LAMPS R. Housley Internet-Draft Vigil Security Updates: 6211 (if approved) S. Turner Intended status: Standards Track sn3rd Expires: 2 March 2027 29 August 2026 Update to the Cryptographic Message Syntax (CMS) Algorithm Identifier Protection Attribute draft-ietf-lamps-rfc6211-update-00 Abstract This document updates RFC 6211. It corrects an error in definition of the id-aa-CMSAlgorithmProtection ASN.1 object identifier. The IANA registry entry has alway been correct. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 2 March 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Housley & Turner Expires 2 March 2027 [Page 1] Internet-Draft Update to RFC 6211 August 2026 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Update to Section 2 of RFC 6211 . . . . . . . . . . . . . . . 2 3. Update to Appendix A of RFC 6211 . . . . . . . . . . . . . . 3 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 3 5. Security Considerations . . . . . . . . . . . . . . . . . . . 3 6. References . . . . . . . . . . . . . . . . . . . . . . . . . 3 6.1. Normative References . . . . . . . . . . . . . . . . . . 3 6.2. Informative References . . . . . . . . . . . . . . . . . 3 Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 4 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 4 1. Introduction This document corrects a mistake in [RFC6211]. It corrects an error in definition of the id-aa-CMSAlgorithmProtection ASN.1 object identifier. The IANA registry entry for this ASN.1 object identifier does not need to be updated; it has always been correct. The authors are aware of two implementations of RFC 6211, but they did not interoperate because one used the ASN.1 object identifier from RFC 6211 and the other used the ASN.1 object identifier from the IANA registry. The mistakes were reported in [Err9144] and [Err9145]. This update to RFC 6211 will hopefully resolve future interoperability troubles. 2. Update to Section 2 of RFC 6211 OLD: The following object identifier identifies the algorithm protection attribute: id-aa-CMSAlgorithmProtection OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9) 52 } NEW: Housley & Turner Expires 2 March 2027 [Page 2] Internet-Draft Update to RFC 6211 August 2026 The following object identifier identifies the algorithm protection attribute: id-aa-CMSAlgorithmProtection OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9) smime(16) aa(2) 52 } 3. Update to Appendix A of RFC 6211 OLD: id-aa-cmsAlgorithmProtect OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9) 52 } NEW: id-aa-cmsAlgorithmProtect OBJECT IDENTIFIER ::= { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs9(9) smime(16) aa(2) 52 } 4. IANA Considerations No IANA registr updates are needed. The IANA registry is correct. 5. Security Considerations The CMS attribute specified in [RFC6211] is designed to address the security issue of algorithm substitutions. That is, the originator uses one algorithm, an attacker modifies the message, and then the validator uses a different algorithm. The specified protection is not successful unless all implementers use the same ASN.1 object identifier for the attribute. 6. References 6.1. Normative References [RFC6211] Schaad, J., "Cryptographic Message Syntax (CMS) Algorithm Identifier Protection Attribute", RFC 6211, DOI 10.17487/RFC6211, April 2011, . 6.2. Informative References [Err9144] RFC Editor, "RFC 6211 Errata Report ID 9144", 19 August 2026, . Housley & Turner Expires 2 March 2027 [Page 3] Internet-Draft Update to RFC 6211 August 2026 [Err9145] RFC Editor, "RFC 6211 Errata Report ID 9145", 19 August 2026, . Acknowledgments Thanks to Paul Timmel for being the first person to spot the error in [RFC6211]. Authors' Addresses Russ Housley Vigil Security, LLC Herndon, VA, United States of America Email: housley@vigilsec.com Sean Turner sn3rd llc Washington, DC, United States of America Email: sean@sn3rd.com Housley & Turner Expires 2 March 2027 [Page 4]