RFC 3850 (rfc3850) - Page 2 of 16

Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3

RFC 3850            S/MIME 3.1 Certificate Handling            July 2004


       4.4.  PKIX Certificate Extensions. . . . . . . . . . . . . . .  9
   5.  Security Considerations. . . . . . . . . . . . . . . . . . . . 11
   A.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 13
       A.1.  Normative References . . . . . . . . . . . . . . . . . . 13
       A.2.  Informative References . . . . . . . . . . . . . . . . . 14
   B.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 15
   C.  Editor's Address . . . . . . . . . . . . . . . . . . . . . . . 15
   Full Copyright Statement . . . . . . . . . . . . . . . . . . . . . 16

1.  Overview

   S/MIME (Secure/Multipurpose Internet Mail Extensions), described in
   [SMIME-MSG], provides a method to send and receive secure MIME
   messages.  Before using a public key to provide security services,
   the S/MIME agent MUST verify that the public key is valid.  S/MIME
   agents MUST use PKIX certificates to validate public keys as
   described in the Internet X.509 Public Key Infrastructure (PKIX)
   Certificate and CRL Profile [KEYM].  S/MIME agents MUST meet the
   certificate processing requirements documented in this document in
   addition to those stated in [KEYM].

   This specification is compatible with the Cryptographic Message
   Syntax [CMS] in that it uses the data types defined by CMS.  It also
   inherits all the varieties of architectures for certificate-based key
   management supported by CMS.

1.1.  Definitions

   For the purposes of this document, the following definitions apply.

   ASN.1: Abstract Syntax Notation One, as defined in ITU-T X.208
   [X.208-88].

   Attribute Certificate (AC): An X.509 AC is a separate structure from
   a subject's public key X.509 Certificate.  A subject may have
   multiple X.509 ACs associated with each of its public key X.509
   Certificates.  Each X.509 AC binds one or more Attributes with one of
   the subject's public key X.509 Certificates.  The X.509 AC syntax is
   defined in [ACAUTH].

   Certificate:  A type that binds an entity's name to a public key with
   a digital signature.  This type is defined in the Internet X.509
   Public Key Infrastructure (PKIX) Certificate and CRL Profile [KEYM].
   This type also contains the distinguished name of the certificate
   issuer (the signer), an issuer-specific serial number, the issuer's
   signature algorithm identifier, a validity period, and extensions
   also defined in that document.




Ramsdell                    Standards Track