X.509 Certificate Extended Key Usage (EKU) for Instant Messaging URIs
Internet-Draft draft-ietf-lamps-im-keyusage-03
Rohan Mahy
Rohan Mahy Consulting Services
rohan.ietf@gmail.com
04 November 2024
SEC
LAMPS WG
x.509
certificate
extended key usage
eku
instant messaging
im URI
mimi URL
RFC 5280 specifies several extended key purpose identifiers (KeyPurposeIds) for X.509 certificates. This document defines Instant Messaging (IM) identity KeyPurposeId for inclusion in the Extended Key Usage (EKU) extension of X.509 v3 public key certificates
About This Document
The latest revision of this draft can be found at https://rohanmahy.github.io/mahy-lamps-im-keyusage/draft-ietf-lamps-im-keyusage.html. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-ietf-lamps-im-keyusage/.
Discussion of this document takes place on the LAMPS WG Working Group mailing list (mailto:lamps@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/lamps/. Subscribe at https://www.ietf.org/mailman/listinfo/lamps/.
Source for this draft and an issue tracker can be found at https://github.com/rohanmahy/mahy-lamps-im-keyusage.
Introduction
Instant Messaging (IM) systems using the Messaging Layer Security (MLS) [RFC9420] protocol can incorporate per-client identity certificate credentials. The subjectAltName of these certificates can be an IM URI or XMPP URI, for example.
Organizations may be unwilling to issue certificates for Instant Message client using a general KeyPurposeId such as id-kp-serverAuth or id-kp-clientAuth, because of the risk that such certificates could be abused in a cross-protocol attack.
An explanation of MLS credentials as they apply to Instant Messaging is described in [I-D.barnes-mimi-identity-arch]. These credentials are expected to be heavily used in the More Instant Messaging Interoperability (MIMI) Working Group.
Conventions and Definitions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.
The IM URI Extended Key Usage
This specification defines the KeyPurposeId id-kp-imUri, which MAY be included in certificates used to prove the identity of an Instant Messaging client. This Extended Key Usage is optionally critical.

id-kp  OBJECT IDENTIFIER  ::= {
  iso(1) identified-organization(3) dod(6) internet(1)
  security(5) mechanisms(5) pkix(7) kp(3) }

id-kp-imUri OBJECT IDENTIFIER ::= { id-kp TBD1 }

Security Considerations
The Security Considerations of [RFC5280] are applicable to this document. This extended key purpose does not introduce new security risks but instead reduces existing security risks by providing means to identify if the certificate is generated to sign IM identity credentials.
IANA Considerations
IANA is requested to register the following OIDs in the "SMI Security for PKIX Extended Key Purpose" registry (1.3.6.1.5.5.7.3). These OIDs are defined in Section 4.
Decimal | Description | References
TBD1 | id-kp-imUri | This-RFC
IANA is also requested to register the following ASN.1 [ITU.X690.2021] module OID in the "SMI Security for PKIX Module Identifier" registry (1.3.6.1.5.5.7.0). This OID is defined in Appendix A.
Decimal | Description | References
TBD2 | id-mod-im-eku | This-RFC
References
Normative References
[ITU.X690.2021]

Information Technology - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)
International Telecommunications Union
2021
ITU-T Recommendation X.690
[ITU.X680.2021]

Information Technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation
International Telecommunications Union
2021
ITU-T Recommendation X.680
[RFC2119]

Key words for use in RFCs to Indicate Requirement Levels
S. Bradner
March 1997
BCP 14
RFC 2119
DOI 10.17487/RFC2119
[RFC8174]

Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
B. Leiba
May 2017
BCP 14
RFC 8174
DOI 10.17487/RFC8174
[RFC5280]

Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
D. Cooper
S. Santesson
S. Farrell
S. Boeyen
R. Housley
W. Polk
May 2008
RFC 5280
DOI 10.17487/RFC5280
Informative References
[RFC9420]

The Messaging Layer Security (MLS) Protocol
R. Barnes
B. Beurdouche
R. Robert
J. Millican
E. Omara
K. Cohn-Gordon
July 2023
RFC 9420
DOI 10.17487/RFC9420
[I-D.barnes-mimi-identity-arch]

Identity for E2E-Secure Communications
Richard Barnes
Cisco
Rohan Mahy
Wire
23 October 2023
Internet-Draft draft-barnes-mimi-identity-arch-01
ASN.1 Module
The following module adheres to ASN.1 specifications [ITU.X680.2021] and [ITU.X690.2021].

<CODE BEGINS>

IM-EKU
  { iso(1) identified-organization(3) dod(6) internet(1)
  security(5) mechanisms(5) pkix(7) id-mod(0)
  id-mod-im-eku (TBD2) }

DEFINITIONS IMPLICIT TAGS ::=
BEGIN

-- OID Arc

id-kp OBJECT IDENTIFIER ::=
  { iso(1) identified-organization(3) dod(6) internet(1)
    security(5) mechanisms(5) pkix(7) kp(3) }

-- Extended Key Usage Values

id-kp-imUri OBJECT IDENTIFIER ::= { id-kp TBD1 }

END

<CODE ENDS>

Change log
RFC Editor, please remove this section on publication.
- made Proposed Standard
- added a MAY statement in Section 3
- corrected typo in registration of the ASN.1 module (Thanks Sean!)
- updated author affiliation
- added ASN.1 module
- specified that eku is optionally critical
Acknowledgments
Thanks to Sean Turner and Russ Housley for reviews, suggestions, corrections, and encouragement.