X.509 Certificate Extension for Secure/Multipurpose Internet Mail Extensions (S/MIME) Capabilities
RFC 4262

Document Type RFC - Proposed Standard (December 2005; No errata)
Author Stefan Santesson 
Last updated 2015-10-14
Stream IETF
Formats plain text html pdf htmlized bibtex
Stream WG state (None)
Document shepherd No shepherd assigned
IESG IESG state RFC 4262 (Proposed Standard)
Action Holders
Consensus Boilerplate Unknown
Telechat date
Responsible AD Russ Housley
Send notices to turners@ieca.com
Network Working Group                                       S. Santesson
Request for Comments: 4262                                     Microsoft
Category: Standards Track                                  December 2005

                    X.509 Certificate Extension for
   Secure/Multipurpose Internet Mail Extensions (S/MIME) Capabilities

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2005).


   This document defines a certificate extension for inclusion of
   Secure/Multipurpose Internet Mail Extensions (S/MIME) Capabilities in
   X.509 public key certificates, as defined by RFC 3280.  This
   certificate extension provides an optional method to indicate the
   cryptographic capabilities of an entity as a complement to the S/MIME
   Capabilities signed attribute in S/MIME messages according to RFC

1.  Introduction

   This document defines a certificate extension for inclusion of S/MIME
   Capabilities in X.509 public key certificates, as defined by RFC 3280

   The S/MIME Capabilities attribute, defined in RFC 3851 [RFC3851], is
   defined to indicate cryptographic capabilities of the sender of a
   signed S/MIME message.  This information can be used by the recipient
   in subsequent S/MIME secured exchanges to select appropriate
   cryptographic properties.

   However, S/MIME does involve also the scenario where, for example, a
   sender of an encrypted message has no prior established knowledge of
   the recipient's cryptographic capabilities through recent S/MIME

Santesson                   Standards Track                     [Page 1]
RFC 4262             S/MIME Capabilities Extensions        December 2005

   In such a case, the sender is forced to rely on out-of-band means or
   its default configuration to select a content encryption algorithm
   for encrypted messages to recipients with unknown capabilities.  Such
   default configuration may, however, be incompatible with the
   recipient's capabilities and/or security policy.

   The solution defined in this specification leverages the fact that
   S/MIME encryption requires possession of the recipient's public key
   certificate.  This certificate already contains information about the
   recipient's public key and the cryptographic capabilities of this
   key.  Through the extension mechanism defined in this specification,
   the certificate may also identify the subject's cryptographic S/MIME
   capabilities.  This may then be used as an optional information
   resource to select appropriate encryption settings for the

   This document is limited to the "static" approach where asserted
   cryptographic capabilities remain unchanged until the certificate
   expires or is revoked.  Other "dynamic" approaches, which allow
   retrieval of certified dynamically updateable capabilities during the
   lifetime of a certificate, are out of scope of this document.

1.1.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   document are to be interpreted as described in RFC 2119 [STDWORDS].

2.  S/MIME Capabilities Extension

   This section defines the S/MIME Capabilities extension.

   The S/MIME Capabilities extension data structure used in this
   specification is identical to the data structure of the
   SMIMECapabilities attribute defined in RFC 3851 [RFC3851].  (The
   ASN.1 structure of smimeCapabilities is included below for
   illustrative purposes only.)

      smimeCapabilities OBJECT IDENTIFIER ::=
         {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
         pkcs-9(9) 15}

      SMIMECapabilities ::= SEQUENCE OF SMIMECapability

      SMIMECapability ::= SEQUENCE {
         capabilityID OBJECT IDENTIFIER,
         parameters ANY DEFINED BY capabilityID OPTIONAL }

Santesson                   Standards Track                     [Page 2]
RFC 4262             S/MIME Capabilities Extensions        December 2005

   All content requirements defined for the SMIMECapabilities attribute
   in RFC 3851 apply also to this extension.

   There are numerous different types of S/MIME Capabilities that have
   been defined in various documents.  While all of the different
   capabilities can be placed in this extension, the intended purpose of
   this specification is mainly to support inclusion of S/MIME
   Capabilities specifying content encryption algorithms.

   Certification Authorities (CAs) SHOULD limit the type of included
   S/MIME Capabilities in this extension to types that are considered
Show full document text