Network Working Group J. Schaad
Request for Comments: 5035 Soaring Hawk Consulting
Updates: 2634 August 2007
Category: Standards Track
Network Working Group J. Schaad
Request for Comments: 5035 Soaring Hawk Consulting
Updates: 2634 August 2007
Category: Standards Track
Enhanced Security Services (ESS) Update: Adding CertID Algorithm Agility
增强安全服务（ESS）更新：增加CertID算法灵活性
Status of This Memo
关于下段备忘
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
本文件规定了互联网社区的互联网标准跟踪协议，并要求进行讨论和提出改进建议。有关本协议的标准化状态和状态，请参考当前版本的“互联网官方协议标准”（STD 1）。本备忘录的分发不受限制。
Abstract
摘要
In the original Enhanced Security Services for S/MIME document (RFC 2634), a structure for cryptographically linking the certificate to be used in validation with the signature was introduced; this structure was hardwired to use SHA-1. This document allows for the structure to have algorithm agility and defines a new attribute for this purpose.
在原始的S/MIME增强安全服务文档（RFC 2634）中，引入了一种将验证中使用的证书与签名进行加密链接的结构；该结构采用SHA-1硬接线。本文档允许结构具有算法灵活性，并为此定义了一个新属性。
Table of Contents
目录
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Notation . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2. Updates to RFC 2634 . . . . . . . . . . . . . . . . . . . 2
2. Replace Section 5.4 'Signing Certificate Attribute
Definitions' . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Insert New Section 5.4.1 'Signing Certificate Attribute
Definition Version 2' . . . . . . . . . . . . . . . . . . . . 4
4. Insert New Section 5.4.1.1 'Certificate Identification
Version 2' . . . . . . . . . . . . . . . . . . . . . . . . . . 5
5. Insert New Section 5.4.2 'Signing Certificate Attribute
Definition Version 1' . . . . . . . . . . . . . . . . . . . . 7
6. Insert New Section 5.4.2.1 'Certificate Identification
Version 1' . . . . . . . . . . . . . . . . . . . . . . . . . . 8
7. Security Considerations . . . . . . . . . . . . . . . . . . . 9
8. Normative References . . . . . . . . . . . . . . . . . . . . . 10
Appendix A. ASN.1 Module . . . . . . . . . . . . . . . . . . . . 11
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Notation . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2. Updates to RFC 2634 . . . . . . . . . . . . . . . . . . . 2
2. Replace Section 5.4 'Signing Certificate Attribute
Definitions' . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Insert New Section 5.4.1 'Signing Certificate Attribute
Definition Version 2' . . . . . . . . . . . . . . . . . . . . 4
4. Insert New Section 5.4.1.1 'Certificate Identification
Version 2' . . . . . . . . . . . . . . . . . . . . . . . . . . 5
5. Insert New Section 5.4.2 'Signing Certificate Attribute
Definition Version 1' . . . . . . . . . . . . . . . . . . . . 7
6. Insert New Section 5.4.2.1 'Certificate Identification
Version 1' . . . . . . . . . . . . . . . . . . . . . . . . . . 8
7. Security Considerations . . . . . . . . . . . . . . . . . . . 9
8. Normative References . . . . . . . . . . . . . . . . . . . . . 10
Appendix A. ASN.1 Module . . . . . . . . . . . . . . . . . . . . 11
In the original Enhanced Security Services (ESS) for S/MIME document [ESS], a structure for cryptographically linking the certificate to be used in validation with the signature was defined. This structure, called ESSCertID, identifies a certificate by its hash. The structure is hardwired to use a SHA-1 hash value. The recent attacks on SHA-1 require that we define a new attribute that allows for the use of different algorithms. This document performs that task.
在针对S/MIME文档[ESS]的原始增强安全服务（ESS）中，定义了一种将验证中使用的证书与签名进行加密链接的结构。此结构称为ESSCertID，通过散列来标识证书。该结构通过硬连线使用SHA-1散列值。最近对SHA-1的攻击要求我们定义一个允许使用不同算法的新属性。本文档执行该任务。
This document defines the structure ESSCertIDv2 along with a new attribute SigningCertificateV2, which uses the updated structure. This document allows for the structure to have algorithm agility by including an algorithm identifier and defines a new signed attribute to use the new structure.
本文档定义了结构EssCertedv2以及一个新属性SigningCertificateV2，该属性使用更新的结构。本文档通过包含一个算法标识符并定义一个新的签名属性来使用新的结构，从而允许该结构具有算法灵活性。
This document specifies the continued use of ESSCertID to ensure compatibility when SHA-1 is used for certificate disambiguation.
本文件规定了在使用SHA-1消除证书歧义时，继续使用ESSCertID以确保兼容性。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照[RFC2119]中所述进行解释。
This document updates Section 5.4 of RFC 2634. Once the updates are applied, the revised section will have the following structure:
本文件更新了RFC 2634第5.4节。应用更新后，修订部分将具有以下结构：
5.4 Signing Certificate Attribute Definitions
5.4 签名证书属性定义
5.4.1 Signing Certificate Attribute Definition Version 2
5.4.1 签名证书属性定义版本2
5.4.1.1 Certificate Identification Version 2
5.4.1.1 证书标识版本2
5.4.2 Signing Certificate Attribute Definition Version 1
5.4.2 签名证书属性定义版本1
5.4.2.1 Certificate Identification Version 1
5.4.2.1 证书标识版本1
In addition, the ASN.1 module in Appendix A is replaced.
此外，附录A中的ASN.1模块被替换。
5.4 Signing Certificate Attribute Definitions
5.4 签名证书属性定义
The signing certificate attribute is designed to prevent simple substitution and re-issue attacks, and to allow for a restricted set of certificates to be used in verifying a signature.
签名证书属性旨在防止简单的替换和重新颁发攻击，并允许在验证签名时使用一组受限的证书。
Two different attributes exist for this due to a flaw in the original design. The only substantial difference between the two attributes is that SigningCertificateV2 allows for hash algorithm agility, while SigningCertificate forces the use of the SHA-1 hash algorithm. With the recent advances in the ability to create hash collisions for SHA-1, it is wise to move forward sooner rather than later.
由于原始设计中存在缺陷，因此存在两种不同的属性。这两个属性之间唯一的实质性区别是SigningCertificateV2允许哈希算法的灵活性，而SigningCertificate强制使用SHA-1哈希算法。随着为SHA-1创建散列冲突的能力的最新进展，明智的做法是越早越好。
When the SHA-1 hash function is used, the SigningCertificate attribute MUST be used. The SigningCertificateV2 attribute MUST be used if any algorithm other than SHA-1 is used and SHOULD NOT be used for SHA-1. Applications SHOULD recognize both attributes as long as they consider SHA-1 able to distinguish between two different certificates, (i.e., the possibility of a collision is sufficiently low). If both attributes exist in a single message, they are independently evaluated.
使用SHA-1哈希函数时，必须使用SigningCertificate属性。如果使用SHA-1以外的任何算法，则必须使用SigningCertificateV2属性，并且不应将其用于SHA-1。应用程序应该承认这两个属性，只要他们认为SHA-1能够区分两个不同的证书，（即，碰撞的可能性足够低）。如果两个属性都存在于单个消息中，则会对它们进行独立评估。
Four cases exist that need to be taken into account when using this attribute for correct processing:
在使用此属性进行正确处理时，需要考虑四种情况：
1. Signature validates and the hashes match: This is the success case.
1. 签名验证和哈希匹配：这是成功的例子。
2. Signature validates and the hashes do not match: In this case, the certificate contained the correct public key, but the certificate containing the public key is not the one that the signer intended to be used. In this case the application should attempt a search for a different certificate with the same public key and for which the hashes match. If no such certificate can be found, this is a failure case.
2. 签名验证，散列不匹配：在这种情况下，证书包含正确的公钥，但包含公钥的证书不是签名者想要使用的证书。在这种情况下，应用程序应尝试搜索具有相同公钥且哈希匹配的不同证书。如果找不到此类证书，则属于失败案例。
3. Signature fails validation and the hashes match: In this case, it can be assumed that the signature has been modified in some fashion. This is a failure case.
3. 签名验证失败，散列匹配：在这种情况下，可以假定签名已以某种方式修改。这是一个失败的案例。
4. Signature fails validation and the hashes do not match: In this case, it can be either that the signature has been modified, or that the wrong certificate has been used. Applications should attempt a search for a different certificate that matches the hash value in the attribute and use the new certificate to retry the signature validation.
4. 签名验证失败，哈希不匹配：在这种情况下，可能是签名已被修改，或者使用了错误的证书。应用程序应尝试搜索与属性中的哈希值匹配的其他证书，并使用新证书重试签名验证。
3. Insert New Section 5.4.1 'Signing Certificate Attribute Definition Version 2'
3. 插入新的第5.4.1节“签名证书属性定义版本2”
5.4.1 Signing Certificate Attribute Definition Version 2
5.4.1 签名证书属性定义版本2
The signing certificate attribute is designed to prevent the simple substitution and re-issue attacks, and to allow for a restricted set of certificates to be used in verifying a signature.
签名证书属性旨在防止简单的替换和重新颁发攻击，并允许在验证签名时使用一组受限的证书。
SigningCertificateV2 is identified by the OID:
签名证书EV2由OID标识：
id-aa-signingCertificateV2 OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) id-aa(2) 47 }
id-aa-signingCertificateV2 OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) id-aa(2) 47 }
The attribute has the ASN.1 definition:
该属性具有ASN.1定义：
SigningCertificateV2 ::= SEQUENCE {
certs SEQUENCE OF ESSCertIDv2,
policies SEQUENCE OF PolicyInformation OPTIONAL
}
SigningCertificateV2 ::= SEQUENCE {
certs SEQUENCE OF ESSCertIDv2,
policies SEQUENCE OF PolicyInformation OPTIONAL
}
certs contains the list of certificates that are to be used in validating the message. The first certificate identified in the sequence of certificate identifiers MUST be the certificate used to verify the signature. The encoding of the ESSCertIDv2 for this certificate SHOULD include the issuerSerial field. If other constraints ensure that issuerAndSerialNumber will be present in the SignerInfo, the issuerSerial field MAY be omitted. The certificate identified is used during the signature verification process. If the hash of the certificate does not match the certificate used to verify the signature, the signature MUST be considered invalid.
certs包含用于验证邮件的证书列表。证书标识符序列中标识的第一个证书必须是用于验证签名的证书。此证书的ESSCertIDv2编码应包括issuerSerial字段。如果其他约束确保SignerinInfo中存在issuerAndSerialNumber，则可以省略issuerSerial字段。标识的证书在签名验证过程中使用。如果证书的哈希与用于验证签名的证书不匹配，则签名必须视为无效。
If more than one certificate is present, subsequent certificates limit the set of certificates that are used during validation. Certificates can be either attribute certificates (limiting authorizations) or public key certificates (limiting path validation). The issuerSerial field (in the ESSCertIDv2 structure) SHOULD be present for these certificates, unless the client who is validating the signature is expected to have easy access to all the certificates required for validation. If only the signing certificate is present in the sequence, there are no restrictions on the set of certificates used in validating the signature.
如果存在多个证书，后续证书将限制验证期间使用的证书集。证书可以是属性证书（限制授权）或公钥证书（限制路径验证）。除非验证签名的客户机可以轻松访问验证所需的所有证书，否则这些证书应显示issuerSerial字段（在ESSCertIDv2结构中）。如果序列中仅存在签名证书，则对验证签名时使用的证书集没有限制。
policies contains a sequence of policy information terms that identify those certificate policies that the signer asserts apply to the certificate, and under which the certificate should be relied upon. This value suggests a policy value to be used in the relying party's certification path validation. The definition of PolicyInformation can be found in [RFC3280].
策略包含一系列策略信息术语，用于标识签名者声明应用于证书的证书策略，以及证书应依赖的证书策略。此值表示要在依赖方的认证路径验证中使用的策略值。保单信息的定义见[RFC3280]。
If present, the SigningCertificateV2 attribute MUST be a signed attribute; it MUST NOT be an unsigned attribute. CMS defines SignedAttributes as a SET OF Attribute. A SignerInfo MUST NOT include multiple instances of the SigningCertificateV2 attribute. CMS defines the ASN.1 syntax for the signed attributes to include attrValues SET OF AttributeValue. A SigningCertificateV2 attribute MUST include only a single instance of AttributeValue. There MUST NOT be zero or multiple instances of AttributeValue present in the attrValues SET OF AttributeValue.
如果存在，SigningCertificateV2属性必须是已签名属性；它不能是未签名的属性。CMS将SignedAttribute定义为一组属性。SignerinInfo不能包含SigningCertificateV2属性的多个实例。CMS为签名属性定义ASN.1语法，以包括AttributeValue的attrValues集。SigningCertificateV2属性只能包含AttributeValue的一个实例。AttributeValue的attrValues集合中不能存在AttributeValue的零个或多个实例。
Insert the following text as a new section.
插入以下文本作为新节。
5.4.1.1 Certificate Identification Version 2
5.4.1.1 证书标识版本2
The best way to identify certificates is an often-discussed issue. The ESSCertIDv2 structure supplies two different fields that are used for this purpose.
识别证书的最佳方法是一个经常讨论的问题。ESSCertIV2结构提供两个用于此目的的不同字段。
The hash of the entire certificate allows for a verifier to check that the certificate used in the verification process was the same certificate the signer intended. Hashes are convenient in that they are frequently used by certificate stores as a method of indexing and retrieving certificates as well. The use of the hash is required by this structure since the detection of substituted certificates is based on the fact they would map to different hash values.
整个证书的散列允许验证者检查验证过程中使用的证书是否与签名者预期的证书相同。散列很方便，因为它们经常被证书存储用作索引和检索证书的方法。这种结构要求使用散列，因为检测替代证书是基于它们将映射到不同散列值的事实。
The issuer/serial number pair is the method of identification of certificates used in [RFC3280]. That document imposes a restriction for certificates that the issuer distinguished name must be present. The issuer/serial number pair would therefore normally be sufficient to identify the correct signing certificate. (This assumes the same issuer name is not reused from the set of trust anchors.) The issuer/serial number pair can be stored in the sid field of the SignerInfo object. However, the sid field is not covered by the signature. In the cases where the issuer/serial number pair is not used in the sid or the issuer/serial number pair needs to be signed, it SHOULD be placed in the issuerSerial field of the ESSCertIDv2 structure.
发卡机构/序列号对是[RFC3280]中使用的证书标识方法。该文件对证书施加了限制，即颁发者可分辨名称必须存在。因此，颁发者/序列号对通常足以识别正确的签名证书。（这假设没有从信任锚集中重用相同的颁发者名称。）颁发者/序列号对可以存储在SignerInfo对象的sid字段中。但是，签名不包括sid字段。如果sid中未使用发卡机构/序列号对，或者需要对发卡机构/序列号对进行签名，则应将其置于ESSCertIDv2结构的发卡机构序列号字段中。
Attribute certificates and additional public key certificates containing information do not have an issuer/serial number pair represented anywhere in a SignerInfo object. When an attribute certificate or an additional public key certificate is not included in the SignedData object, it becomes much more difficult to get the correct set of certificates based only on a hash of the certificate. For this reason, these certificates SHOULD be identified by the IssuerSerial object.
属性证书和包含信息的其他公钥证书在SignerInfo对象中的任何位置都没有表示颁发者/序列号对。当属性证书或附加公钥证书未包含在SignedData对象中时，仅根据证书的哈希值获取正确的证书集变得更加困难。因此，这些证书应该由IssuerSerial对象标识。
This document defines a certificate identifier as:
本文档将证书标识符定义为：
ESSCertIDv2 ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier
DEFAULT {algorithm id-sha256},
certHash Hash,
issuerSerial IssuerSerial OPTIONAL
}
ESSCertIDv2 ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier
DEFAULT {algorithm id-sha256},
certHash Hash,
issuerSerial IssuerSerial OPTIONAL
}
Hash ::= OCTET STRING
Hash ::= OCTET STRING
IssuerSerial ::= SEQUENCE {
issuer GeneralNames,
serialNumber CertificateSerialNumber
}
IssuerSerial ::= SEQUENCE {
issuer GeneralNames,
serialNumber CertificateSerialNumber
}
The fields of ESSCertIDv2 are defined as follows:
ESSCertIDv2的字段定义如下：
hashAlgorithm contains the identifier of the algorithm used in computing certHash.
hashAlgorithm包含用于计算certHash的算法的标识符。
certHash is computed over the entire DER-encoded certificate (including the signature) using the SHA-1 algorithm.
certHash使用SHA-1算法计算整个DER编码证书（包括签名）。
issuerSerial holds the identification of the certificate. The issuerSerial would normally be present unless the value can be inferred from other information (e.g., the sid field of the SignerInfo object).
ISSUPERSERIAL持有证书的标识。除非可以从其他信息（例如SignerInfo对象的sid字段）推断出该值，否则issuerSerial通常会存在。
The fields of IssuerSerial are defined as follows:
IssuerSerial的字段定义如下：
issuer contains the issuer name of the certificate. For non-attribute certificates, the issuer MUST contain only the issuer name from the certificate encoded in the directoryName choice of GeneralNames. For attribute certificates, the issuer MUST contain the issuer name field from the attribute certificate.
颁发者包含证书的颁发者名称。对于非属性证书，颁发者必须仅包含在GeneralName的directoryName选项中编码的证书中的颁发者名称。对于属性证书，颁发者必须包含属性证书中的颁发者名称字段。
serialNumber holds the serial number that uniquely identifies the certificate for the issuer.
serialNumber保存唯一标识颁发者证书的序列号。
5. Insert New Section 5.4.2 'Signing Certificate Attribute Definition Version 1'
5. 插入新的第5.4.2节“签名证书属性定义版本1”
(Note: This section does not present new material. This section contains the original contents of Section 5.4 in [ESS], which are retained with minor changes in this specification to achieve backwards compatibility.)
（注：本节不提供新材料。本节包含[ESS]第5.4节的原始内容，本规范中的微小更改保留了这些内容，以实现向后兼容性。）
Insert the following text as a new section.
插入以下文本作为新节。
5.4.2 Signing Certificate Attribute Definition Version 1
5.4.2 签名证书属性定义版本1
The signing certificate attribute is designed to prevent the simple substitution and re-issue attacks, and to allow for a restricted set of certificates to be used in verifying a signature.
签名证书属性旨在防止简单的替换和重新颁发攻击，并允许在验证签名时使用一组受限的证书。
The definition of SigningCertificate is
签名证书的定义是
SigningCertificate ::= SEQUENCE {
certs SEQUENCE OF ESSCertID,
policies SEQUENCE OF PolicyInformation OPTIONAL
}
SigningCertificate ::= SEQUENCE {
certs SEQUENCE OF ESSCertID,
policies SEQUENCE OF PolicyInformation OPTIONAL
}
id-aa-signingCertificate OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) id-aa(2) 12 }
id-aa-signingCertificate OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) id-aa(2) 12 }
The first certificate identified in the sequence of certificate identifiers MUST be the certificate used to verify the signature. The encoding of the ESSCertID for this certificate SHOULD include the issuerSerial field. If other constraints ensure that issuerAndSerialNumber will be present in the SignerInfo, the issuerSerial field MAY be omitted. The certificate identified is used during the signature verification process. If the hash of the certificate does not match the certificate used to verify the signature, the signature MUST be considered invalid.
证书标识符序列中标识的第一个证书必须是用于验证签名的证书。此证书的ESSCertID编码应包括issuerSerial字段。如果其他约束确保SignerinInfo中存在issuerAndSerialNumber，则可以省略issuerSerial字段。标识的证书在签名验证过程中使用。如果证书的哈希与用于验证签名的证书不匹配，则签名必须视为无效。
If more than one certificate is present in the sequence of ESSCertIDs, the certificates after the first one limit the set of certificates that are used during validation. Certificates can be either attribute certificates (limiting authorizations) or public key certificates (limiting path validation). The issuerSerial field (in the ESSCertID structure) SHOULD be present for these certificates, unless the client who is validating the signature is expected to have
如果ESSCertID序列中存在多个证书，则第一个证书之后的证书将限制验证期间使用的证书集。证书可以是属性证书（限制授权）或公钥证书（限制路径验证）。除非验证签名的客户机预期具有以下权限，否则这些证书应显示issuerSerial字段（在ESSCertID结构中）
easy access to all the certificates required for validation. If only the signing certificate is present in the sequence, there are no restrictions on the set of certificates used in validating the signature.
轻松访问验证所需的所有证书。如果序列中仅存在签名证书，则对验证签名时使用的证书集没有限制。
The sequence of policy information terms identifies those certificate policies that the signer asserts apply to the certificate, and under which the certificate should be relied upon. This value suggests a policy value to be used in the relying party's certification path validation.
策略信息术语的顺序标识了签名者声称应用于证书的那些证书策略，以及证书应该依赖的那些证书策略。此值表示要在依赖方的认证路径验证中使用的策略值。
If present, the SigningCertificate attribute MUST be a signed attribute; it MUST NOT be an unsigned attribute. Cryptographic Message Syntax (CMS) defines SignedAttributes as a SET OF Attribute. A SignerInfo MUST NOT include multiple instances of the SigningCertificate attribute. CMS defines the ASN.1 syntax for the signed attributes to include attrValues SET OF AttributeValue. A SigningCertificate attribute MUST include only a single instance of AttributeValue. There MUST NOT be zero or multiple instances of AttributeValue present in the attrValues SET OF AttributeValue.
如果存在，SigningCertificate属性必须是已签名属性；它不能是未签名的属性。加密消息语法（CMS）将SignedAttribute定义为一组属性。SignerinInfo不能包含SigningCertificate属性的多个实例。CMS为签名属性定义ASN.1语法，以包括AttributeValue的attrValues集。SigningCertificate属性只能包含AttributeValue的一个实例。AttributeValue的attrValues集合中不能存在AttributeValue的零个或多个实例。
(Note: This section does not present new material. This section contains the original contents of Section 5.4 in [ESS], which are retained with minor changes in this specification to achieve backwards compatibility.)
（注：本节不提供新材料。本节包含[ESS]第5.4节的原始内容，本规范中的微小更改保留了这些内容，以实现向后兼容性。）
Delete old Section 5.4.1
删除旧的第5.4.1节
Insert the following as new text
插入以下内容作为新文本
5.4.2.1 Certificate Identification Version 1
5.4.2.1 证书标识版本1
Certificates are uniquely identified using the information in the ESSCertID structure. Discussion can be found in Section 5.4.1.1.
证书使用ESSCertID结构中的信息进行唯一标识。讨论见第5.4.1.1节。
This document defines a certificate identifier as:
本文档将证书标识符定义为：
ESSCertID ::= SEQUENCE {
certHash Hash,
issuerSerial IssuerSerial OPTIONAL
}
ESSCertID ::= SEQUENCE {
certHash Hash,
issuerSerial IssuerSerial OPTIONAL
}
The fields of ESSCertID are defined as follows:
ESSCertID的字段定义如下：
certHash is computed over the entire DER-encoded certificate (including the signature).
certHash计算整个DER编码证书（包括签名）。
issuerSerial holds the identification of the certificate. This field would normally be present unless the value can be inferred from other information (e.g., the sid field of the SignerInfo object).
ISSUPERSERIAL持有证书的标识。除非可以从其他信息（例如SignerInfo对象的sid字段）推断出该值，否则该字段通常会出现。
The fields of IssuerSerial are discussed in Section 5.4.1.1
发行人序列字段在第5.4.1.1节中讨论
This document is designed to address the security issue of a substituted certificate used by the validator. If a different certificate is used by the validator than the signer, the validator may not get the correct result. An example of this would be that the original certificate was revoked and a new certificate with the same public key was issued for a different individual. Since the issuer/ serial number field is not protected, the attacker could replace this and point to the new certificate and validation would be successful.
本文档旨在解决验证器使用的替代证书的安全问题。如果验证器使用的证书与签名者不同，验证器可能无法获得正确的结果。这方面的一个例子是，原始证书被吊销，并为不同的个人颁发了具有相同公钥的新证书。由于颁发者/序列号字段不受保护，攻击者可以替换此字段并指向新证书，验证将成功。
The attributes defined in this document are to be placed in locations that are protected by the signature. This attribute does not provide any additional security if placed in an unsigned or un-authenticated location.
本文件中定义的属性将放置在受签名保护的位置。如果将此属性放置在未签名或未经身份验证的位置，则不会提供任何额外的安全性。
The attributes defined in this document permit a signer to select a hash algorithm to identify a certificate. A poorly selected hash algorithm may provide inadequate protection against certificate substitution or result in denial of service for this protection. By employing the attributes defined in this specification with the same hash algorithm used for message signing, the sender can ensure that these attributes provide commensurate security.
本文档中定义的属性允许签名者选择哈希算法来标识证书。选择不当的哈希算法可能无法针对证书替换提供充分的保护，或导致拒绝服务。通过使用本规范中定义的属性和用于消息签名的相同哈希算法，发送方可以确保这些属性提供相应的安全性。
Since recipients must support the hash algorithm to verify the signature, selecting the same hash algorithm also increases the likelihood that the hash algorithm is supported in the context of certificate identification. Note that an unsupported hash algorithm for certificate identification does not preclude validating the message but does deny the message recipient protection against certificate substitution.
由于收件人必须支持哈希算法来验证签名，因此选择相同的哈希算法也会增加在证书标识上下文中支持哈希算法的可能性。请注意，用于证书标识的不受支持的哈希算法并不排除验证消息，但会拒绝消息收件人对证书替换的保护。
To ensure that legacy implementations are provided protection against certificate substitution, clients are permitted to include both ESScertID and ESScertIDv2 in the same message. Since these
为确保为旧版实现提供防止证书替换的保护，允许客户端在同一消息中同时包含ESScertID和ESScertIDv2。自从这些
attributes are generated and evaluated independently, the contents could conceivably be in conflict. Specifically, where a signer has multiple certificates containing the same public key, the two attributes could specify different signing certificates. The result of signature processing may vary depending on which certificate is used to validate the signature.
属性是独立生成和评估的，内容可能存在冲突。具体来说，如果签名者有多个包含相同公钥的证书，则这两个属性可以指定不同的签名证书。签名处理的结果可能因用于验证签名的证书而异。
Recipients that attempt to evaluate both attributes may choose to reject such a message.
尝试评估这两个属性的收件人可以选择拒绝此类邮件。
[ESS] Hoffman, P., "Enhanced Security Services for S/MIME", RFC 2634, June 1999.
[ESS]Hoffman，P.，“S/MIME的增强安全服务”，RFC 2634，1999年6月。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", RFC 2119, BCP 14, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，RFC 2119，BCP 14，1997年3月。
[RFC3280] Housley, R., Ford, W., Polk, W., and D. Solo, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 3280, April 2002.
[RFC3280]Housley，R.，Ford，W.，Polk，W.，和D.Solo，“互联网X.509公钥基础设施证书和证书撤销列表（CRL）概要”，RFC 32802002年4月。
[RFC3852] Housley, R., "Cryptographic Message Syntax (CMS)", RFC 3852, July 2004.
[RFC3852]Housley，R.，“加密消息语法（CMS）”，RFC3852，2004年7月。
[UTF8] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.
[UTF8]Yergeau，F.，“UTF-8，ISO 10646的转换格式”，STD 63，RFC 3629，2003年11月。
Replace the ASN.1 module in RFC 2634 with this one.
用此模块替换RFC 2634中的ASN.1模块。
ExtendedSecurityServices-2006
{ iso(1) member-body(2) us(840) rsadsi(113549)
pkcs(1) pkcs-9(9) smime(16) modules(0) id-mod-ess-2006(30) }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
IMPORTS
-- Cryptographic Message Syntax (CMS) [RFC3852]
ContentType, IssuerAndSerialNumber, SubjectKeyIdentifier
FROM CryptographicMessageSyntax2004 { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16)
modules(0) cms-2004(24)}
-- PKIX Certificate and CRL Profile, Section A.1 Explicity Tagged Module
-- 1988 Syntax [RFC3280]
AlgorithmIdentifier, CertificateSerialNumber
FROM PKIX1Explicit88 { iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-explicit(18) }
ExtendedSecurityServices-2006
{ iso(1) member-body(2) us(840) rsadsi(113549)
pkcs(1) pkcs-9(9) smime(16) modules(0) id-mod-ess-2006(30) }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
IMPORTS
-- Cryptographic Message Syntax (CMS) [RFC3852]
ContentType, IssuerAndSerialNumber, SubjectKeyIdentifier
FROM CryptographicMessageSyntax2004 { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16)
modules(0) cms-2004(24)}
-- PKIX Certificate and CRL Profile, Section A.1 Explicity Tagged Module
-- 1988 Syntax [RFC3280]
AlgorithmIdentifier, CertificateSerialNumber
FROM PKIX1Explicit88 { iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-explicit(18) }
-- PKIX Certificate and CRL Profile, Sec A.2 Implicitly Tagged Module,
-- 1988 Syntax [RFC3280]
PolicyInformation, GeneralNames
FROM PKIX1Implicit88 {iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-implicit(19)};
-- PKIX Certificate and CRL Profile, Sec A.2 Implicitly Tagged Module,
-- 1988 Syntax [RFC3280]
PolicyInformation, GeneralNames
FROM PKIX1Implicit88 {iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-implicit(19)};
-- Extended Security Services
-- The construct "SEQUENCE SIZE (1..MAX) OF" appears in several ASN.1
-- constructs in this module. A valid ASN.1 SEQUENCE can have zero or
-- more entries. The SIZE (1..MAX) construct constrains the SEQUENCE to
-- have at least one entry. MAX indicates the upper bound is
-- unspecified. Implementations are free to choose an upper bound that
-- suits their environment.
-- Extended Security Services
-- The construct "SEQUENCE SIZE (1..MAX) OF" appears in several ASN.1
-- constructs in this module. A valid ASN.1 SEQUENCE can have zero or
-- more entries. The SIZE (1..MAX) construct constrains the SEQUENCE to
-- have at least one entry. MAX indicates the upper bound is
-- unspecified. Implementations are free to choose an upper bound that
-- suits their environment.
-- UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
-- UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
-- The contents are formatted as described in [UTF8]
--内容的格式如[UTF8]所述
-- Section 2.7
--第2.7节
ReceiptRequest ::= SEQUENCE {
signedContentIdentifier ContentIdentifier,
receiptsFrom ReceiptsFrom,
receiptsTo SEQUENCE SIZE (1..ub-receiptsTo) OF GeneralNames
}
ReceiptRequest ::= SEQUENCE {
signedContentIdentifier ContentIdentifier,
receiptsFrom ReceiptsFrom,
receiptsTo SEQUENCE SIZE (1..ub-receiptsTo) OF GeneralNames
}
ub-receiptsTo INTEGER ::= 16
ub-receiptsTo INTEGER ::= 16
id-aa-receiptRequest OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 1}
id-aa-receiptRequest OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 1}
ContentIdentifier ::= OCTET STRING
ContentIdentifier ::= OCTET STRING
id-aa-contentIdentifier OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 7}
id-aa-contentIdentifier OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 7}
ReceiptsFrom ::= CHOICE {
allOrFirstTier [0] AllOrFirstTier, -- formerly "allOrNone [0]AllOrNone"
receiptList [1] SEQUENCE OF GeneralNames
}
ReceiptsFrom ::= CHOICE {
allOrFirstTier [0] AllOrFirstTier, -- formerly "allOrNone [0]AllOrNone"
receiptList [1] SEQUENCE OF GeneralNames
}
AllOrFirstTier ::= INTEGER { -- Formerly AllOrNone
allReceipts (0),
firstTierRecipients (1)
}
AllOrFirstTier ::= INTEGER { -- Formerly AllOrNone
allReceipts (0),
firstTierRecipients (1)
}
-- Section 2.8
--第2.8节
Receipt ::= SEQUENCE {
version ESSVersion,
contentType ContentType,
signedContentIdentifier ContentIdentifier,
originatorSignatureValue OCTET STRING
}
Receipt ::= SEQUENCE {
version ESSVersion,
contentType ContentType,
signedContentIdentifier ContentIdentifier,
originatorSignatureValue OCTET STRING
}
id-ct-receipt OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-ct(1) 1}
id-ct-receipt OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-ct(1) 1}
ESSVersion ::= INTEGER { v1(1) }
ESSVersion ::= INTEGER { v1(1) }
-- Section 2.9
--第2.9节
ContentHints ::= SEQUENCE {
contentDescription UTF8String (SIZE (1..MAX)) OPTIONAL,
contentType ContentType
}
ContentHints ::= SEQUENCE {
contentDescription UTF8String (SIZE (1..MAX)) OPTIONAL,
contentType ContentType
}
id-aa-contentHint OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 4}
id-aa-contentHint OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840)
rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 4}
-- Section 2.10
--第2.10节
MsgSigDigest ::= OCTET STRING
MsgSigDigest ::= OCTET STRING
id-aa-msgSigDigest OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 5}
id-aa-msgSigDigest OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 5}
-- Section 2.11
--第2.11节
ContentReference ::= SEQUENCE {
contentType ContentType,
signedContentIdentifier ContentIdentifier,
originatorSignatureValue OCTET STRING
}
ContentReference ::= SEQUENCE {
contentType ContentType,
signedContentIdentifier ContentIdentifier,
originatorSignatureValue OCTET STRING
}
id-aa-contentReference OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 10 }
id-aa-contentReference OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 10 }
-- Section 3.2
--第3.2节
ESSSecurityLabel ::= SET {
security-policy-identifier SecurityPolicyIdentifier,
security-classification SecurityClassification OPTIONAL,
privacy-mark ESSPrivacyMark OPTIONAL,
security-categories SecurityCategories OPTIONAL
}
ESSSecurityLabel ::= SET {
security-policy-identifier SecurityPolicyIdentifier,
security-classification SecurityClassification OPTIONAL,
privacy-mark ESSPrivacyMark OPTIONAL,
security-categories SecurityCategories OPTIONAL
}
id-aa-securityLabel OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 2}
SecurityPolicyIdentifier ::= OBJECT IDENTIFIER
id-aa-securityLabel OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 2}
SecurityPolicyIdentifier ::= OBJECT IDENTIFIER
SecurityClassification ::= INTEGER {
unmarked (0),
unclassified (1),
restricted (2),
confidential (3),
secret (4),
top-secret (5)
}(0..ub-integer-options)
SecurityClassification ::= INTEGER {
unmarked (0),
unclassified (1),
restricted (2),
confidential (3),
secret (4),
top-secret (5)
}(0..ub-integer-options)
ub-integer-options INTEGER ::= 256
ub-integer-options INTEGER ::= 256
ESSPrivacyMark ::= CHOICE {
pString PrintableString (SIZE (1..ub-privacy-mark-length)),
utf8String UTF8String (SIZE (1..MAX))
}
ESSPrivacyMark ::= CHOICE {
pString PrintableString (SIZE (1..ub-privacy-mark-length)),
utf8String UTF8String (SIZE (1..MAX))
}
ub-privacy-mark-length INTEGER ::= 128
ub-privacy-mark-length INTEGER ::= 128
SecurityCategories ::= SET SIZE (1..ub-security-categories) OF
SecurityCategory
SecurityCategories ::= SET SIZE (1..ub-security-categories) OF
SecurityCategory
ub-security-categories INTEGER ::= 64
ub-security-categories INTEGER ::= 64
SecurityCategory ::= SEQUENCE {
type [0] OBJECT IDENTIFIER,
value [1] ANY DEFINED BY type
}
SecurityCategory ::= SEQUENCE {
type [0] OBJECT IDENTIFIER,
value [1] ANY DEFINED BY type
}
--Note: The aforementioned SecurityCategory syntax produces identical
--hex encodings as the following SecurityCategory syntax that is
--documented in the X.411 specification:
--
--SecurityCategory ::= SEQUENCE {
--Note: The aforementioned SecurityCategory syntax produces identical
--hex encodings as the following SecurityCategory syntax that is
--documented in the X.411 specification:
--
--SecurityCategory ::= SEQUENCE {
-- type [0] SECURITY-CATEGORY,
-- value [1] ANY DEFINED BY type }
--
--SECURITY-CATEGORY MACRO ::=
--BEGIN
--TYPE NOTATION ::= type | empty
--VALUE NOTATION ::= value (VALUE OBJECT IDENTIFIER)
--END
-- type [0] SECURITY-CATEGORY,
-- value [1] ANY DEFINED BY type }
--
--SECURITY-CATEGORY MACRO ::=
--BEGIN
--TYPE NOTATION ::= type | empty
--VALUE NOTATION ::= value (VALUE OBJECT IDENTIFIER)
--END
-- Section 3.4
--第3.4节
EquivalentLabels ::= SEQUENCE OF ESSSecurityLabel
EquivalentLabels ::= SEQUENCE OF ESSSecurityLabel
id-aa-equivalentLabels OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 9}
id-aa-equivalentLabels OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 9}
-- Section 4.4
--第4.4节
MLExpansionHistory ::= SEQUENCE
SIZE (1..ub-ml-expansion-history) OF MLData
MLExpansionHistory ::= SEQUENCE
SIZE (1..ub-ml-expansion-history) OF MLData
id-aa-mlExpandHistory OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 3 }
id-aa-mlExpandHistory OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) id-aa(2) 3 }
ub-ml-expansion-history INTEGER ::= 64 MLData ::= SEQUENCE {
mailListIdentifier EntityIdentifier,
expansionTime GeneralizedTime,
mlReceiptPolicy MLReceiptPolicy OPTIONAL
}
ub-ml-expansion-history INTEGER ::= 64 MLData ::= SEQUENCE {
mailListIdentifier EntityIdentifier,
expansionTime GeneralizedTime,
mlReceiptPolicy MLReceiptPolicy OPTIONAL
}
EntityIdentifier ::= CHOICE {
issuerAndSerialNumber IssuerAndSerialNumber,
subjectKeyIdentifier SubjectKeyIdentifier
}
EntityIdentifier ::= CHOICE {
issuerAndSerialNumber IssuerAndSerialNumber,
subjectKeyIdentifier SubjectKeyIdentifier
}
MLReceiptPolicy ::= CHOICE {
none [0] NULL,
insteadOf [1] SEQUENCE SIZE (1..MAX) OF GeneralNames,
inAdditionTo [2] SEQUENCE SIZE (1..MAX) OF GeneralNames
}
MLReceiptPolicy ::= CHOICE {
none [0] NULL,
insteadOf [1] SEQUENCE SIZE (1..MAX) OF GeneralNames,
inAdditionTo [2] SEQUENCE SIZE (1..MAX) OF GeneralNames
}
-- Section 5.4
--第5.4节
SigningCertificate ::= SEQUENCE {
certs SEQUENCE OF ESSCertID,
policies SEQUENCE OF PolicyInformation OPTIONAL
}
SigningCertificate ::= SEQUENCE {
certs SEQUENCE OF ESSCertID,
policies SEQUENCE OF PolicyInformation OPTIONAL
}
id-aa-signingCertificate OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) id-aa(2) 12 }
id-aa-signingCertificate OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) id-aa(2) 12 }
SigningCertificateV2 ::= SEQUENCE {
certs SEQUENCE OF ESSCertIDv2,
policies SEQUENCE OF PolicyInformation OPTIONAL
}
SigningCertificateV2 ::= SEQUENCE {
certs SEQUENCE OF ESSCertIDv2,
policies SEQUENCE OF PolicyInformation OPTIONAL
}
id-aa-signingCertificateV2 OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) id-aa(2) 47 }
id-aa-signingCertificateV2 OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
smime(16) id-aa(2) 47 }
id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101)
csor(3) nistalgorithm(4) hashalgs(2) 1 }
id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101)
csor(3) nistalgorithm(4) hashalgs(2) 1 }
ESSCertIDv2 ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier
DEFAULT {algorithm id-sha256},
certHash Hash,
issuerSerial IssuerSerial OPTIONAL
}
ESSCertIDv2 ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier
DEFAULT {algorithm id-sha256},
certHash Hash,
issuerSerial IssuerSerial OPTIONAL
}
ESSCertID ::= SEQUENCE {
certHash Hash,
issuerSerial IssuerSerial OPTIONAL
}
ESSCertID ::= SEQUENCE {
certHash Hash,
issuerSerial IssuerSerial OPTIONAL
}
Hash ::= OCTET STRING IssuerSerial ::= SEQUENCE {
issuer GeneralNames,
serialNumber CertificateSerialNumber
}
Hash ::= OCTET STRING IssuerSerial ::= SEQUENCE {
issuer GeneralNames,
serialNumber CertificateSerialNumber
}
END
终止
-- of ExtendedSecurityServices-2006
--扩展安全服务-2006
Author's Address
作者地址
Jim Schaad Soaring Hawk Consulting PO Box 675 Gold Bar, WA 98251
Jim Schaad Smalling Hawk咨询公司华盛顿金条675号邮政信箱98251
EMail: jimsch@exmsft.com
EMail: jimsch@exmsft.com
Full Copyright Statement
完整版权声明
Copyright (C) The IETF Trust (2007).
版权所有（C）IETF信托基金（2007年）。
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
本文件受BCP 78中包含的权利、许可和限制的约束，除其中规定外，作者保留其所有权利。
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件及其包含的信息以“原样”为基础提供，贡献者、他/她所代表或赞助的组织（如有）、互联网协会、IETF信托基金和互联网工程任务组不承担任何明示或暗示的担保，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。
Intellectual Property
知识产权
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
IETF对可能声称与本文件所述技术的实施或使用有关的任何知识产权或其他权利的有效性或范围，或此类权利下的任何许可可能或可能不可用的程度，不采取任何立场；它也不表示它已作出任何独立努力来确定任何此类权利。有关RFC文件中权利的程序信息，请参见BCP 78和BCP 79。
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
向IETF秘书处披露的知识产权副本和任何许可证保证，或本规范实施者或用户试图获得使用此类专有权利的一般许可证或许可的结果，可从IETF在线知识产权存储库获取，网址为http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
IETF邀请任何相关方提请其注意任何版权、专利或专利申请，或其他可能涵盖实施本标准所需技术的专有权利。请将信息发送至IETF的IETF-ipr@ietf.org.