RFC 1114 (rfc1114) - Page 2 of 25
Privacy enhancement for Internet electronic mail: Part II - certificate-based key management
Alternative Format: Original Text Document
RFC 1114 Mail Privacy: Key Management August 1989
3.4.1.7 Certificate Signature 20
3.4.2 Validation Conventions 20
3.4.3 Relation with X.509 Certificate Specification 22
NOTES 24
1. Executive Summary
This is one of a series of RFCs defining privacy enhancement
mechanisms for electronic mail transferred using Internet mail
protocols. RFC-1113 (the successor to RFC 1040) prescribes protocol
extensions and processing procedures for RFC-822 mail messages, given
that suitable cryptographic keys are held by originators and
recipients as a necessary precondition. RFC-1115 specifies
algorithms for use in processing privacy-enhanced messages, as called
for in RFC-1113. This RFC defines a supporting key management
architecture and infrastructure, based on public-key certificate
techniques, to provide keying information to message originators and
recipients. A subsequent RFC, the fourth in this series, will
provide detailed specifications, paper and electronic application
forms, etc. for the key management infrastructure described herein.
The key management architecture described in this RFC is compatible
with the authentication framework described in X.509. The major
contributions of this RFC lie not in the specification of computer
communication protocols or algorithms but rather in procedures and
conventions for the key management infrastructure. This RFC
incorporates numerous conventions to facilitate near term
implementation. Some of these conventions may be superceded in time
as the motivations for them no longer apply, e.g., when X.500 or
similar directory servers become well established.
The RSA cryptographic algorithm, covered in the U.S. by patents
administered through RSA Data Security, Inc. (hereafter abbreviated
RSADSI) has been selected for use in this key management system.
This algorithm has been selected because it provides all the
necessary algorithmic facilities, is "time tested" and is relatively
efficient to implement in either software or hardware. It is also
the primary algorithm identified (at this time) for use in
international standards where an asymmetric encryption algorithm is
required. Protocol facilities (e.g., algorithm identifiers) exist to
permit use of other asymmetric algorithms if, in the future, it
becomes appropriate to employ a different algorithm for key
management. However, the infrastructure described herein is specific
to use of the RSA algorithm in many respects and thus might be
different if the underlying algorithm were to change.
Current plans call for RSADSI to act in concert with subscriber
organizations as a "certifying authority" in a fashion described
Kent & Linn