prerequisites in Section 3.4:¶

• The certificate of the EE MUST have been enrolled by an external PKI, e.g., a manufacturer-issued device certificate.¶
• The PKI management entity MUST have the trust anchor of the external PKI.¶
• When using the generalInfo field certProfile, the EE MUST know the identifier needed to indicate the requested certificate profile.¶

Message Flow:¶

Step# EE                                  PKI management entity
  1   format ir
  2                      ->   ir      ->
  3                                        handle or
                                             forward ir
  4                                        format or receive ip
  5                                        possibly grant
                                             implicitConfirm
  6                      <-   ip      <-
  7   handle ip

-----------------  if implicitConfirm not granted  -----------------

  8   format certConf
  9                      ->   certConf ->
 10                                        handle or
                                             forward certConf
 11                                        format or receive pkiConf
 12                      <-   pkiConf  <-
 13   handle pkiConf

For this PKI management operation, the EE MUST include exactly one CertReqMsg in the ir. If more certificates are required, further requests MUST be sent using separate PKI management operation.¶

The EE SHOULD include the implicitConfirm extension in the header of the ir message as described in Section 3.1, unless it knows that certificate confirmation is needed. This leaves the choice to the PKI management entities whether the EE must send a certConf message on receiving a new certificate. Depending on the PKI policy and requirements for managing EE certificates, it can be important for PKI management entities to learn if the EE accepted the new certificate. In such cases, when responding with an ip message, the PKI management entity MUST NOT include the implicitConfirm extension. In case the PKI management entity does not need any explicit confirmation from the EE, it MUST include the extension as described in Section 3.1. This prevents explicit certificate confirmation and saves the overhead of a further message round-trip.¶

If the EE did not request implicit confirmation or implicit confirmation was not granted by the PKI management entity, certificate confirmation MUST be performed as follows. If the EE successfully received the certificate, it MUST send a certConf message in due time. On receiving a valid certConf message, the PKI management entity MUST respond with a pkiConf message. If the PKI management entity does not receive the expected certConf message in time it MUST handle this like a rejection by the EE. In case of rejection, depending on its policy the PKI management entity MAY revoke the newly issued certificate, notify a monitoring system, or log the event internally.¶

Note: Depending on PKI policy, a new certificate may be published by a PKI management entity, and explicit confirmation may be required. In this case it is advisable not to do the publication until a positive certificate confirmation has been received. This way the need to revoke the certificate on negative confirmation is avoided.¶

If the certificate request was rejected by the CA, the PKI management entity must return an ip message containing the status code "rejection" as described in Section 3.6 and no certifiedKeyPair field. The EE MUST NOT react to such an ip message with a certConf message and the PKI management operation MUST be terminated.¶

Detailed Message Description:¶

Initialization Request -- ir

Field                         Value

header
    -- As described in Section 3.1

body
    -- The request of the EE for a new certificate
  ir                          REQUIRED
    -- MUST contain exactly one CertReqMsg
    -- If more certificates are required, further PKI management
    -- operations MUST be initiated
    certReq                   REQUIRED
      certReqId               REQUIRED
    -- MUST be 0
      certTemplate            REQUIRED
        version               OPTIONAL
    -- MUST be 2 if supplied
        subject               REQUIRED
    -- The EE subject name MUST be carried in the subject field
    -- and/or the subjectAltName extension.
    -- If subject name is present only in the subjectAltName
    -- extension, then the subject field MUST be a NULL-DN
        publicKey             REQUIRED
          algorithm           REQUIRED
    -- MUST include the subject public key algorithm identifier
          subjectPublicKey    REQUIRED
    -- MUST contain the public key to be certified in case of local
    -- key generation
        extensions            OPTIONAL
    -- MAY include end-entity-specific X.509 extensions of the
    -- requested certificate like subject alternative name, key
    -- usage, and extended key usage
    -- The subjectAltName extension MUST be present if the EE subject
    -- name includes a subject alternative name.
    popo                      OPTIONAL
    -- MUST be present if local key generation is used
    -- MUST be absent if central key generation is requested
      signature               RECOMMENDED
    -- MUST be used by an EE if the key can be used for signing and
    -- has the type POPOSigningKey
        poposkInput           PROHIBITED
    -- MUST NOT be used; it is not needed because subject and
    -- publicKey are both present in the certTemplate
        algorithmIdentifier   REQUIRED
    -- The signature algorithm MUST be consistent with the publicKey
    -- algorithm field of the certTemplate
        signature             REQUIRED
    -- MUST contain the signature value computed over the DER-encoded
    -- certTemplate
      raVerified              OPTIONAL
    -- MAY be used by an RA after verifying the proof-of-possession
    -- provided by the EE

protection                    REQUIRED
    -- As described in Section 3.2

extraCerts                    REQUIRED
    -- As described in Section 3.3


Initialization Response -- ip

Field                         Value

header
    -- As described in Section 3.1

body
    -- The response of the CA to the request as appropriate
  ip                          REQUIRED
    caPubs                    OPTIONAL
    -- MAY be used if the certifiedKeyPair field is present
    -- If used it MUST contain only a trust anchor, e.g. root
    -- certificate, of the certificate contained in certOrEncCert
    response                  REQUIRED
    -- MUST contain exactly one CertResponse
      certReqId               REQUIRED
    -- MUST be 0
      status                  REQUIRED
    -- PKIStatusInfo structure MUST be present
        status                REQUIRED
    -- positive values allowed: "accepted", "grantedWithMods"
    -- negative values allowed: "rejection"
    -- "waiting" only allowed with polling use case as described in
    -- Section 4.4
        statusString          OPTIONAL
    -- MAY be any human-readable text for debugging, logging or to
    -- display in a GUI
        failInfo              OPTIONAL
    -- MAY be present if status is "rejection"
    -- MUST be absent if status is "accepted" or "grantedWithMods"
      certifiedKeyPair        OPTIONAL
    -- MUST be present if status is "accepted" or "grantedWithMods"
    -- MUST be absent if status is "rejection"
        certOrEncCert         REQUIRED
    -- MUST be present if status is "accepted" or "grantedWithMods"
          certificate         REQUIRED
    -- MUST be present when certifiedKeyPair is present
    -- MUST contain the newly enrolled X.509 certificate
        privateKey            OPTIONAL
    -- MUST be absent in case of local key generation or "rejection"
    -- MUST contain the encrypted private key in an EnvelopedData
    -- structure as specified in Section 4.1.6 in case the private
    -- key was generated centrally

protection                    REQUIRED
    -- As described in Section 3.2

extraCerts                    REQUIRED
    -- As described in Section 3.3
    -- MUST contain the chain of the certificate present in
    -- certOrEncCert
    -- Self-signed certificates SHOULD be omitted
    -- Duplicate certificates MAY be omitted


Certificate Confirmation -- certConf

Field                         Value

header
    -- As described in Section 3.1

body
    -- The message of the EE sends as confirmation to the PKI
    -- management entity to accept or reject the issued certificates
  certConf                    REQUIRED
    -- MUST contain exactly one CertStatus
    CertStatus                REQUIRED
      certHash                REQUIRED
    -- MUST be the hash of the certificate, using the hash algorithm
    -- indicated in hashAlg, see below, or the same one as used to
    -- create the certificate signature
      certReqId               REQUIRED
    -- MUST be 0
      statusInfo              RECOMMENDED
    -- PKIStatusInfo structure SHOULD be present
    -- Omission indicates acceptance of the indicated certificate
        status                REQUIRED
    -- positive values allowed: "accepted"
    -- negative values allowed: "rejection"
        statusString          OPTIONAL
    -- MAY be any human-readable text for debugging, logging, or to
    -- display in a GUI
        failInfo              OPTIONAL
    -- MAY be present if status is "rejection"
    -- MUST be absent if status is "accepted"
      hashAlg                 OPTIONAL
    -- The hash algorithm to use for calculating certHash
    -- SHOULD NOT be used in all cases where the AlgorithmIdentifier
    -- of the certificate signature specifies a hash algorithm
    -- If used, the pvno field in the header MUST be cmp2021 (3)

protection                    REQUIRED
    -- As described in Section 3.2
    -- MUST use the same credentials as in the first request message
    -- of this PKI management operation

extraCerts                    RECOMMENDED
    -- As described in Section 3.3
    -- MAY be omitted if the message size is critical and
    -- the PKI management entity caches the extraCerts from the
    -- first request message of this PKI management operation


PKI Confirmation -- pkiConf

Field                         Value

header
    -- As described in Section 3.1

body
  pkiconf                     REQUIRED
    -- The content of this field MUST be NULL

protection                    REQUIRED
    -- As described in Section 3.2
    -- MUST use the same credentials as in the first response
    -- message of this PKI management operation

extraCerts                    RECOMMENDED
    -- As described in Section 3.3
    -- MAY be omitted if the message size is critical and the EE has
    -- cached the extraCerts from the first response message of
    -- this PKI management operation

4.1.2. Enrolling an End Entity to a Known PKI

This PKI management operation should be used by an EE to request an additional certificate of the same PKI it already has certificates from. The EE uses one of these existing certificates to authenticate itself by signing its request messages using the respective private key.¶

Specific prerequisites augmenting the prerequisites in Section 3.4:¶

• The certificate used by the EE MUST have been enrolled by the PKI it requests another certificate from.¶
• When using the generalInfo field certProfile, the EE MUST know the identifier needed to indicate the requested certificate profile.¶

The message sequence for this PKI management operation is identical to that given in Section 4.1.1, with the following changes:¶

1

The body of the first request and response SHOULD be cr and cp, respectively.¶

Note: Since the difference between ir/ip and cr/cp is syntactically not essential, an ir/ip MAY be used in this PKI management operation.¶

2

The caPubs field in the certificate response message SHOULD be absent.¶

4.1.3. Updating a Valid Certificate

This PKI management operation should be used by an EE to request an update for one of its certificates that is still valid. The EE uses the certificate it wishes to update as the protection certificate. Both for authenticating itself and for proving ownership of the certificate to be updated, it signs the request messages with the corresponding private key.¶

Specific prerequisites augmenting the prerequisites in Section 3.4:¶

• The certificate the EE wishes to update MUST NOT be expired or revoked and MUST have been issued by the addressed CA.¶
• A new public-private key pair SHOULD be used.¶
• When using the generalInfo field certProfile, the EE MUST know the identifier needed to indicate the requested certificate profile.¶

The message sequence for this PKI management operation is identical to that given in Section 4.1.1, with the following changes:¶

1

The body of the first request and response MUST be kur and kup, respectively.¶

2

Protection of the kur MUST be performed using the certificate to be updated.¶

3

The subject field and/or the subjectAltName extension of the certTemplate MUST contain the EE subject name of the existing certificate to be updated, without modifications.¶

4

The certTemplate SHOULD contain the subject and/or subjectAltName extension and publicKey of the EE only.¶

5

The oldCertId control MAY be used to make clear which certificate is to be updated.¶

6

The caPubs field in the kup message MUST be absent.¶

As part of the certReq structure of the kur the oldCertId control is added after the certTemplate field.¶

    controls
      type                    RECOMMENDED
    -- MUST be the value id-regCtrl-oldCertID, if present
      value
        issuer                REQUIRED
        serialNumber          REQUIRED
    -- MUST contain the issuer and serialNumber of the certificate
    -- to be updated

4.1.4. Enrolling an End Entity Using a PKCS#10 Request

This PKI management operation can be used by an EE to request a certificate using a legacy PKCS#10 [RFC2986] request instead of CRMF [RFC4211]. This offers a variation of the PKI management operations specified in Section 4.1.2.¶

In Secure Zero Touch Provisioning (SZTP) [RFC8572] environments, SZTP-CSR [I-D.ietf-netconf-sztp-csr] describes the use of a CMP p10cr message as a form of certificate signing request (CSR) to optionally include in device bootstrapping to obtain an identity certificate as part of the onboarding information. Such a CSR is of form ietf-sztp-types:cmp-csr from module ietf-sztp-csr. The requirements given below on p10cr message MUST be adhered to.¶

In this PKI management operation, the public key and all further certificate template data MUST be contained in the subjectPKInfo and other certificationRequestInfo fields of the PKCS#10 structure.¶

The prerequisites are the same as given in Section 4.1.2.¶

The message sequence for this PKI management operation is identical to that given in Section 4.1.2, with the following changes:¶

1

The body of the first request and response MUST be p10cr and cp, respectively.¶

2

The certReqId in the cp message MUST be -1.¶

3

The caPubs field in the cp message SHOULD be absent.¶

Detailed Message Description:¶

Certification Request -- p10cr

Field                         Value

header
    -- As described in Section 3.1

body
    -- The request of the EE for a new certificate using a PKCS#10
    -- certificate request
  p10cr                       REQUIRED
    certificationRequestInfo  REQUIRED
      version                 REQUIRED
    -- MUST be 0 to indicate PKCS#10 V1.7
      subject                 REQUIRED
    -- The EE subject name MUST be carried in the subject field
    -- and/or the subjectAltName extension.
    -- If subject name is present only in the subjectAltName
    -- extension, then the subject field MUST be a NULL-DN
      subjectPKInfo           REQUIRED
        algorithm             REQUIRED
    -- MUST include the subject public key algorithm identifier
        subjectPublicKey      REQUIRED
    -- MUST include the public key to be certified
      attributes              OPTIONAL
    -- MAY include end-entity-specific X.509 extensions of the
    -- requested certificate like subject alternative name,
    -- key usage, and extended key usage
    -- The subjectAltName extension MUST be present if the EE
    -- subject name includes a subject alternative name.
    signatureAlgorithm        REQUIRED
    -- The signature algorithm MUST be consistent with the
    -- subjectPKInfo field.
    signature                 REQUIRED
    -- MUST contain the self-signature for proof-of-possession

protection                    REQUIRED
    -- As described in Section 3.2

extraCerts                    REQUIRED
    -- As described for the underlying PKI management operation

4.1.5. Using MAC-Based Protection for Enrollment

This is a variant of the PKI management operations described in Section 4.1.1 to Section 4.1.4. It should be used by an EE to request a certificate of a new PKI in case it does not have a certificate to prove its identity to the target PKI, but has some secret information shared with the PKI management entity. Therefore, the request and response messages are MAC-protected using this shared secret information. The distribution of this shared secret is out of scope for this document. The PKI management entity checking the MAC-based protection SHOULD replace this protection according to Section 5.2.3 in case the next hop does not know the shared secret information.¶

Note: The entropy of the shared secret information is crucial for the level of protection when using MAC-based protection. Further guidance is available in the security considerations of CMP updated by [I-D.ietf-lamps-cmp-updates].¶

Specific prerequisites augmenting the prerequisites in Section 3.4:¶

• Rather than using private keys, certificates, and trust anchors, the EE and the PKI management entity MUST share secret information.¶

  Note: The shared secret information MUST be established out-of-band, e.g., by a service technician during initial local configuration.¶

• When using the generalInfo field certProfile, the EE MUST know the identifier needed to indicate the requested certificate profile.¶

The message sequence for this PKI management operation is identical to that given in Section 4.1.1, with the following changes:¶

1

The protection of all messages MUST be MAC-based.¶

2

The senderKID MUST contain a reference the recipient can use to identify the shared secret information used for the protection, e.g., the username of the EE.¶

3

The extraCerts of all messages does not contain CMP protection certs and associated chains.¶

See Section 6 of CMP Algorithms [I-D.ietf-lamps-cmp-algorithms] for details on message authentication code algorithms (MSG_MAC_ALG) to use. Typically, parameters are part of the protectionAlg field, e.g., used for key derivation, like a salt and an iteration count. Such fields SHOULD remain constant for message protection throughout this PKI management operation to reduce the computational overhead.¶

4.1.6. Adding Central Key Pair Generation to Enrollment

This is a variant of the PKI management operations described in Section 4.1.1 to Section 4.1.4 and the variant described in Section 4.1.5. It needs to be used in case an EE is not able to generate its new public-private key pair itself or central generation of the EE key material is preferred. It is a matter of the local implementation which PKI management entity will act as Key Generation Authority (KGA) and perform the key generation. This PKI management entity MUST use a certificate containing the additional extended key usage extension id-kp-cmKGA in order to be accepted by the EE as a legitimate key generation authority.¶

As described in Section 5.3.1, the KGA can use one of the PKI management operations described in the sections above to request the certificate for this key pair on behalf of the EE.¶

Note: When performing central key generation for a certificate update, the KGA cannot use the old EE credentials for protection. Therefore, the PKI management operation described in Section 4.1.2 SHOULD be used instead of Section 4.1.3 to request a certificate for the newly generated key pair on behalf of the EE.¶

Generally speaking, in machine-to-machine scenarios it is strongly preferable to generate public-private key pairs locally at the EE. Together with proof-of-possession of the private key in the certificate request, this is advisable to make sure that the entity identified in the newly issued certificate is the only entity that knows the private key.¶

Reasons for central key generation may include the following:¶

• Lack of sufficient initial entropy.¶

  Note: Good random numbers are needed not only for key generation but also for session keys and nonces in any security protocol. Therefore, a decent security architecture should anyways support good random number generation on the EE side or provide enough initial entropy for the RNG seed to guarantee good pseudo-random number generation. Yet maybe this is not the case at the time of requesting an initial certificate during manufacturing.¶

• Lack of computational resources, in particular for RSA key generation.¶

  Note: Since key generation could be performed in advance to the certificate enrollment communication, it is often not time critical.¶

Note: As mentioned in Section 2, central key generation may be required in a push model, where the certificate response message is transferred by the PKI management entity to the EE without a previous request message.¶

The EE requesting central key generation MUST omit the publicKey field from the certTemplate or, in case it has a preference on the key type to be generated, provide it in the algorithm sub-field and fill the subjectPublicKey sub-field with a zero-length BIT STRING. Both variants indicate to the PKI management entity that a new key pair shall be generated centrally on behalf of the EE.¶

Note: As the protection of centrally generated keys in the response message has been extended to EncryptedKey by CMP Updates Section 2.7 [I-D.ietf-lamps-cmp-updates], EnvelopedData is the preferred alternative to EncryptedValue. In CRMF Section 2.1.9 [RFC4211] the use of EncryptedValue has been deprecated in favor of the EnvelopedData structure. Therefore, this profile requires using EnvelopedData as specified in CMS Section 6 [RFC5652]. When EnvelopedData is to be used in a PKI management operation, CMP v3 MUST be indicated in the message header already for the initial request message, see CMP Updates Section 2.19 and Section 2.20 [I-D.ietf-lamps-cmp-updates].¶

+----------------------------------+
| EnvelopedData                    |
| [RFC5652] section 6              |
| +------------------------------+ |
| | SignedData                   | |
| | [RFC5652] section 5          | |
| | +--------------------------+ | |
| | | AsymmetricKeyPackage     | | |
| | | [RFC5958]                | | |
| | | +----------------------+ | | |
| | | | privateKey           | | | |
| | | | OCTET STRING         | | | |
| | | +----------------------+ | | |
| | +--------------------------+ | |
| +------------------------------+ |
+----------------------------------+

The PKI management entity delivers the private key in the privateKey field in the certifiedKeyPair structure of the response message also containing the newly issued certificate.¶

The private key MUST be provided as an AsymmetricKeyPackage structure as defined in RFC 5958 [RFC5958].¶

This AsymmetricKeyPackage structure MUST be wrapped in a SignedData structure, as specified in CMS Section 5 [RFC5652] and [RFC8933], signed by the KGA generating the key pair. The signature MUST be performed using a private key related to a certificate asserting the extended key usage id-kp-cmKGA as described in CMP Updates Section 2.2 [I-D.ietf-lamps-cmp-updates] to demonstrate authorization to generate key pairs on behalf of an EE. The EE SHOULD validate the signer certificate contained in the SignedData structure and verify the presence of this extended key usage in the signer certificate.¶

Note: When using password-based key management technique as described in Section 4.1.6.3 it may not be possible or meaningful to the EE to validate the KGA signature and the related certificate in the SignedData structure since shared secret information is used for initial authentication. In this case the EE MAY omit this validation.¶

The SignedData structure MUST be wrapped in an EnvelopedData structure, as specified in CMS Section 6 [RFC5652], encrypting it using a newly generated symmetric content-encryption key.¶

This content-encryption key MUST be securely provided as part of the EnvelopedData structure to the EE using one of three key management techniques. The choice of the key management technique to be used by the PKI management entity depends on the authentication mechanism the EE chose to protect the request message. See CMP Updates Section 2.7 [I-D.ietf-lamps-cmp-updates] for more details on which key management technique to use.¶

• Signature-based protection of the request message:¶

  • The content-encryption key SHALL be protected using the key agreement key management technique, see Section 4.1.6.1, if the certificate used by the EE for protecting the request message allows the key usage keyAgreement. If the certificate also allows the key usage keyEncipherment, the key transport key management technique SHALL NOT be used.¶
  • The content-encryption key SHALL be protected using the key transport key management technique, see Section 4.1.6.2, if the certificate used by the EE for protecting the respective request message allows the key usage keyEncipherment but not keyAgreement.¶

• MAC-based protected of the request message:¶

  • The content-encryption key SHALL be protected using the password-based key management technique, see Section 4.1.6.3, if and only if the EE used MAC-based protection for the request message.¶

If central key generation is supported, support of the key agreement key management technique is REQUIRED and support of key transport and password-based key management techniques are OPTION, for two reasons: The key agreement key management technique is supported by most asymmetric algorithms, while the key transport key management technique is supported only by a very few of them. The password-based key management technique shall only be used in combination with MAC-based protection, which is a sideline in this document.¶

Specific prerequisites augmenting those of the respective certificate enrollment PKI management operations:¶

• If signature-based protection is used, the EE MUST be able to authenticate and authorize the KGA, using suitable information, which includes a trust anchor.¶
• If MAC-based protection is used, the KGA MUST also know the shared secret information to protect the encrypted transport of the newly generated key pair. Consequently, the EE can also authorize the KGA.¶
• The PKI management entity MUST have a certificate containing the additional extended key usage extension id-kp-cmKGA for signing the SignedData structure containing the private key package.¶

• For encrypting the SignedData structure a fresh content-encryption key to be used by the symmetric encryption algorithm MUST be generated with sufficient entropy.¶

  Note: The security strength of the protection of the generated private key should be similar or higher than the security strength of the generated private key.¶

Detailed Description of privateKey Field:¶

        privateKey            OPTIONAL
    -- MUST be an EnvelopedData structure as specified in CMS
    -- Section 6 [RFC5652]
          version             REQUIRED
    -- MUST be 2 for recipientInfo type KeyAgreeRecipientInfo and
    -- KeyTransRecipientInfo
    -- MUST be 0 for recipientInfo type PasswordRecipientInfo
          recipientInfos      REQUIRED
    -- MUST contain exactly one RecipientInfo, which MUST be
    -- kari of type KeyAgreeRecipientInfo (see section 4.1.6.1),
    -- ktri of type KeyTransRecipientInfo (see section 4.1.6.2), or
    -- pwri of type PasswordRecipientInfo (see section 4.1.6.3)
          encryptedContentInfo
                              REQUIRED
            contentType       REQUIRED
    -- MUST be id-signedData
            contentEncryptionAlgorithm
                              REQUIRED
    -- MUST be the algorithm identifier of the algorithm used for
    -- content encryption
    -- The algorithm type MUST be a PROT_SYM_ALG as specified in
    -- RFC-CMP-Alg Section 5
            encryptedContent  REQUIRED
    -- MUST be the SignedData structure as specified in CMS
    -- Section 5 [RFC5652] and [RFC8933] in encrypted form
              version         REQUIRED
    -- MUST be 3
              digestAlgorithms
                              REQUIRED
    -- MUST contain exactly one AlgorithmIdentifier element
    -- MUST be the algorithm identifier of the digest algorithm
    -- used for generating the signature and match the signature
    -- algorithm specified in signatureAlgorithm, see and [RFC8933]
              encapContentInfo
                              REQUIRED
    -- MUST contain the content that is to be signed
                eContentType  REQUIRED
    -- MUST be id-ct-KP-aKeyPackage as specified in [RFC5958]
                eContent      REQUIRED
    -- MUST be of type AsymmetricKeyPackage and
    -- MUST contain exactly one OneAsymmetricKey element
                      version REQUIRED
    -- MUST be 1 (indicating v2)
                      privateKeyAlgorithm
                              REQUIRED
    -- The privateKeyAlgorithm field MUST contain the algorithm
    -- identifier of the asymmetric key pair algorithm
                      privateKey
                              REQUIRED
                      publicKey
                              REQUIRED
    -- MUST contain the public key corresponding to the private key
    -- for simplicity and consistency with v2 of OneAsymmetricKey
              certificates    REQUIRED
    -- MUST contain the certificate for the private key used to sign
    -- the signedData content, together with its chain
    -- The first certificate in this field MUST be the KGA
    -- certificate used for protecting this content
    -- Self-signed certificates SHOULD NOT be included and MUST NOT
    -- be trusted based on their inclusion in any case
                signerInfos   REQUIRED
    -- MUST contain exactly one SignerInfo element
                version       REQUIRED
    -- MUST be 3
                sid           REQUIRED
                  subjectKeyIdentifier
                              REQUIRED
    -- MUST be the subjectKeyIdentifier of the KGA certificate
                digestAlgorithm
                              REQUIRED
    -- MUST be the same as in digestAlgorithms
                signedAttrs   REQUIRED
    -- MUST contain an id-contentType attribute containing the value
    -- id-ct-KP-aKeyPackage
    -- MUST contain an id-messageDigest attribute containing the
    -- message digest of eContent
    -- MAY contain an id-signingTime attribute containing the time
    -- of signature
    -- For details on the signed attributes see CMS Section 5.3 and
    -- Section 11 [RFC5652] and [RFC8933]
                signatureAlgorithm
                              REQUIRED
    -- MUST be the algorithm identifier of the signature algorithm
    -- used for calculation of the signature bits
    -- The signature algorithm type MUST be a MSG_SIG_ALG as
    -- specified in RFC-CMP-Alg Section 3 and MUST be consistent
    -- with the subjectPublicKeyInfo field of the KGA certificate
                signature     REQUIRED
    -- MUST be the digital signature of the encapContentInfo

NOTE: As stated in Section 1.5, all fields of the ASN.1 syntax that are defined in RFC 5652 [RFC5652] but are not explicitly specified here SHOULD NOT be used.¶

            kari              REQUIRED
    -- MUST be a KeyAgreeRecipientInfo as specified in CMS Section
    -- 6.2.2 [RFC5652]
              version         REQUIRED
    -- MUST be 3
              originator      REQUIRED
    -- MUST contain the subjectKeyIdentifier of the certificate,
    -- and thereby identifies the sender's public key.
    -- MUST contain the same value as the senderKID in the
    -- message header
              ukm             RECOMMENDED
    -- MUST be used when 1-pass ECMQV is used
    -- SHOULD be present to ensure uniqueness of the key
    -- encryption key
              keyEncryptionAlgorithm
                              REQUIRED
    -- MUST be the algorithm identifier of the key agreement
    -- algorithm
    -- The algorithm type MUST be a KM_KA_ALG as specified in
    -- RFC-CMP-Alg Section 4.1
    -- The parameters field of the key agreement algorithm MUST
    -- contains the key wrap algorithm
    -- The algorithm type MUST be a KM_KW_ALG as specified in
    -- RFC-CMP-Alg Section 4.3
              recipientEncryptedKeys
                              REQUIRED
    -- MUST contain exactly one RecipientEncryptedKey element
                rid           REQUIRED
    -- MUST contain the rKeyId choice
                  rKeyId      REQUIRED
                    subjectKeyIdentifier
                              REQUIRED
    -- MUST contain the same value as the senderKID in the
    -- respective request message header
                  encryptedKey
                              REQUIRED
    -- MUST be the encrypted content-encryption key

            ktri              REQUIRED
    -- MUST be a KeyTransRecipientInfo as specified in CMS
    -- Section 6.2.1 [RFC5652]
              version         REQUIRED
    -- MUST be 2
              rid             REQUIRED
    -- MUST contain the subjectKeyIdentifier choice
                subjectKeyIdentifier
                              REQUIRED
    -- MUST contain the same value as the senderKID in the
    -- respective request message header
              keyEncryptionAlgorithm
                              REQUIRED
    -- MUST be the algorithm identifier of the key transport
    -- algorithm
    -- The algorithm type MUST be a KM_KT_ALG as specified in
    -- RFC-CMP-Alg Section 4.2
              encryptedKey    REQUIRED
    -- MUST be the encrypted content-encryption key

            pwri              REQUIRED
    -- MUST be a PasswordRecipientInfo as specified in CMS
    -- Section 6.2.4 [RFC5652]
              version         REQUIRED
    -- MUST be 0
              keyDerivationAlgorithm
                              REQUIRED
    -- MUST be the algorithm identifier of the key derivation
    -- algorithm
    -- The algorithm type MUST be a KM_KD_ALG as specified in
    -- RFC-CMP-Alg Section 4.4
              keyEncryptionAlgorithm
                              REQUIRED
    -- MUST be the algorithm identifier of the key wrap algorithm
    -- The algorithm type MUST be a KM_KW_ALG as specified in
    -- RFC-CMP-Alg Section 4.3
              encryptedKey    REQUIRED
    -- MUST be the encrypted content-encryption key

4.3.1. Get CA Certificates

This PKI management operation can be used by an EE to request CA certificates from the PKI management entity.¶

An EE requests CA certificates, e.g., for chain construction, from an PKI management entity by sending a general message with OID id-it-caCerts as specified in CMP Updates Section 2.13 [I-D.ietf-lamps-cmp-updates]. The PKI management entity responds with a general response with the same OID that either contains a SEQUENCE of certificates populated with the available intermediate and issuing CA certificates or with no content in case no CA certificate is available.¶

No specific prerequisites apply in addition to those specified in Section 3.4.¶

The message sequence for this PKI management operation is as given above, with the following specific content:¶

1

the infoType OID to use is id-it-caCerts¶

2

the infoValue of the request MUST be absent¶

3

if present, the infoValue of the response MUST contain a sequence of certificates¶

Detailed Description of infoValue Field of genp:¶

      infoValue               OPTIONAL
    -- MUST be absent if no CA certificate is available
    -- MUST be present if CA certificates are available
    -- MUST be a sequence of CMPCertificate

4.3.2. Get Root CA Certificate Update

This PKI management operation can be used by an EE to request an updated root CA Certificate as described in Section 4.4 of RFC 4210 [RFC4210].¶

An EE requests an update of a root CA certificate from the PKI management entity by sending a general message with OID id-it-rootCaCert, which SHOULD include the old root CA certificate in the message body, as specified in CMP Updates Section 2.14 [I-D.ietf-lamps-cmp-updates]. The PKI management entity responds with a general response with OID id-it-rootCaKeyUpdate that either contains the update of the root CA certificate consisting of up to three certificates, or with no content in case no update is available.¶

Note: This mechanism may also be used to update trusted non-root certificates, i.e., trusted intermediate CA or issuing CA certificates.¶

The newWithNew certificate is the new root CA certificate and is REQUIRED to be present if available. The newWithOld certificate is REQUIRED to be present in the response message because it is needed for the receiving entity trusting the old root CA certificate to gain trust in the new root CA certificate. The oldWithNew certificate is OPTIONAL because it is only needed in rare scenarios where entities do not already trust the old root CA.¶

No specific prerequisites apply in addition to those specified in Section 3.4.¶

The message sequence for this PKI management operation is as given above, with the following specific content:¶

1

the infoType OID to use is id-it-rootCaCert in the request and id-it-rootCaKeyUpdate in the response¶

2

the infoValue of the request SHOULD contain the root CA certificate the update is requested for¶

3

if present, the infoValue of the response MUST be a RootCaKeyUpdateContent structure¶

Detailed Description of infoValue Field of genm:¶

      infoValue               RECOMMENDED
    -- MUST contain the root CA certificate to be updated, if
    -- available

Detailed Description of infoValue Field of genp:¶

      infoValue               OPTIONAL
    -- MUST be absent if no update of the root CA certificate is
    -- available
    -- MUST be present if an update of the root CA certificate
    -- is available and MUST be of type RootCaKeyUpdateContent
        newWithNew            REQUIRED
    -- MUST be present if infoValue is present
    -- MUST contain the new root CA certificate
        newWithOld            REQUIRED
    -- MUST be present if infoValue is present
    -- MUST contain a certificate containing the new public
    -- root CA key signed with the old private root CA key
        oldWithNew            OPTIONAL
    -- MAY be present if infoValue is present
    -- MUST contain a certificate containing the old public
    -- root CA key signed with the new private root CA key

4.3.3. Get Certificate Request Template

This PKI management operation can be used by an EE to request a template with parameters for future certificate requests.¶

An EE requests certificate request parameters from the PKI management entity by sending a general message with OID id-it-certReqTemplate as specified in CMP Updates Section 2.15 [I-D.ietf-lamps-cmp-updates]. The EE MAY indicate the certificate profile to use in the id-it-certProfile extension of the generalInfo field in the PKIHeader of the general message as described in Section 3.1. The PKI management entity responds with a general response with the same OID that either contains requirements on the certificate request template, or with no content in case no specific requirements are imposed by the PKI. The CertReqTemplateValue contains requirements on certificate fields and extensions in a certTemplate. Optionally it contains a keySpec field containing requirements on algorithms acceptable for key pair generation.¶

The EE SHOULD follow the requirements from the received CertTemplate, by including in the certificate requests all the fields requested, taking over all the field values provided and filling in any remaining fields values. The EE SHOULD NOT add further fields, name components, and extensions or their (sub-)components.¶

Note: We deliberately do not use "MUST" or "MUST NOT" here in order to allow more flexibility in case the rules given here are not sufficient for specific scenarios. The EE can populate the certificate request as wanted and ignore any of the requirements contained in the CertReqTemplateValue. On the other hand, a PKI management entity is free to ignore or replace any parts of the content of the certificate request provided by the EE. The CertReqTemplate PKI management operation offers means to ease a joint understanding which fields and/or which field values should be used. An example is provided in Appendix A.¶

In case a field of type Name, e.g., subject, is present in the CertTemplate but has the value NULL-DN (i.e., has an empty list of RDN components), the field SHOULD be included in the certificate request and filled with content provided by the EE. Similarly, in case an X.509v3 extension is present but its extnValue is empty, this means that the extension SHOULD be included and filled with content provided by the EE. In case a Name component, for instance a common name or serial number, is given but has an empty string value, the EE SHOULD fill in a value. Similarly, in case an extension has sub-components (e.g., an IP address in a SubjectAltName field) with empty value, the EE SHOULD fill in a value.¶

The EE MUST ignore (i.e., not include and fill in) empty fields, extensions, and sub-components that it does not understand or does not know suitable values to be filled in.¶

The publicKey field of type SubjectPublicKeyInfo in the CertTemplate of the CertReqTemplateValue MUST be omitted. In case the PKI management entity wishes to make stipulation on algorithms the EE may use for key generation, this MUST be specified using the keySpec field as specified in CMP Updates Section 2.15 [I-D.ietf-lamps-cmp-updates].¶

The keySpec field, if present, specifies the public key types optionally with parameters, and/or RSA key lengths for which a certificate may be requested.¶

The value of a keySpec element with the OID id-regCtrl-algId, as specified in CMP Updates Section 2.15 [I-D.ietf-lamps-cmp-updates], MUST be of type AlgorithmIdentifier and give an algorithm other than RSA. For EC keys the curve information MUST be specified as described in the respective standard documents.¶

The value of a keySpec element with the OID id-regCtrl-rsaKeyLen, as specified in CMP Updates Section 2.15 [I-D.ietf-lamps-cmp-updates], MUST be a positive integer value and give an RSA key length.¶

In the CertTemplate of the CertReqTemplateValue the serialNumber, signingAlg, issuerUID, and subjectUID fields MUST be omitted.¶

Specific prerequisites augmenting the prerequisites in Section 3.4:¶

• When using the generalInfo field certProfile, the EE MUST know the identifier needed to indicate the requested certificate profile.¶

The message sequence for this PKI management operation is as given above, with the following specific content:¶

1

the infoType OID to use is id-it-certReqTemplate¶

2

the id-it-certProfile generalInfo field in the header of the request MAY contain the name of the requested certificate request template¶

3

the infoValue of the request MUST be absent¶

4

if present, the infoValue of the response MUST be a CertReqTemplateValue containing a CertTemplate structure and an optional keySpec field¶

Detailed Description of infoValue Field of genp:¶

      InfoValue               OPTIONAL
    -- MUST be absent if no requirements are available
    -- MUST be present if the PKI management entity has any
    -- requirements on the contents of the certificate template
        certTemplate          REQUIRED
    -- MUST be present if infoValue is present
    -- MUST contain the required CertTemplate structure elements
    -- The SubjectPublicKeyInfo field MUST be absent
        keySpec               OPTIONAL
    -- MUST be absent if no requirements on the public key are
    -- available
    -- MUST be present if the PKI management entity has any
    -- requirements on the keys generated
    -- MUST contain one AttributeTypeAndValue per supported
    -- algorithm with attribute id-regCtrl-algId or
    -- id-regCtrl-rsaKeyLen

4.3.4. CRL Update Retrieval

This PKI management operation can be used by an EE to request a new CRL. If a CA offers methods to access a CRL, it may include CRL distribution points or authority information access extensions as specified in RFC 5280 [RFC5280] into the issued certificates. In addition, CMP offers CRL provisioning functionality as part of the PKI management operation.¶

An EE requests a CRL update from the PKI management entity by sending a general message with OID id-it-crlStatusList. The EE MUST include the CRL source identifying the requested CRL and, if available, the thisUpdate time of the most current CRL instance it already has, as specified in CMP Updates Section 2.16 [I-D.ietf-lamps-cmp-updates]. The PKI management entity MUST respond with a general response with OID id-it-crls. If no thisUpdate value was given by the EE, the PKI management entity MUST return the latest CRL available. If a thisUpdate value was given, the PKI management entity MUST return the latest available CRL in case this CRL is more recent, otherwise the infoValue in the response message MUST be absent.¶

The EE MUST identify the requested CRL either by its CRL distribution point name or issuer name. The CRL distribution point name can either be provided form the CRL distribution points extension of the certificate to be validated or from the issuing distribution point extension from the CRL to be updated. If no CRL distribution name is available to identify the CRL, the EE can use the issuer name either from the certificate to be validated or from the CRL to be updated.¶

The PKI management entity SHOULD treat a CRL distribution point name as an internal pointer to identify a CRL for which is available at the PKI management entity directly. It is not intended as a way to fetch an arbitrary CRL from an external location.¶

In addition to the prerequisites specified in Section 3.4, the EE MUST know which CRL to request.¶

Note: If the EE does not want to request a specific CRL it MAY use instead a general message with OID id-it-currentCrl as specified in RFC 4210 Section 5.3.19.6 [RFC4210].¶

The message sequence for this PKI management operation is as given above, with the following specific content:¶

1

the infoType OID to use is id-it-crlStatusList in the request and id-it-crls in the response¶

2

the infoValue of the request MUST be present and contain exactly one CRLStatus structure¶

3

if present, the infoValue of the response MUST contain exactly one CRL¶

Detailed Description of infoValue Field of genm:¶

      CRLSource               REQUIRED
    -- MUST contain exactly one CRLSource structure
    -- MUST contain the dpn choice of type DistributionPointName if
    -- the CRL distribution point name is available
    -- Otherwise, MUST contain the issuer choice identifying the CA
    -- that issues the CRL. It MUST contain the issuer DN in the
    -- directoryName field of a GeneralName element.
      thisUpdate              OPTIONAL
    -- SHOULD contain the thisUpdate field of the latest CRL form
    -- the issuer specified in the given dpn or issuer field,
    -- in case such a CRL is already known by the EE

Detailed Description of infoValue Field of genp:¶

      infoValue               OPTIONAL
    -- MUST be absent if no CRL to be returned is available
    -- MUST contain exactly one CRL update from the referenced
    -- source, if a thisUpdate value was not given or a more recent
    -- CRL is available

5.1.1. Responding to a Certificate Request

An ir/cr/p10cr/kur message is used to request a certificate as described in Section 4.1. The responding PKI management entity MUST proceed as follows unless it initiates delayed delivery as described in Section 5.1.5.¶

The PKI management entity SHOULD check the message body according to the applicable requirements from Section 4.1. Possible failInfo bit values used for error reporting in case a check failed include badCertId and badCertTemplate. It MUST verify the presence and value of the proof-of-possession (failInfo bit: badPOP), unless central key generation is requested. In case the special POP value "raVerified" is given, it SHOULD check that the request message was signed using a certificate containing the cmcRA extended key usage (failInfo bit: notAuthorized). The PKI management entity SHOULD perform also any further checks on the certTemplate contents (failInfo: badCertTemplate) according to any applicable PKI policy and certificate profile.¶

If the requested certificate is available, the PKI management entity MUST respond with a positive ip/cp/kup message as described in Section 4.1.¶

Note: If central key generation is performed by the responding PKI management entity, the responding PKI management entity MUST include in the response the privateKey field as specified in Section 4.1.6. It may have issued the certificate for the newly generated key pair itself if it is a CA, or have requested the certificate on behalf of the EE as described in Section 5.3.1, or have received it by other means from a CA.¶

The prerequisites of the respective PKI management operation as specified in Section 4.1 apply.¶

Note: If the EE requested omission of the certConf message, the PKI management entity SHOULD handle it as described in Section 4.1.1 and therefore MAY grant this by including the implicitConfirm extension in the response header.¶

5.1.2. Responding to a Confirmation Message

A PKI management entity MUST handle a certConf message if it has responded before with a positive ip/cp/kup message not granting implicit confirmation. It SHOULD check the message body according to the requirements given in Section 4.1.1 (failInfo bit: badCertId) and react as described there.¶

The prerequisites of the respective PKI management operation as specified in Section 4.1 apply.¶

5.1.3. Responding to a Revocation Request

An rr message is used to request revocation of a certificate. The responding PKI management entity SHOULD check the message body according to the requirements in Section 4.2. It MUST make sure that the referenced certificate exists (failInfo bit: badCertId), has been issued by the addressed CA, and is not already expired or revoked (failInfo bit: certRevoked). On success it MUST respond with a positive rp message as described in Section 4.2.¶

No specific prerequisites apply in addition to those specified in Section 3.4.¶

5.1.4. Responding to a Support Message

A genm message is used to retrieve extra content. The responding PKI management entity SHOULD check the message body according to the applicable requirements in Section 4.3 and perform any further checks depending on the PKI policy. On success it MUST respond with a genp message as described there.¶

Note: The responding PKI management entity may generate the response from scratch or reuse the contents of previous responses. Therefore, it may be worth caching the body of the response message as long as the contained information is still valid, such that further requests for the same contents can be answered immediately.¶

No specific prerequisites apply in addition to those specified in Section 3.4.¶

5.1.5. Initiating Delayed Delivery

This functional extension can be used by a PKI management entity in case the response to a request takes longer than usual. In this case the PKI management entity MUST completely validate the request as usual and then start preparing the response or forward the request further upstream as soon as possible. In the meantime, it MUST respond with an ip/cp/kup/error message including the status "waiting" and handle subsequent polling as described in Section 4.4.¶

Note: Typically, as stated in Section 5.2.3, an intermediate PKI management entity should not change the sender and recipient nonces even in case it modifies a request or a response message. In the special case of delayed delivery initiated by an intermediate PKI management entity, there is an exception. Between the EE and this PKI management entity, pollReq and pollRep messages are exchanged handling the nonces as usual. Yet when the final response from upstream has arrived at the PKI management entity, this response contains the recipNonce copied (as usual) from the senderNonce in the original request message. The PKI management entity that initiated the delayed delivery may replace the recipNonce in the response message with the senderNonce of the last received pollReq because the downstream entities, including the EE, might expect it in this way. Yet the check specified in Section 3.5 allows to alternatively use the senderNonce of the original request.¶

No specific prerequisites apply in addition to those of the respective PKI management operation.¶

5.2.1. Not Changing Protection

This variant means that a PKI management entity forwards a CMP message without changing the header, body, or protection. In this case the PKI management entity acts more like a proxy, e.g., on a network boundary, implementing no specific RA-like security functionality that requires an authentic indication to the PKI. Still the PKI management entity might implement checks that result in refusing to forward the request message and instead responding as specified in Section 3.6.¶

This variant of forwarding a message or the one described in Section 5.2.2.1 SHOULD be used for kur messages and for central key generation.¶

No specific prerequisites apply in addition to those specified in Section 3.4.¶

5.2.2. Adding Protection and Batching of Messages

This variant of forwarding a message means that a PKI management entity adds another protection to PKI management messages before forwarding them.¶

The nested message is a PKI management message containing a PKIMessages sequence as its body containing one or more CMP messages.¶

As specified in the updated Section 5.1.3.4 of RFC 4210 [RFC4210] (see also CMP Updates Section 2.6 [I-D.ietf-lamps-cmp-updates]) there are various use cases for adding another protection by a PKI management entity. Specific procedures are described in more detail in the following sections.¶

Detailed Message Description:¶

Nested Message - nested

Field                         Value

header
    -- As described in Section 3.1

body
    -- Container to provide additional protection to original
    -- messages and to bundle request messages or alternatively
    -- response messages
  PKIMessages                 REQUIRED
    -- MUST be a sequence of one or more CMP messages

protection                    REQUIRED
    -- As described in Section 3.2 using the CMP protection key of
    -- the PKI management entity

extraCerts                    REQUIRED
    -- As described in Section 3.3

Step# PKI management entity               PKI management entity
 1   format nested
 2                      ->  nested   ->
 3                                        handle or forward nested
 4                                        format or receive response
 5                      <-  response <-
 6   forward response

Step# PKI management entity               PKI management entity
 1   format nested
 2                      ->  nested   ->
 3                                        handle or forward nested
 4                                        format or receive nested
 5                      <-  nested   <-
 6   handle nested

5.2.3. Replacing Protection

The following two alternatives can be used by any PKI management entity forwarding a CMP message with or without changes while providing its own protection and in this way asserting approval of the message.¶

By replacing the existing protection using its own CMP protection key the PKI management entity provides a proof of verifying and approving the message as described above. Thus, the PKI management entity acts as an actual Registration Authority (RA), which implements important security functionality of the PKI.¶

Before replacing the existing protection by a new protection, the PKI management entity MUST verify the protection provided and approve its content, including any modifications that it may perform. It MUST also check that the sender, as authenticated by the message protection, is authorized for the given operation.¶

These message adaptations MUST NOT be applied to kur messages described in Section 4.1.3 since their original protection using the key and certificate to be updated needs to be preserved, unless the regCtrl OldCertId is used to strongly identify the certificate to be updated.¶

These message adaptations MUST NOT be applied to certificate request messages described in for central key generation Section 4.1.6 since their original protection needs to be preserved up to the Key Generation Authority, which needs to use it for encrypting the new private key for the EE.¶

In both the kur and central key generation cases, if a PKI management entity needs to state its approval of the original request message it MUST provide this using a nested message as specified in Section 5.2.2.1.¶

When an intermediate PKI management entity modifies a message, it SHOULD NOT change the transactionID nor the sender and recipient nonces.¶

    popo
      raVerified              REQUIRED
    -- MUST have the value NULL and indicates that the PKI
    -- management entity verified the popo of the original message

5.3.1. Requesting a Certificate

A PKI management entity may use on of the PKI management operations described in Section 4.1 to request a certificate on behalf of another PKI entity. It either generates the key pair itself and inserts the new public key in the subjectPublicKey field of the request certTemplate, or it uses a certificate request received from downstream, e.g., by means of a different protocol. In the latter case it SHOULD verify the received proof-of-possession.¶

No specific prerequisites apply in addition to those specified in Section 4.1.¶

Note: An upstream PKI management entity will not be able to differentiate this PKI management operation from the one described in Section 5.2.3 because in both cases the message is protected by the PKI management entity.¶

The message sequence for this PKI management operation is identical to the respective PKI management operation given in Section 4.1, with the following changes:¶

1

The request messages MUST be signed using the CMP protection key of the PKI management entity taking the role of the EE in this operation.¶

2

If inclusion of a proper proof-of-possession is not possible the PKI management entity MUST verify the POP provided from downstream and use "raVerified" in its upstream request.¶

5.3.2. Revoking a Certificate

A PKI management entity may use the PKI management operation described in Section 4.2 to revoke a certificate of another PKI entity. This revocation request message MUST be signed by the PKI management entity using its own CMP protection key to prove to the PKI authorization to revoke the certificate on behalf of that PKI entity.¶

No specific prerequisites apply in addition to those specified in Section 4.2.¶

Note: An upstream PKI management entity will not be able to differentiate this PKI management operation from the ones described in Section 5.2.3.¶

The message sequence for this PKI management operation is identical to that given in Section 4.2, with the following changes:¶

1

The rr message MUST be signed using the CMP protection key of the PKI management entity acting on behalf of the EE in this operation.¶

6.4.1. File-Based Transfer

CMP messages MAY be transferred between PKI entities using file-based mechanisms, for instance when an offline EE or a PKI management entity performs delayed delivery. Each file MUST contain the ASN.1 DER encoding of one CMP message only, where the message may be nested. There MUST be no extraneous header or trailer information in the file. The file name extension ".pki" MUST be used.¶

6.4.2. Other Asynchronous Transfer Protocols

Other asynchronous transfer protocols, e.g., email or website up-/download, MAY transfer CMP messages between PKI entities. A MIME wrapping is defined for those environments that are MIME-native. The MIME wrapping in this section is specified in RFC 8551 Section 3.1 [RFC8551].¶

The ASN.1 DER encoding of the CMP messages MUST be transferred using the "application/pkixcmp" content type and base64-encoded content transfer encoding as specified in RFC 2510 Section 5.3 [RFC2510]. A filename MUST be included either in a "content-type" or a "content-disposition" statement. The file name extension ".pki" MUST be used.¶