Internet Engineering Task Force (IETF) R. Housley
Request for Comments: 5914 Vigil Security, LLC
Category: Standards Track S. Ashmore
ISSN: 2070-1721 National Security Agency
C. Wallace
Cygnacom Solutions
June 2010
Internet Engineering Task Force (IETF) R. Housley
Request for Comments: 5914 Vigil Security, LLC
Category: Standards Track S. Ashmore
ISSN: 2070-1721 National Security Agency
C. Wallace
Cygnacom Solutions
June 2010
Trust Anchor Format
信任锚格式
Abstract
摘要
This document describes a structure for representing trust anchor information. A trust anchor is an authoritative entity represented by a public key and associated data. The public key is used to verify digital signatures, and the associated data is used to constrain the types of information or actions for which the trust anchor is authoritative. The structures defined in this document are intended to satisfy the format-related requirements defined in Trust Anchor Management Requirements.
本文档描述了一种表示信任锚信息的结构。信任锚是由公钥和相关数据表示的权威实体。公钥用于验证数字签名，关联数据用于约束信任锚具有权威性的信息或操作的类型。本文件中定义的结构旨在满足信托锚管理要求中定义的格式相关要求。
Status of This Memo
关于下段备忘
This is an Internet Standards Track document.
这是一份互联网标准跟踪文件。
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741.
本文件是互联网工程任务组（IETF）的产品。它代表了IETF社区的共识。它已经接受了公众审查，并已被互联网工程指导小组（IESG）批准出版。有关互联网标准的更多信息，请参见RFC 5741第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc5914.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问http://www.rfc-editor.org/info/rfc5914.
Copyright Notice
版权公告
Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2010 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(http://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。从本文件中提取的代码组件必须包括信托法律条款第4.e节中所述的简化BSD许可证文本，并提供简化BSD许可证中所述的无担保。
This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) controlling the copyright in such materials, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate it into languages other than English.
本文件可能包含2008年11月10日之前发布或公开的IETF文件或IETF贡献中的材料。控制某些材料版权的人员可能未授予IETF信托允许在IETF标准流程之外修改此类材料的权利。在未从控制此类材料版权的人员处获得充分许可的情况下，不得在IETF标准流程之外修改本文件，也不得在IETF标准流程之外创建其衍生作品，除了将其格式化以RFC形式发布或将其翻译成英语以外的其他语言。
Table of Contents
目录
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
2. Trust Anchor Information Syntax . . . . . . . . . . . . . . . 3
2.1. Version . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2. Public Key . . . . . . . . . . . . . . . . . . . . . . . . 3
2.3. Key Identifier . . . . . . . . . . . . . . . . . . . . . . 4
2.4. Trust Anchor Title . . . . . . . . . . . . . . . . . . . . 4
2.5. Certification Path Controls . . . . . . . . . . . . . . . 4
2.6. Extensions . . . . . . . . . . . . . . . . . . . . . . . . 8
3. Trust Anchor List . . . . . . . . . . . . . . . . . . . . . . 8
4. Security Considerations . . . . . . . . . . . . . . . . . . . 9
5. References . . . . . . . . . . . . . . . . . . . . . . . . . . 9
5.1. Normative References . . . . . . . . . . . . . . . . . . . 9
5.2. Informative References . . . . . . . . . . . . . . . . . . 10
Appendix A. ASN.1 Modules . . . . . . . . . . . . . . . . . . . . 11
A.1. ASN.1 Module Using 2002 Syntax . . . . . . . . . . . . . . 11
A.2. ASN.1 Module Using 1988 Syntax . . . . . . . . . . . . . . 12
A.2.1. ASN.1 Module . . . . . . . . . . . . . . . . . . . . . 12
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
2. Trust Anchor Information Syntax . . . . . . . . . . . . . . . 3
2.1. Version . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2. Public Key . . . . . . . . . . . . . . . . . . . . . . . . 3
2.3. Key Identifier . . . . . . . . . . . . . . . . . . . . . . 4
2.4. Trust Anchor Title . . . . . . . . . . . . . . . . . . . . 4
2.5. Certification Path Controls . . . . . . . . . . . . . . . 4
2.6. Extensions . . . . . . . . . . . . . . . . . . . . . . . . 8
3. Trust Anchor List . . . . . . . . . . . . . . . . . . . . . . 8
4. Security Considerations . . . . . . . . . . . . . . . . . . . 9
5. References . . . . . . . . . . . . . . . . . . . . . . . . . . 9
5.1. Normative References . . . . . . . . . . . . . . . . . . . 9
5.2. Informative References . . . . . . . . . . . . . . . . . . 10
Appendix A. ASN.1 Modules . . . . . . . . . . . . . . . . . . . . 11
A.1. ASN.1 Module Using 2002 Syntax . . . . . . . . . . . . . . 11
A.2. ASN.1 Module Using 1988 Syntax . . . . . . . . . . . . . . 12
A.2.1. ASN.1 Module . . . . . . . . . . . . . . . . . . . . . 12
Trust anchors are widely used to verify digital signatures and validate certification paths [RFC5280][X.509]. They are required when validating certification paths. Though widely used, there is no standard format for representing trust anchor information. This document describes the TrustAnchorInfo structure. This structure is intended to satisfy the format-related requirements expressed in Trust Anchor Management Requirements [TA-MGMT-REQS] and is expressed using ASN.1 [X.680]. It can provide a more compact alternative to X.509 certificates for exchanging trust anchor information and provides a means of associating additional or alternative constraints with certificates without breaking the signature on the certificate.
信任锚广泛用于验证数字签名和验证认证路径[RFC5280][X.509]。在验证证书路径时需要它们。尽管广泛使用，但没有标准格式来表示信任锚信息。本文档描述TrustAnchorInfo结构。该结构旨在满足信托锚管理要求[TA-MGMT-REQS]中表示的格式相关要求，并使用ASN.1[X.680]表示。它可以为交换信任锚信息提供X.509证书的更紧凑的替代方案，并提供一种将附加或替代约束与证书关联的方法，而不会破坏证书上的签名。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119].
本文件中的关键词“必须”、“不得”、“要求”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照RFC 2119[RFC2119]中所述进行解释。
This section describes the TrustAnchorInfo structure.
本节介绍TrustAnchorInfo结构。
TrustAnchorInfo ::= SEQUENCE {
version TrustAnchorInfoVersion DEFAULT v1,
pubKey SubjectPublicKeyInfo,
keyId KeyIdentifier,
taTitle TrustAnchorTitle OPTIONAL,
certPath CertPathControls OPTIONAL,
exts [1] EXPLICIT Extensions OPTIONAL,
taTitleLangTag [2] UTF8String OPTIONAL }
TrustAnchorInfo ::= SEQUENCE {
version TrustAnchorInfoVersion DEFAULT v1,
pubKey SubjectPublicKeyInfo,
keyId KeyIdentifier,
taTitle TrustAnchorTitle OPTIONAL,
certPath CertPathControls OPTIONAL,
exts [1] EXPLICIT Extensions OPTIONAL,
taTitleLangTag [2] UTF8String OPTIONAL }
TrustAnchorInfoVersion ::= INTEGER { v1(1) }
TrustAnchorInfoVersion ::= INTEGER { v1(1) }
version identifies the version of TrustAnchorInfo. Future updates to this document may include changes to the TrustAnchorInfo structure, in which case the version number should be incremented. However, the default value, v1, cannot be changed.
版本标识TrustAnchorInfo的版本。本文档的未来更新可能包括对TrustAnchorInfo结构的更改，在这种情况下，版本号应增加。但是，无法更改默认值v1。
pubKey identifies the public key and algorithm associated with the trust anchor using the SubjectPublicKeyInfo structure [RFC5280]. The SubjectPublicKeyInfo structure contains the algorithm identifier followed by the public key itself. The algorithm field is an
pubKey使用SubjectPublicKeyInfo结构[RFC5280]标识与信任锚关联的公钥和算法。SubjectPublicKeyInfo结构包含算法标识符，后跟公钥本身。算法字段是一个
AlgorithmIdentifier, which contains an object identifier and OPTIONAL parameters. The object identifier names the public key algorithm and indicates the syntax of the parameters, if present, as well as the format of the public key. The public key is encoded as a BIT STRING.
AlgorithmIdentifier，包含对象标识符和可选参数。对象标识符命名公钥算法，并指示参数的语法（如果存在）以及公钥的格式。公钥被编码为位字符串。
keyId contains the public key identifier of the trust anchor public key. See Section 4.2.1.2 of [RFC5280] for a description of common key identifier calculation methods.
keyId包含信任锚公钥的公钥标识符。有关通用密钥标识符计算方法的说明，请参见[RFC5280]第4.2.1.2节。
TrustAnchorTitle ::= UTF8String (SIZE (1..64))
TrustAnchorTitle ::= UTF8String (SIZE (1..64))
taTitle is OPTIONAL. When it is present, it provides a human-readable name for the trust anchor. The text is encoded in UTF-8 [RFC3629], which accommodates most of the world's writing systems. The taTitleLangTag field identifies the language used to express the taTitle. When taTitleLangTag is absent, English ("en" language tag) is used. The value of the taTitleLangTag should be a language tag as described in [RFC5646].
taTitle是可选的。当它存在时，它为信任锚提供了一个人类可读的名称。文本采用UTF-8[RFC3629]编码，可容纳世界上大多数书写系统。taTitleLangTag字段标识用于表示taTitle的语言。如果缺少taTitleLangTag，则使用英语（“en”语言标记）。taTitleLangTag的值应为[RFC5646]中所述的语言标记。
CertPathControls ::= SEQUENCE {
taName Name,
certificate [0] Certificate OPTIONAL,
policySet [1] CertificatePolicies OPTIONAL,
policyFlags [2] CertPolicyFlags OPTIONAL,
nameConstr [3] NameConstraints OPTIONAL,
pathLenConstraint[4] INTEGER (0..MAX) OPTIONAL}
CertPathControls ::= SEQUENCE {
taName Name,
certificate [0] Certificate OPTIONAL,
policySet [1] CertificatePolicies OPTIONAL,
policyFlags [2] CertPolicyFlags OPTIONAL,
nameConstr [3] NameConstraints OPTIONAL,
pathLenConstraint[4] INTEGER (0..MAX) OPTIONAL}
certPath is OPTIONAL. When it is present, it provides the controls needed to initialize an X.509 certification path validation algorithm implementation (see Section 6 of [RFC5280]). When absent, the trust anchor cannot be used to validate the signature on an X.509 certificate.
certPath是可选的。当它存在时，它提供初始化X.509认证路径验证算法实现所需的控制（见[RFC5280]第6节）。不存在时，信任锚不能用于验证X.509证书上的签名。
taName provides the X.500 distinguished name associated with the trust anchor, and this distinguished name is used to construct and validate an X.509 certification path. The name MUST NOT be an empty sequence.
taName提供与信任锚关联的X.500可分辨名称，该可分辨名称用于构造和验证X.509证书路径。名称不能是空序列。
certificate provides an OPTIONAL X.509 certificate, which can be used in some environments to represent the trust anchor in certification path development and validation. If the certificate is present, the subject name in the certificate MUST exactly match the X.500
证书提供可选的X.509证书，可在某些环境中用于表示证书路径开发和验证中的信任锚。如果存在证书，则证书中的使用者名称必须与X.500完全匹配
distinguished name provided in the taName field, the public key MUST exactly match the public key in the pubKey field, and the subjectKeyIdentifier extension, if present, MUST exactly match the key identifier in the keyId field. The complete description of the syntax and semantics of the Certificate are provided in [RFC5280]. Constraints defined in the policySet, policyFlags, nameConstr, pathLenConstraint, and exts fields within TrustAnchorInfo replace values contained in a certificate or provide values for extensions not present in the certificate. Values defined in these TrustAnchorInfo fields are always enforced. Extensions included in a certificate are enforced only if there is no corresponding value in the TrustAnchorInfo. Correspondence between extensions within certificate and TrustAnchorInfo fields is defined as follows:
taName字段中提供的可分辨名称，公钥必须与pubKey字段中的公钥完全匹配，subjectKeyIdentifier扩展（如果存在）必须与keyId字段中的密钥标识符完全匹配。[RFC5280]中提供了证书语法和语义的完整描述。TrustAnchorInfo中的policySet、policyFlags、nameConstr、pathLenConstraint和exts字段中定义的约束将替换证书中包含的值，或为证书中不存在的扩展提供值。始终强制执行这些TrustAnchorInfo字段中定义的值。只有当TrustAnchorInfo中没有相应的值时，证书中包含的扩展才会强制执行。证书和TrustAnchorInfo字段中的扩展之间的对应关系定义如下：
o an id-ce-certificatePolicies certificate extension corresponds to the CertPathControls.policySet field.
o id ce CertificatePolicys证书扩展对应于CertPathControls.policySet字段。
o an id-ce-policyConstraints certificate extension corresponds to the CertPolicyFlags.inhibitPolicyMapping and CertPolicyFlags.requireExplicitPolicy fields.
o id ce policyConstraints证书扩展对应于CertPolicyFlags.inhibitPolicyMapping和CertPolicyFlags.requireExplicitPolicy字段。
o an id-ce-inhibitAnyPolicy certificate extension corresponds to the CertPolicyFlags.inhibitAnyPolicy field.
o id ce inhibitAnyPolicy证书扩展对应于CertPolicyFlags.inhibitAnyPolicy字段。
o an id-ce-nameConstraints certificate extension corresponds to the CertPathControls.nameConstr field.
o id ce nameConstraints证书扩展对应于CertPathControls.nameConstr字段。
o the pathLenConstraint field of an id-ce-basicConstraints certificate extension corresponds to the CertPathControls.pathLenConstraint field (the presence of a CertPathControls structure corresponds to a TRUE value in the cA field of a BasicConstraints extension).
o id ce basicConstraints证书扩展的pathLenConstraint字段对应于CertPathControls.pathLenConstraint字段（CertPathControls结构的存在对应于basicConstraints扩展的cA字段中的真值）。
o any other certificate extension corresponds to the same type of extension in the TrustAnchorInfo.exts field.
o 任何其他证书扩展都对应于TrustAnchorInfo.exts字段中相同类型的扩展。
CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
PolicyInformation ::= SEQUENCE {
policyIdentifier CertPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL }
PolicyInformation ::= SEQUENCE {
policyIdentifier CertPolicyId,
policyQualifiers SEQUENCE SIZE (1..MAX) OF
PolicyQualifierInfo OPTIONAL }
CertPolicyId ::= OBJECT IDENTIFIER
CertPolicyId ::= OBJECT IDENTIFIER
policySet is OPTIONAL. When present, it contains a sequence of certificate policy identifiers to be provided as inputs to the certification path validation algorithm. When absent, the special
policySet是可选的。当存在时，它包含一系列证书策略标识符，作为证书路径验证算法的输入提供。缺席时，特别代表
value any-policy is provided as the input to the certification path validation algorithm. The complete description of the syntax and semantics of the CertificatePolicies are provided in [RFC5280], including the syntax for PolicyInformation. In this context, the OPTIONAL policyQualifiers structure MUST NOT be included.
值提供任何策略作为证书路径验证算法的输入。[RFC5280]中提供了证书策略语法和语义的完整描述，包括策略信息的语法。在此上下文中，不得包括可选的policyQualifiers结构。
CertPolicyFlags ::= BIT STRING {
inhibitPolicyMapping (0),
requireExplicitPolicy (1),
inhibitAnyPolicy (2) }
CertPolicyFlags ::= BIT STRING {
inhibitPolicyMapping (0),
requireExplicitPolicy (1),
inhibitAnyPolicy (2) }
policyFlags is OPTIONAL. When present, three Boolean values for input to the certification path validation algorithm are provided in a BIT STRING. When absent, the input to the certification path validation algorithm is { FALSE, FALSE, FALSE }, which represents the most liberal setting for these flags. The three bits are used as follows:
policyFlags是可选的。如果存在，则在位字符串中提供三个用于输入到认证路径验证算法的布尔值。当不存在时，证书路径验证算法的输入为{FALSE，FALSE，FALSE}，这表示这些标志的最自由的设置。这三个位的使用如下：
inhibitPolicyMapping indicates if policy mapping is allowed in the certification path. When set to TRUE, policy mapping is not permitted. This value represents the initial-policy-mapping-inhibit input value to the certification path validation algorithm described in Section 6.1.1 of [RFC5280].
inhibitPolicyMapping指示证书路径中是否允许策略映射。如果设置为TRUE，则不允许策略映射。该值表示[RFC5280]第6.1.1节中描述的认证路径验证算法的初始策略映射禁止输入值。
requireExplicitPolicy indicates if the certification path MUST be valid for at least one of the certificate policies in the policySet. When set to TRUE, all certificates in the certification path MUST contain an acceptable policy identifier in the certificate policies extension. This value represents the initial-explicit-policy input value to the certification path validation algorithm described in Section 6.1.1 of [RFC5280]. An acceptable policy identifier is a member of the policySet or the identifier of a policy that is declared to be equivalent through policy mapping. This bit MUST be set to FALSE if policySet is absent.
requireExplicitPolicy指示证书路径是否必须对策略集中的至少一个证书策略有效。当设置为TRUE时，证书路径中的所有证书都必须在证书策略扩展中包含可接受的策略标识符。该值表示[RFC5280]第6.1.1节中描述的认证路径验证算法的初始显式策略输入值。可接受的策略标识符是策略集的成员或通过策略映射声明为等效的策略的标识符。如果缺少policySet，则此位必须设置为FALSE。
inhibitAnyPolicy indicates whether the special anyPolicy policy identifier, with the value { 2 5 29 32 0 }, is considered an explicit match for other certificate policies. This value represents the initial-any-policy-inhibit input value to the certification path validation algorithm described in Section 6.1.1 of [RFC5280].
inhibitAnyPolicy指示值为{2 5 29 32 0}的特殊anyPolicy策略标识符是否被视为与其他证书策略的显式匹配。该值表示[RFC5280]第6.1.1节中描述的认证路径验证算法的初始任何策略禁止输入值。
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
BaseDistance ::= INTEGER (0..MAX)
BaseDistance ::= INTEGER (0..MAX)
nameConstr is OPTIONAL. It has the same syntax and semantics as the Name Constraints certificate extension [RFC5280], which includes a list of permitted names and a list of excluded names. The definition of GeneralName can be found in [RFC5280]. When it is present, constraints are provided on names (including alternative names) that might appear in subsequent X.509 certificates in a certification path. This field is used to set the initial-permitted-subtrees and initial-excluded-subtrees input values to the certification path validation algorithm described in Section 6.1.1 of [RFC5280]. When this field is absent, the initial-permitted-subtrees variable is unbounded and the initial-excluded-subtrees variable is empty.
namecontr是可选的。它与名称约束证书扩展[RFC5280]具有相同的语法和语义，该扩展包括允许的名称列表和排除的名称列表。GeneralName的定义可在[RFC5280]中找到。当它存在时，将对可能出现在证书路径中的后续X.509证书中的名称（包括替代名称）提供约束。该字段用于将初始允许子树和初始排除子树输入值设置为[RFC5280]第6.1.1节所述的认证路径验证算法。缺少此字段时，初始允许子树变量为无界变量，初始排除子树变量为空。
The pathLenConstraint field gives the maximum number of non-self-issued intermediate certificates that may follow this certificate in a valid certification path. (Note: The last certificate in the certification path is not an intermediate certificate and is not included in this limit. Usually, the last certificate is an end entity certificate, but it can be a CA certificate.) A pathLenConstraint of zero indicates that no non-self-issued intermediate certification authority (CA) certificates may follow in a valid certification path. Where it appears, the pathLenConstraint field MUST be greater than or equal to zero. Where pathLenConstraint does not appear, no limit is imposed.
pathLenConstraint字段提供了在有效证书路径中，此证书之后可能出现的非自颁发中间证书的最大数量。（注意：证书路径中的最后一个证书不是中间证书，不包括在此限制中。通常，最后一个证书是终端实体证书，但它可以是CA证书。）pathLenConstraint为零表示没有非自行颁发的中间证书颁发机构（CA）证书可以遵循有效的证书路径。出现时，pathLenConstraint字段必须大于或等于零。如果未出现pathLenConstraint，则不会施加任何限制。
When the trust anchor is used to validate a certification path, CertPathControls provides limitations on certification paths that will successfully validate. An application that is validating a certification path SHOULD NOT ignore these limitations, but the application can impose additional limitations to ensure that the validated certification path is appropriate for the intended application context. As input to the certification path validation algorithm, an application MAY:
当信任锚点用于验证证书路径时，CertPathControls对将成功验证的证书路径提供限制。验证认证路径的应用程序不应忽略这些限制，但应用程序可以施加其他限制，以确保验证的认证路径适合预期的应用程序上下文。作为认证路径验证算法的输入，应用程序可以：
o Provide a subset of the certification policies provided in the policySet;
o 提供策略集中提供的认证策略的子集；
o Provide a TRUE value, if appropriate, for any of the flags in the policyFlags;
o 如果适用，为policyFlags中的任何标志提供真实值；
o Provide a subset of the permitted names provided in the nameConstr;
o 提供nameConstr中提供的允许名称的子集；
o Provide additional excluded names to the ones that are provided in the nameConstr;
o 为nameConstr中提供的名称提供额外的排除名称；
o Provide a smaller value for pathLenConstraint.
o 为pathLenConstraint提供较小的值。
exts is OPTIONAL. When it is present, it can be used to associate additional information with the trust anchor using the standard Extensions structure. Extensions that are anticipated to be widely used have been included in the CertPathControls structure to avoid overhead associated with use of the Extensions structure. To avoid duplication with the CertPathControls field, the following types of extensions MUST NOT appear in the exts field and are ignored if they do appear: id-ce-certificatePolicies, id-ce-policyConstraints, id-ce-inhibitAnyPolicy, or id-ce-nameConstraints.
exts是可选的。当它存在时，可以使用标准扩展结构将附加信息与信任锚关联起来。CertPathControls结构中包含了预计将广泛使用的扩展，以避免与扩展结构的使用相关的开销。为避免与CertPathControls字段重复，以下类型的扩展不能出现在exts字段中，如果确实出现，则将忽略它们：id ce CertificatePolicys、id ce policyConstraints、id ce InhibitationAnyPolicy或id ce nameConstraints。
TrustAnchorInfo allows for the representation of a single trust anchor. In many cases, it is convenient to represent a collection of trust anchors. The TrustAnchorList structure is defined for this purpose. TrustAnchorList is defined as a sequence of one or more TrustAnchorChoice objects. TrustAnchorChoice provides three options for representing a trust anchor. The certificate option allows for the use of a certificate with no additional associated constraints. The tbsCert option allows for associating constraints by removing a signature on a certificate and changing the extensions field. The taInfo option allows for use of the TrustAnchorInfo structure defined in this document.
TrustAnchorInfo允许表示单个信任锚。在许多情况下，表示信任锚的集合是很方便的。为此目的定义了信任结构。TrustAnchorList定义为一个或多个TrustAnchorChoice对象的序列。TrustAnchorChoice提供了三个表示信任锚的选项。certificate选项允许在没有其他相关约束的情况下使用证书。tbsCert选项允许通过删除证书上的签名并更改extensions字段来关联约束。taInfo选项允许使用本文档中定义的TrustAnchorInfo结构。
TrustAnchorList ::= SEQUENCE SIZE (1..MAX) OF TrustAnchorChoice
TrustAnchorList ::= SEQUENCE SIZE (1..MAX) OF TrustAnchorChoice
TrustAnchorChoice ::= CHOICE {
certificate Certificate,
tbsCert [1] EXPLICIT TBSCertificate,
taInfo [2] EXPLICIT TrustAnchorInfo }
TrustAnchorChoice ::= CHOICE {
certificate Certificate,
tbsCert [1] EXPLICIT TBSCertificate,
taInfo [2] EXPLICIT TrustAnchorInfo }
trust-anchor-list PKCS7-CONTENT-TYPE ::=
{ TrustAnchorList IDENTIFIED BY id-ct-trustAnchorList }
trust-anchor-list PKCS7-CONTENT-TYPE ::=
{ TrustAnchorList IDENTIFIED BY id-ct-trustAnchorList }
The TrustAnchorList structure can be protected using the SignedData structure defined in the Cryptographic Message Syntax (CMS) [RFC5652]. The id-ct-trustAnchorList object identifier has been defined to represent TrustAnchorList payloads with CMS structures.
可以使用加密消息语法（CMS）[RFC5652]中定义的SignedData结构来保护TrustAnchorList结构。id ct trustAnchorList对象标识符已定义为用CMS结构表示trustAnchorList有效负载。
Compromise of a trust anchor private key permits unauthorized parties to masquerade as the trust anchor, with potentially severe consequences. Where TA-based constraints are enforced, the unauthorized holder of the trust anchor private key will be limited by the certification path controls associated with the trust anchor, as expressed in the certPath and exts fields. For example, name constraints in the trust anchor will determine the name space that will be accepted in certificates that are validated using the compromised trust anchor. Reliance on an inappropriate or incorrect trust anchor public key has similar potentially severe consequences.
信任锚私钥的泄露允许未经授权的各方伪装成信任锚，并可能带来严重后果。在强制实施基于TA的约束的情况下，未经授权的信任锚私钥持有者将受到与信任锚相关联的证书路径控制的限制，如certPath和exts字段中所示。例如，信任锚点中的名称约束将确定将在使用受损信任锚点验证的证书中接受的名称空间。依赖不适当或不正确的信任锚公钥也有类似的潜在严重后果。
The compromise of a CA's private key leads to the same type of problems as the compromise of a trust anchor private key. The unauthorized holder of the CA private key will be limited by the certification path controls associated with the trust anchor, as expressed in the certPath field or as an extension.
CA私钥的泄露会导致与信任锚私钥泄露相同类型的问题。CA私钥的未经授权持有者将受到与信任锚点相关联的证书路径控制的限制，如certPath字段或扩展中所示。
Usage of a certificate independent of the TrustAnchorInfo structure that envelopes it must be carefully managed to avoid violating constraints expressed in the TrustAnchorInfo. When enveloping a certificate in a TrustAnchorInfo structure, values included in the certificate should be evaluated to ensure there is no confusion or conflict with values in the TrustAnchorInfo structure.
必须仔细管理独立于TrustAnchorInfo结构的证书的使用，以避免违反TrustAnchorInfo中表示的约束。在TrustAnchorInfo结构中封装证书时，应评估证书中包含的值，以确保与TrustAnchorInfo结构中的值没有混淆或冲突。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.
[RFC3629]Yergeau，F.，“UTF-8，ISO 10646的转换格式”，STD 63，RFC 3629，2003年11月。
[RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", RFC 5652, September 2009.
[RFC5652]Housley，R.，“加密消息语法（CMS）”，RFC 56522009年9月。
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008.
[RFC5280]Cooper，D.，Santesson，S.，Farrell，S.，Boeyen，S.，Housley，R.，和W.Polk，“Internet X.509公钥基础设施证书和证书撤销列表（CRL）配置文件”，RFC 52802008年5月。
[RFC5646] Phillips, A. and M. Davis, "Tags for Identifying Languages", BCP 47, RFC 5646, September 2009.
[RFC5646]Phillips，A.和M.Davis，“识别语言的标记”，BCP 47，RFC 5646，2009年9月。
[RFC5912] Hoffman, P. and J. Schaad, "New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)", RFC 5912, June 2010.
[RFC5912]Hoffman，P.和J.Schaad，“使用X.509（PKIX）的公钥基础设施的新ASN.1模块”，RFC 5912，2010年6月。
[X.680] "ITU-T Recommendation X.680: Information Technology - Abstract Syntax Notation One", 2002.
[X.680]“ITU-T建议X.680：信息技术——抽象语法符号1”，2002年。
[TA-MGMT-REQS] Reddy, R. and C. Wallace, "Trust Anchor Management Requirements", Work in Progress, March 2010.
[TA-MGMT-REQS]Reddy，R.和C.Wallace，“信托锚管理要求”，正在进行的工作，2010年3月。
[X.509] "ITU-T Recommendation X.509 - The Directory - Authentication Framework", 2000.
[X.509]“ITU-T建议X.509——目录——认证框架”，2000年。
Appendix A.1 provides the normative ASN.1 definitions for the structures described in this specification using ASN.1 as defined in [X.680]. It includes definitions imported from [RFC5280] and [RFC5912].
附录A.1使用[X.680]中定义的ASN.1为本规范中描述的结构提供了规范性ASN.1定义。它包括从[RFC5280]和[RFC5912]导入的定义。
TrustAnchorInfoModule
{ joint-iso-ccitt(2) country(16) us(840) organization(1)
gov(101) dod(2) infosec(1) modules(0) 33 }
TrustAnchorInfoModule
{ joint-iso-ccitt(2) country(16) us(840) organization(1)
gov(101) dod(2) infosec(1) modules(0) 33 }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
IMPORTS
Certificate, Name, SubjectPublicKeyInfo, TBSCertificate
FROM PKIX1Explicit-2009 -- from [RFC5912]
{iso(1) identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)}
CertificatePolicies, KeyIdentifier, NameConstraints
FROM PKIX1Implicit-2009 -- from [RFC5912]
{iso(1) identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-implicit-02(59)}
Extensions{}
FROM PKIX-CommonTypes-2009 -- from [RFC5912]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) } ;
IMPORTS
Certificate, Name, SubjectPublicKeyInfo, TBSCertificate
FROM PKIX1Explicit-2009 -- from [RFC5912]
{iso(1) identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)}
CertificatePolicies, KeyIdentifier, NameConstraints
FROM PKIX1Implicit-2009 -- from [RFC5912]
{iso(1) identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-implicit-02(59)}
Extensions{}
FROM PKIX-CommonTypes-2009 -- from [RFC5912]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57) } ;
TrustAnchorInfo ::= SEQUENCE {
version TrustAnchorInfoVersion DEFAULT v1,
pubKey SubjectPublicKeyInfo,
keyId KeyIdentifier,
taTitle TrustAnchorTitle OPTIONAL,
certPath CertPathControls OPTIONAL,
exts [1] EXPLICIT Extensions {{...}} OPTIONAL,
taTitleLangTag [2] UTF8String OPTIONAL }
TrustAnchorInfo ::= SEQUENCE {
version TrustAnchorInfoVersion DEFAULT v1,
pubKey SubjectPublicKeyInfo,
keyId KeyIdentifier,
taTitle TrustAnchorTitle OPTIONAL,
certPath CertPathControls OPTIONAL,
exts [1] EXPLICIT Extensions {{...}} OPTIONAL,
taTitleLangTag [2] UTF8String OPTIONAL }
TrustAnchorInfoVersion ::= INTEGER { v1(1) }
TrustAnchorInfoVersion ::= INTEGER { v1(1) }
TrustAnchorTitle ::= UTF8String (SIZE (1..64))
TrustAnchorTitle ::= UTF8String (SIZE (1..64))
CertPathControls ::= SEQUENCE {
taName Name,
certificate [0] Certificate OPTIONAL,
policySet [1] CertificatePolicies OPTIONAL,
CertPathControls ::= SEQUENCE {
taName Name,
certificate [0] Certificate OPTIONAL,
policySet [1] CertificatePolicies OPTIONAL,
policyFlags [2] CertPolicyFlags OPTIONAL, nameConstr [3] NameConstraints OPTIONAL, pathLenConstraint[4] INTEGER (0..MAX) OPTIONAL}
policyFlags[2]CertPolicyFlags可选，NameConst[3]NameConstraints可选，pathLenConstraint[4]整数（0..MAX）可选}
CertPolicyFlags ::= BIT STRING {
inhibitPolicyMapping (0),
requireExplicitPolicy (1),
inhibitAnyPolicy (2) }
CertPolicyFlags ::= BIT STRING {
inhibitPolicyMapping (0),
requireExplicitPolicy (1),
inhibitAnyPolicy (2) }
TrustAnchorList ::= SEQUENCE SIZE (1..MAX) OF TrustAnchorChoice
TrustAnchorList ::= SEQUENCE SIZE (1..MAX) OF TrustAnchorChoice
TrustAnchorChoice ::= CHOICE {
certificate Certificate,
tbsCert [1] EXPLICIT TBSCertificate,
taInfo [2] EXPLICIT TrustAnchorInfo }
TrustAnchorChoice ::= CHOICE {
certificate Certificate,
tbsCert [1] EXPLICIT TBSCertificate,
taInfo [2] EXPLICIT TrustAnchorInfo }
id-ct-trustAnchorList OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
id-smime(16) id-ct(1) 34 }
id-ct-trustAnchorList OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
id-smime(16) id-ct(1) 34 }
PKCS7-CONTENT-TYPE ::= TYPE-IDENTIFIER
PKCS7-CONTENT-TYPE ::= TYPE-IDENTIFIER
trust-anchor-list PKCS7-CONTENT-TYPE ::=
{ TrustAnchorList IDENTIFIED BY id-ct-trustAnchorList }
trust-anchor-list PKCS7-CONTENT-TYPE ::=
{ TrustAnchorList IDENTIFIED BY id-ct-trustAnchorList }
END
终止
Appendix A.2 provides the normative ASN.1 definitions for the structures described in this specification using ASN.1 as defined in [X.680].
附录A.2使用[X.680]中定义的ASN.1为本规范中描述的结构提供了规范性ASN.1定义。
TrustAnchorInfoModule-88
{ joint-iso-ccitt(2) country(16) us(840) organization(1)
gov(101) dod(2) infosec(1) modules(0) 37 }
TrustAnchorInfoModule-88
{ joint-iso-ccitt(2) country(16) us(840) organization(1)
gov(101) dod(2) infosec(1) modules(0) 37 }
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
DEFINITIONS IMPLICIT TAGS ::=
BEGIN
IMPORTS
Certificate, Name, Extensions,
SubjectPublicKeyInfo, TBSCertificate
FROM PKIX1Explicit88 -- from [RFC5280]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
IMPORTS
Certificate, Name, Extensions,
SubjectPublicKeyInfo, TBSCertificate
FROM PKIX1Explicit88 -- from [RFC5280]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-explicit(18) }
CertificatePolicies, KeyIdentifier, NameConstraints
FROM PKIX1Implicit88 -- [RFC5280]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-implicit(19) }
;
id-pkix1-explicit(18) }
CertificatePolicies, KeyIdentifier, NameConstraints
FROM PKIX1Implicit88 -- [RFC5280]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-implicit(19) }
;
TrustAnchorInfo ::= SEQUENCE {
version TrustAnchorInfoVersion DEFAULT v1,
pubKey SubjectPublicKeyInfo,
keyId KeyIdentifier,
taTitle TrustAnchorTitle OPTIONAL,
certPath CertPathControls OPTIONAL,
exts [1] EXPLICIT Extensions OPTIONAL,
taTitleLangTag [2] UTF8String OPTIONAL }
TrustAnchorInfo ::= SEQUENCE {
version TrustAnchorInfoVersion DEFAULT v1,
pubKey SubjectPublicKeyInfo,
keyId KeyIdentifier,
taTitle TrustAnchorTitle OPTIONAL,
certPath CertPathControls OPTIONAL,
exts [1] EXPLICIT Extensions OPTIONAL,
taTitleLangTag [2] UTF8String OPTIONAL }
TrustAnchorInfoVersion ::= INTEGER { v1(1) }
TrustAnchorInfoVersion ::= INTEGER { v1(1) }
TrustAnchorTitle ::= UTF8String (SIZE (1..64))
TrustAnchorTitle ::= UTF8String (SIZE (1..64))
CertPathControls ::= SEQUENCE {
taName Name,
certificate [0] Certificate OPTIONAL,
policySet [1] CertificatePolicies OPTIONAL,
policyFlags [2] CertPolicyFlags OPTIONAL,
nameConstr [3] NameConstraints OPTIONAL,
pathLenConstraint[4] INTEGER (0..MAX) OPTIONAL}
CertPathControls ::= SEQUENCE {
taName Name,
certificate [0] Certificate OPTIONAL,
policySet [1] CertificatePolicies OPTIONAL,
policyFlags [2] CertPolicyFlags OPTIONAL,
nameConstr [3] NameConstraints OPTIONAL,
pathLenConstraint[4] INTEGER (0..MAX) OPTIONAL}
CertPolicyFlags ::= BIT STRING {
inhibitPolicyMapping (0),
requireExplicitPolicy (1),
inhibitAnyPolicy (2) }
CertPolicyFlags ::= BIT STRING {
inhibitPolicyMapping (0),
requireExplicitPolicy (1),
inhibitAnyPolicy (2) }
TrustAnchorList ::= SEQUENCE SIZE (1..MAX) OF TrustAnchorChoice
TrustAnchorList ::= SEQUENCE SIZE (1..MAX) OF TrustAnchorChoice
TrustAnchorChoice ::= CHOICE {
certificate Certificate,
tbsCert [1] EXPLICIT TBSCertificate,
taInfo [2] EXPLICIT TrustAnchorInfo }
TrustAnchorChoice ::= CHOICE {
certificate Certificate,
tbsCert [1] EXPLICIT TBSCertificate,
taInfo [2] EXPLICIT TrustAnchorInfo }
id-ct-trustAnchorList OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
id-smime(16) id-ct(1) 34 }
id-ct-trustAnchorList OBJECT IDENTIFIER ::= { iso(1)
member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9)
id-smime(16) id-ct(1) 34 }
END
终止
Authors' Addresses
作者地址
Russ Housley Vigil Security, LLC 918 Spring Knoll Drive Herndon, VA 20170
Russ Housley Vigil Security，LLC，弗吉尼亚州赫恩登斯普林诺尔大道918号，邮编20170
EMail: housley@vigilsec.com
EMail: housley@vigilsec.com
Sam Ashmore National Security Agency Suite 6751 9800 Savage Road Fort Meade, MD 20755
美国马里兰州米德堡萨维奇路6751 9800号Sam Ashmore国家安全局套房20755
EMail: srashmo@radium.ncsc.mil
EMail: srashmo@radium.ncsc.mil
Carl Wallace Cygnacom Solutions Suite 5400 7925 Jones Branch Drive McLean, VA 22102
卡尔·华莱士·辛尼亚康解决方案套房5400 7925弗吉尼亚州麦克莱恩琼斯支路22102
EMail: cwallace@cygnacom.com
EMail: cwallace@cygnacom.com