Network Working Group D. Eastlake 3rd
Request for Comments: 4051 Motorola Laboratories
Category: Standards Track April 2005
Additional XML Security Uniform Resource Identifiers (URIs)
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2005).
Abstract
A number of Uniform Resource Identifiers (URIs) intended for use with
XML Digital Signatures, Encryption, and Canonicalization are defined.
These URIs identify algorithms and types of keying information.
Table of Contents
1. Introduction.................................................. 2
2. Algorithms.................................................... 3
2.1. DigestMethod Algorithms................................. 3
2.1.1. MD5............................................. 3
2.1.2. SHA-224......................................... 3
2.1.3. SHA-384......................................... 4
2.2. SignatureMethod Message Authentication Code Algorithms.. 4
2.2.1. HMAC-MD5........................................ 4
2.2.2. HMAC SHA Variations............................. 5
2.2.3. HMAC-RIPEMD160.................................. 6
2.3. SignatureMethod Public Key Signature Algorithms......... 6
2.3.1. RSA-MD5......................................... 6
2.3.2. RSA-SHA256...................................... 7
2.3.3. RSA-SHA384...................................... 7
2.3.4. RSA-SHA512...................................... 7
2.3.5. RSA-RIPEMD160................................... 8
2.3.6. ECDSA-SHA*...................................... 8
2.3.7. ESIGN-SHA1...................................... 8
2.4. Minimal Canonicalization................................ 9
2.5. Transform Algorithms.................................... 9
2.5.1. XPointer........................................ 9
Eastlake 3rd Standards Track [Page 1]
RFC 4051 Additional XML Security URIs April 2005
2.6. EncryptionMethod Algorithms............................. 10
2.6.1. ARCFOUR Encryption Algorithm.................... 10
2.6.2. Camellia Block Encryption....................... 10
2.6.3. Camellia Key Wrap............................... 11
2.6.4. PSEC-KEM........................................ 11
3. KeyInfo....................................................... 12
3.1. PKCS #7 Bag of Certificates and CRLs.................... 12
3.2. Additional RetrievalMethod Type Values.................. 12
4. IANA Considerations........................................... 13
5. Security Considerations....................................... 13
Acknowledgements.................................................. 13
Normative References.............................................. 13
Informative References............................................ 15
Author's Address.................................................. 16
Full Copyright Statement.......................................... 17
1. Introduction
XML Digital Signatures, Canonicalization, and Encryption have been
standardized by the W3C and the joint IETF/W3C XMLDSIG working group.
All of these are now W3C Recommendations and IETF Informational or
Standards Track documents. They are available as follows:
IETF level W3C REC Topic
----------- ------- -----
[RFC3275] Draft Std [XMLDSIG] XML Digital Signatures
[RFC3076] Info [CANON] Canonical XML
- - - - - - [XMLENC] XML Encryption
[RFC3741] Info [EXCANON] Exclusive XML Canonicalization
All of these standards and recommendations use URIs [RFC2396] to
identify algorithms and keying information types. This document
provides a convenient reference list of URIs and descriptions for
algorithms in which there is substantial interest, but which cannot
or have not been included in the main documents. Note that raising
XML digital signature to a Draft Standard in the IETF required
removal of any algorithms for which interoperability from the main
standards document has not been demonstrated. This required removal
of the Minimal Canonicalization algorithm, in which there appears to
be a continued interest, to be dropped from the standards track
specification. It is included here.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
Eastlake 3rd Standards Track [Page 2]
RFC 4051 Additional XML Security URIs April 2005
2. Algorithms
The URI [RFC2396] being dropped from the standard because of the
transition from Proposed Standard to Draft Standard is included in
Section 2.4 with its original prefix so as to avoid changing the
XMLDSIG standard's namespace.
http://www.w3.org/2000/09/xmldsig#
Additional algorithms are given URIs that start with:
http://www.w3.org/2001/04/xmldsig-more#
An "xmldsig-more" URI does not imply any official W3C status for
these algorithms or identifiers or that they are only useful in
digital signatures. Currently, dereferencing such URIs may or may
not produce a temporary placeholder document. Permission to use this
URI prefix has been given by the W3C.
2.1. DigestMethod Algorithms
These algorithms are usable wherever a DigestMethod element occurs.
2.1.1. MD5
Identifier:
http://www.w3.org/2001/04/xmldsig-more#md5
The MD5 algorithm [RFC1321] takes no explicit parameters. An example
of an MD5 DigestAlgorithm element is:
112
The output of the HMAC algorithm is ultimately the output (possibly
truncated) of the chosen digest algorithm. This value shall be
base64 [RFC2405] encoded in the same straightforward fashion as the
output of the digest algorithms. For example, the SignatureValue
element for the HMAC-MD5 digest
9294727A 3638BB1C 13F48EF8 158BFC9D
from the test vectors in [RFC2104] would be
kpRyejY4uxwT9I74FYv8nQ==
Schema Definition:
DTD:
The Schema Definition and DTD immediately shown above are taken from
[RFC3275].
Although some cryptographic suspicions have recently been cast on MD5
for use in signatures such as RSA-MD5 below, this does not effect use
of MD5 in HMAC.
2.2.2. HMAC SHA Variations
Identifiers:
http://www.w3.org/2001/04/xmldsig-more#hmac-sha224
http://www.w3.org/2001/04/xmldsig-more#hmac-sha256
http://www.w3.org/2001/04/xmldsig-more#hmac-sha384
http://www.w3.org/2001/04/xmldsig-more#hmac-sha512
SHA-224, SHA-256, SHA-384, and SHA-512 [FIPS-180-2, FIPS-180-2change,
RFC3874] can also be used in HMAC as described in section 2.2.1 for
HMAC-MD5.
Eastlake 3rd Standards Track [Page 5]
RFC 4051 Additional XML Security URIs April 2005
2.2.3. HMAC-RIPEMD160
Identifier:
http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160
RIPEMD-160 [RIPEMD-160] can also be used in HMAC as described in
section 2.2.1 for HMAC-MD5.
2.3. SignatureMethod Public Key Signature Algorithms
These algorithms are distinguished from those in Section 2.2 in that
they use public key methods. The verification key is different from
and not feasibly derivable from the signing key.
2.3.1. RSA-MD5
Identifier:
http://www.w3.org/2001/04/xmldsig-more#rsa-md5
RSA-MD5 implies the PKCS#1 v1.5 padding algorithm described in
[RFC3447]. An example of use is
xpointer(id("foo")) xmlns(bar=http://foobar.example)
xpointer(//bar:Zab[@Id="foo"])
Schema Definition:
DTD:
Input to this transform is an octet stream (which is then parsed into
XML).
Eastlake 3rd Standards Track [Page 9]
RFC 4051 Additional XML Security URIs April 2005
Output from this transform is a node set; the results of the XPointer
are processed as defined in the XMLDSIG specification [RFC3275] for a
same document XPointer.
2.6. EncryptionMethod Algorithms
This subsection gives identifiers and information for several
EncryptionMethod Algorithms.
2.6.1. ARCFOUR Encryption Algorithm
Identifier:
http://www.w3.org/2001/04/xmldsig-more#arcfour
ARCFOUR is a fast, simple stream encryption algorithm that is
compatible with RSA Security's RC4 algorithm. An example of the
EncryptionMethod element using ARCFOUR is
40
Note that Arcfour makes use of the generic KeySize parameter
specified and defined in [XMLENC].
2.6.2. Camellia Block Encryption
Identifiers:
http://www.w3.org/2001/04/xmldsig-more#camellia128-cbc
http://www.w3.org/2001/04/xmldsig-more#camellia192-cbc
http://www.w3.org/2001/04/xmldsig-more#camellia256-cbc
Camellia is an efficient and secure block cipher with the same
interface as the AES [Camellia, RFC3713], that is 128-bit block size
and 128, 192, and 256 bit key sizes. In XML Encryption, Camellia is
used in the same way as the AES: It is used in the Cipher Block
Chaining (CBC) mode with a 128-bit initialization vector (IV). The
resulting cipher text is prefixed by the IV. If included in XML
output, it is then base64 encoded. An example Camellia
EncryptionMethod is as follows:
version
id
curve
order
cofactor
Eastlake 3rd Standards Track [Page 11]
RFC 4051 Additional XML Security URIs April 2005
See [ISO/IEC-18033-2] for information on the parameters above.
3. KeyInfo
In section 3.1 a new KeyInfo element child is specified, while in
section 3.2 additional KeyInfo Type values for use in RetrievalMethod
are specified.
3.1. PKCS #7 Bag of Certificates and CRLs
A PKCS #7 [RFC2315] "signedData" can also be used as a bag of
certificates and/or certificate revocation lists (CRLs). The
PKCS7signedData element is defined to accommodate such structures
within KeyInfo. The binary PKCS #7 structure is base64 [RFC2405]
encoded. Any signer information present is ignored. The following
is an example, eliding the base64 data [RFC3092]:
...
3.2. Additional RetrievalMethod Type Values
The Type attribute of RetrievalMethod is an optional identifier for
the type of data to be retrieved. The result of dereferencing a
RetrievalMethod reference for all KeyInfo types with an XML structure
is an XML element or document with that element as the root. The
various "raw" key information types return a binary value. Thus,
they require a Type attribute because they are not unambiguously
parseable.
Identifiers:
http://www.w3.org/2001/04/xmldsig-more#KeyValue
http://www.w3.org/2001/04/xmldsig-more#RetrievalMethod
http://www.w3.org/2001/04/xmldsig-more#KeyName
http://www.w3.org/2001/04/xmldsig-more#rawX509CRL
http://www.w3.org/2001/04/xmldsig-more#rawPGPKeyPacket
http://www.w3.org/2001/04/xmldsig-more#rawSPKISexp
http://www.w3.org/2001/04/xmldsig-more#PKCS7signedData
http://www.w3.org/2001/04/xmldsig-more#rawPKCS7signedData
Eastlake 3rd Standards Track [Page 12]
RFC 4051 Additional XML Security URIs April 2005
4. IANA Considerations
As it is easy for people to construct their own unique URIs [RFC2396]
and possibly obtain a URI from the W3C if appropriate, it is not
intended that any additional "http://www.w3.org/2001/04/xmldsig-
more#" URIs be created beyond those enumerated in this document.
(W3C Namespace stability rules prohibit the creation of new URIs
under "http://www.w3.org/2000/09/xmldsig#".)
5. Security Considerations
Due to computer speed and cryptographic advances, the use of MD5 as a
DigestMethod and the use of MD5 in the RSA-MD5 SignatureMethod is NOT
RECOMMENDED. The concerned cryptographic advances do not effect the
security of HMAC-MD5; however, there is little reason not to use one
of the SHA series of algorithms.
Acknowledgements
Glenn Adams, Merlin Hughs, Gregor Karlinger, Brian LaMachia, Shiho
Moriai, Joseph Reagle, Russ Housley, and Joel Halpern.
Normative References
[Camellia] "Camellia: A 128-bit Block Cipher Suitable for
Multiple Platforms - Design and Analysis -", K.
Aoki, T. Ichikawa, M. Matsui, S. Moriai, J.
Nakajima, T. Tokita, In Selected Areas in
Cryptography, 7th Annual International Workshop,
SAC 2000, August 2000, Proceedings, Lecture Notes
in Computer Science 2012, pp. 39-56, Springer-
Verlag, 2001.
[ECDSA] Blake-Wilson, S., Karlinger, G., Kobayashi, T.,
and Y. Wang, "Using the Elliptic Curve Signature
Algorithm (ECDSA) for XML Digital Signatures", RFC
4050, April 2005.
[FIPS-180-2] "Secure Hash Standard", (SHA-1/256/384/512) US
Federal Information Processing Standard, 1 August
2002.
[FIPS-180-2change] "FIPS 180-2, Secure Hash Standard Change Notice
1", adds SHA-224 to [FIPS 180-2], 25 February
2004.
[FIPS-186-2] "Digital Signature Standard", National Institute
of Standards and Technology, 2000.
Eastlake 3rd Standards Track [Page 13]
RFC 4051 Additional XML Security URIs April 2005
[IEEE-P1363a] "Standard Specifications for Public Key
Cryptography: Additional Techniques", October
2002.
[ISO/IEC-18033-2] "Information technology -- Security techniques --
Encryption algorithms -- Part 3: Asymmetric
ciphers", CD, October 2002.
[RFC1321] Rivest, R., "The MD5 Message-Digest Algorithm ",
RFC 1321, April 1992.
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC:
Keyed-Hashing for Message Authentication", RFC
2104, February 1997.
[RFC2119] Bradner, S., "Key words for use in RFCs to
Indicate Requirement Levels", BCP 14, RFC 2119,
March 1997.
[RFC2396] Berners-Lee, T., Fielding, R., and L. Masinter,
"Uniform Resource Identifiers (URI): Generic
Syntax", RFC 2396, August 1998.
[RFC2405] Madson, C. and N. Doraswamy, "The ESP DES-CBC
Cipher Algorithm With Explicit IV", RFC 2405,
November 1998.
[RFC2315] Kaliski, B., "PKCS #7: Cryptographic Message
Syntax Version 1.5", RFC 2315, March 1998.
[RFC3075] Eastlake 3rd, D., Reagle, J., and D. Solo, "XML-
Signature Syntax and Processing", RFC 3075, March
2001. (RFC 3075 was obsoleted by RFC 3275 but is
referenced in this document for its description of
Minimal Canonicalization which was dropped in RFC
3275.)
[RFC3275] Eastlake 3rd, D., Reagle, J., and D. Solo,
"(Extensible Markup Language) XML-Signature Syntax
and Processing", RFC 3275, March 2002.
[RFC3394] Schaad, J. and R. Housley, "Advanced Encryption
Standard (AES) Key Wrap Algorithm", RFC 3394,
September 2002.
Eastlake 3rd Standards Track [Page 14]
RFC 4051 Additional XML Security URIs April 2005
[RFC3447] Jonsson, J. and B. Kaliski, "Public-Key
Cryptography Standards (PKCS) #1: RSA Cryptography
Specifications Version 2.1", RFC 3447, February
2003.
[RFC3713] Matsui, M., Nakajima, J., and S. Moriai, "A
Description of the Camellia Encryption Algorithm",
RFC 3713, April 2004.
[RFC3874] Housley, R., "A 224-bit One-way Hash Function:
SHA-224", RFC 3874, September 2004.
[RIPEMD-160] ISO/IEC 10118-3:1998, "Information Technology -
Security techniques - Hash-functions - Part3:
Dedicated hash- functions", ISO, 1998.
[X9.62] X9.62-200X, "Public Key Cryptography for the
Financial Services Industry: The Elliptic Curve
Digital Signature Algorithm (ECDSA)", Accredited
Standards Committee X9, American National
Standards Institute.
[XMLDSIG] "XML-Signature Syntax and Processing", D. Eastlake
3rd, J. Reagle, & D. Solo, 12 February 2002.
Informative References
[CANON] "Canonical XML Version 1.0", John Boyer.
.
[EXCANON] "Exclusive XML Canonicalization Version 1.0", D.
Eastlake, J. Reagle, 18 July 2002.
RFC, FYI, BCP