GB/T 29243-2012Information security technology - Specifications of delegated certification path construction and delegated validation for digital certificate (English PDF)

Foreword

This standard was drafted in accordance with GB/T 1.1-2009 given rules.

This standard by the National Safety Standardization Technical Committee (SAC/TC260) and focal points.

This standard was drafted. CAS data protection and Communication Research and Education Center.

This standard was first formulated.

Introduction

With the promotion of "People's Republic of China Electronic Signature Law", the construction of the application of electronic authentication services and PKI system also entered A new stage of development. At the same time, with the further development of the Internet, more types of terminal access network. For certain types of terminals, Such as mobile phones, sensors, etc., due to limitations of its computing or communication resources, it is difficult to complete its certification path is constructed or independent verification certificate is required PKI system provides agency services to assist in the completion of these two tasks.

For PKI relying party, the certificate authority certificate path construction and validation process is necessary, but the process required in the certificate Find, locate revocation information, Certificate/CRL verification calculation, require larger bandwidth and computing resources consumption, limited computing or communication resources There will be varying degrees of difficulty under the circumstances. Agent technology is an important way to solve these difficulties, the authentication certificate path construction or inspection certificate Permit delegated to the proxy server, can greatly reduce the computational burden PKI client communication and consumption.

Acting certification path construction and proxy authentication are two different security level agency services. For proxy certification path construction, agent Verify that the server returns the full path to the certificate required (including the certificate chain, CRL, OCSP communications messages, etc.), and then the client's own authenticating. Under this approach can significantly reduce the communication cost the client, and does not require the client to trust the server; for proxy authentication, Proxy servers are returned directly to verify the certificate is valid. In this way the client computational load and communication cost are significantly reduced, But the client should trust the proxy server. To meet the needs of different security level of transactions, general requirements for PKI systems offer both Different services.

This standard defines the agent certification path construction and proxy authentication to the service concept and protocol requirements, and according to the agreement required to give a Species standardized client and server interaction agency services agreement.

1 Scope

This standard specifies the digital certificate path construction and proxy authentication proxy authentication to service concept and protocol requirements, and to meet the protocol Proxy service protocol requirements.

Implementation and application of this standard applies to the PKI system operators proxy agent certification path construction and validation services.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version suitable for use herein Member. For undated references, the latest edition (including any amendments) applies to this document.

GB/T 16263.1-2006 Information technology - ASN.1 encoding rules Part 1. Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER) specification

GB/T 16264.8-2005 Information technology - OSI Directory - Part 8. a public key and attribute certificate frameworks

RFC 3852 password message syntax (Cryptographic Message Syntax, CMS)

3 Terms and Definitions

GB/T 16264.8-2005 and as defined in the following terms and definitions apply to this document.