keyprov P. Hoyer Internet-Draft ActivIdentity Intended status: Standards Track M. Pei Expires: July 9, 2010 VeriSign S. Machani Diversinet January 5, 2010 Portable Symmetric Key Container (PSKC) draft-ietf-keyprov-pskc-05 Status of this Memo This Internet-Draft is submitted to IETF in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on July 9, 2010. Copyright Notice Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents in effect on the date of publication of this document (http://trustee.ietf.org/license-info). Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Hoyer, et al. Expires July 9, 2010 [Page 1] Internet-Draft Portable Symmetric Key Container (PSKC) January 2010 Abstract This document specifies a symmetric key format for transport and provisioning of symmetric keys to different types of crypto modules. For example, One Time Password (OTP) shared secrets or symmetric cryptographic keys to strong authentication devices. A standard key transport format enables enterprises to deploy best-of-breed solutions combining components from different vendors into the same infrastructure. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.1. Key Words . . . . . . . . . . . . . . . . . . . . . . . . 4 1.2. Versions . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.3. Namespace Identifiers . . . . . . . . . . . . . . . . . . 4 1.3.1. Defined Identifiers . . . . . . . . . . . . . . . . . 4 1.3.2. Referenced Identifiers . . . . . . . . . . . . . . . . 5 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 6 3. Portable Key Container Entities Overview and Relationships . . 7 4. Element: The Basics . . . . . . . . . . . . . . 9 4.1. : Embedding Keying Material and Key Related Information . . . . . . . . . . . . . . . . . . . . . . . 9 4.2. Transmission of supplementary Information . . . . . . . . 11 4.2.1. Element: Unique Device Identification . . 12 4.2.2. Element: CryptoModule Identification . . . . . . . . . . . . . . . . . . . . 13 4.2.3. Element: User Identification . . . . . . . . 14 4.2.4. Element: Supplementary Information for OTP and CR Algorithms . . . . . . . . 14 4.3. Transmission of Key Derivation Values . . . . . . . . . . 16 5. Key Policy . . . . . . . . . . . . . . . . . . . . . . . . . . 18 6. Key Protection Methods . . . . . . . . . . . . . . . . . . . . 23 6.1. Encryption based on Pre-Shared Keys . . . . . . . . . . . 23 6.1.1. MAC Method . . . . . . . . . . . . . . . . . . . . . . 25 6.2. Encryption based on Passphrase-based Keys . . . . . . . . 26 6.3. Encryption based on Asymmetric Keys . . . . . . . . . . . 29 6.4. Padding of Encrypted Values for Non-Padded Encryption Algorithms . . . . . . . . . . . . . . . . . . . . . . . . 30 7. Digital Signature . . . . . . . . . . . . . . . . . . . . . . 31 8. Bulk Provisioning . . . . . . . . . . . . . . . . . . . . . . 33 9. Extensibility . . . . . . . . . . . . . . . . . . . . . . . . 36 10. PSKC Algorithm Profile . . . . . . . . . . . . . . . . . . . . 37 10.1. HOTP . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 10.2. KEYPROV-PIN . . . . . . . . . . . . . . . . . . . . . . . 37 11. XML Schema . . . . . . . . . . . . . . . . . . . . . . . . . . 39 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 46 Hoyer, et al. Expires July 9, 2010 [Page 2] Internet-Draft Portable Symmetric Key Container (PSKC) January 2010 12.1. Content-type registration for 'application/pskc+xml' . . . 46 12.2. XML Schema Registration . . . . . . . . . . . . . . . . . 47 12.3. URN Sub-Namespace Registration . . . . . . . . . . . . . . 47 12.4. PSKC Algorithm Profile Registry . . . . . . . . . . . . . 48 12.5. PSKC Version Registry . . . . . . . . . . . . . . . . . . 49 12.6. Key Usage Registry . . . . . . . . . . . . . . . . . . . . 49 13. Security Considerations . . . . . . . . . . . . . . . . . . . 51 13.1. Payload Confidentiality . . . . . . . . . . . . . . . . . 51 13.2. Payload Integrity . . . . . . . . . . . . . . . . . . . . 52 13.3. Payload Authenticity . . . . . . . . . . . . . . . . . . . 52 14. Contributors . . . . . . . . . . . . . . . . . . . . . . . . . 53 15. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 54 16. References . . . . . . . . . . . . . . . . . . . . . . . . . . 55 16.1. Normative References . . . . . . . . . . . . . . . . . . . 55 16.2. Informative References . . . . . . . . . . . . . . . . . . 55 Appendix A. Use Cases . . . . . . . . . . . . . . . . . . . . . . 57 A.1. Online Use Cases . . . . . . . . . . . . . . . . . . . . . 57 A.1.1. Transport of keys from Server to Cryptographic Module . . . . . . . . . . . . . . . . . . . . . . . . 57 A.1.2. Transport of keys from Cryptographic Module to Cryptographic Module . . . . . . . . . . . . . . . . . 57 A.1.3. Transport of keys from Cryptographic Module to Server . . . . . . . . . . . . . . . . . . . . . . . . 58 A.1.4. Server to server Bulk import/export of keys . . . . . 58 A.2. Offline Use Cases . . . . . . . . . . . . . . . . . . . . 58 A.2.1. Server to server Bulk import/export of keys . . . . . 58 Appendix B. Requirements . . . . . . . . . . . . . . . . . . . . 60 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 62 Hoyer, et al. Expires July 9, 2010 [Page 3] Internet-Draft Portable Symmetric Key Container (PSKC) January 2010 1. Introduction With increasing use of symmetric key based systems, such as encryption of data at rest, or systems used for strong authentication, such as those based on one-time-password (OTP) and challenge response (CR) mechanisms, there is a need for vendor interoperability and a standard format for importing and exporting (provisioning) symmetric keys. For instance, traditionally, vendors of authentication servers and service providers have used proprietary formats for importing and exporting these keys into their systems, thus making it hard to use tokens from two different vendors. This document defines a standardized XML-based key container, called Portable Symmetric Key Container (PSKC), for transporting symmetric keys and key related meta data. The document also specifies the information elements that are required when the symmetric key is utilized for specific purposes, such as the initial counter in the MAC-Based One Time Password (HOTP) [HOTP] algorithm. It also requests the creation of an IANA registry for algorithm profiles where algorithms, their meta-data and PSKC transmission profile can be recorded for centralised standardised reference. 1.1. Key Words The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 1.2. Versions There is a provision made in the syntax for an explicit version number. Only version "1.0" is currently specified. 1.3. Namespace Identifiers This document uses Uniform Resource Identifiers [RFC3986] to identify resources, algorithms, and semantics. 1.3.1. Defined Identifiers The XML namespace [XMLNS] URI for Version 1.0 of PSKC is: xmlns:pskc="urn:ietf:params:xml:ns:keyprov:pskc" References to qualified elements in the PSKC schema defined herein use the prefix "pskc". Hoyer, et al. Expires July 9, 2010 [Page 4] Internet-Draft Portable Symmetric Key Container (PSKC) January 2010 1.3.2. Referenced Identifiers The PSKC syntax presented in this document relies on algorithm identifiers and elements defined in the XML Signature [XMLDSIG] namespace: xmlns:ds="http://www.w3.org/2000/09/xmldsig#" References to the XML Signature namespace are represented by the prefix "ds". PSKC also relies on algorithm identifiers and elements defined in the XML Encryption [XMLENC] namespace: xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" References to the XML Encryption namespace are represented by the prefix "xenc". When protecting keys in transport with passphrase-based keys, PSKC also relies on the derived key element defined in the XML Encryption Version 1.1 [XMLENC11] namespace: xmlns:xenc11="http://www.w3.org/2009/xmlenc11#"" References to the XML Encryption Version 1.1 namespace are represented by the prefix "xenc11". When protecting keys in transport with passphrase-based keys, PSKC also relies on algorithm identifiers and elements defined in the PKCS#5 [PKCS5] namespace: xmlns:pkcs5= "http://www.rsasecurity.com/rsalabs/pkcs/schemas/pkcs-5v2-0#" References to the PKCS#5 namespace are represented by the prefix "pkcs5". Hoyer, et al. Expires July 9, 2010 [Page 5] Internet-Draft Portable Symmetric Key Container (PSKC) January 2010 2. Terminology NOTE: In subsequent sections of the document we highlight **mandatory** XML elements and attributes. Optional elements and attributes are not explicitly indicated, i.e., if it does not say mandatory it is optional. Hoyer, et al. Expires July 9, 2010 [Page 6] Internet-Draft Portable Symmetric Key Container (PSKC) January 2010 3. Portable Key Container Entities Overview and Relationships The portable key container is based on an XML schema definition and contains the following main conceptual entities: 1. KeyContainer entity - representing the container that carries a number of KeyPackages 2. KeyPackage entity - representing the package of at most one key and its related provisioning endpoint or current usage endpoint, such as a physical or virtual device and a specific CryptoModule 3. DeviceInfo entity - representing the information about the device and criteria to uniquely identify the device 4. CryptoModuleInfo entity - representing the information about the CryptoModule where the keys reside or are provisioned to 5. Key entity - representing the key transported or provisioned 6. Data entity - representing a list of meta-data related to the key, where the element name is the name of the meta-data and its associated value is either in encrypted form (for example for Data element ) or plaintext (for example the Data element ) Figure 1 shows the high-level structure of the PSKC data elements. Hoyer, et al. Expires July 9, 2010 [Page 7] Internet-Draft Portable Symmetric Key Container (PSKC) January 2010 ----------------- | KeyContainer | |---------------| | EncryptionKey | | Signature | | ... | ----------------- | | /|\ 1..n ---------------- ---------------- | KeyPackage | 0..1| DeviceInfo | |--------------|--------|--------------| | |-- | SerialNumber | ---------------- | | Manufacturer | | | | .... | | | ---------------- /|\ 0..1 | ---------------- | -------------------- | Key | | 0..1| CryptoModuleInfo | |--------------| -----|------------------| | Id | | Id | | Algorithm | |.... | | UserId | -------------------- | Policy | | .... | ---------------- | | /|\ 0..n --------------------------------------- - - | | | ------------------ ---------------- -------- - - | Data:Secret | | Data:Counter | | Data:other |----------------| |--------------| |-- - - | EncryptedValue | | PlainValue | | ValueMAC | ---------------- ------------------ Figure 1: PSKC data elements relationship diagram The following sections describe in detail all the entities and related XML schema elements and attributes. Hoyer, et al. Expires July 9, 2010 [Page 8] Internet-Draft Portable Symmetric Key Container (PSKC) January 2010 4. Element: The Basics In its most basic form, a PSKC document uses the top-level element and a single element to carry key information. The following example shows such a simple PSKC document. We will use it to describe the structure of the element and its child elements. Issuer-A MTIzNA== Figure 2: Basic PSKC Key Container Example The attributes of the element have the following semantics: 'Version:' The 'Version' attribute is used to identify the version of the PSKC schema version. This specification defines the initial version ("1.0") of the PSKC schema. This attribute MUST be included. 'Id:' The 'Id' attribute carries a unique identifier for the container. As such, it helps to identify a specific key container in cases when multiple containers are embedded in larger xml documents. 4.1. : Embedding Keying Material and Key Related Information The following attributes of the element MUST be included at a minimum: Hoyer, et al. Expires July 9, 2010 [Page 9] Internet-Draft Portable Symmetric Key Container (PSKC) January 2010 'Id': This attribute carries a globally unique identifier for the symmetric key. The identifier is defined as a string of alphanumeric characters. 'Algorithm': This attribute contains a unique identifier for the PSKC algorithm profile. This profile associates specific semantics to the elements and attributes contained in the element. This document describes profiles for open standards algorithms in Section 10. Additional profiles are defined in the following information draft [PSKC-ALGORITHM-PROFILES]. The element has a number of optional child elements. An initial set is described below: : This element represents the name of the party that issued the key. For example, a bank "Foobar Bank Inc." issuing hardware tokens to their retail banking users may set this element to "Foobar Bank Inc.". : A human readable name for the secret key for easier reference. This element serves informational purposes only. : This element carries parameters that influence the result of the algorithmic computation, for example response truncation and format in OTP and CR algorithms. A more detailed discussion of the element can be found in Section 4.2.4. : This element carries data about and related to the key. The following child elements are defined for the element: : This element carries the value of the key itself in a binary representation. : This element contains the event counter for event based OTP algorithms.