| RFC 9310 | 5G NFTypes in X.509 Certificates | January 2023 |
| Housley, et al. | Standards Track | [Page] |
This document specifies the certificate extension for includingNetwork Function Types (NFTypes) for the 5G System in X.509 v3 publickey certificates as profiled in RFC 5280.¶
This is an Internet Standards Track document.¶
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.¶
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained athttps://www.rfc-editor.org/info/rfc9310.¶
Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
The 3rd Generation Partnership Project (3GPP) has specified severalNetwork Functions (NFs) as part of the service-based architecture withinthe 5G System. There are 56 NF Types defined for 3GPP Release 17; theyare listed in Table 6.1.6.3.3-1 of[TS29.510], and each NF type isidentified by a short ASCII string.¶
Operators of 5G Systems make use of an internal PKI to identifyinterface instances in the NFs in a 5G System. X.509 v3 public keycertificates[RFC5280] are used, and the primary function of acertificate is to bind a public key to the identity of an entity thatholds the corresponding private key, known as the certificate subject.The certificate subject and the SubjectAltName certificate extension canbe used to support identity-based access control decisions.¶
This document specifies the NFTypes certificate extension to supportrole-based access control decisions by providing a list of NF Typesassociated with the certificate subject. The NFTypes certificateextension can be used by operators of 5G Systems or later.¶
The key words "MUST", "MUST NOT","REQUIRED", "SHALL","SHALL NOT", "SHOULD","SHOULD NOT","RECOMMENDED", "NOT RECOMMENDED","MAY", and "OPTIONAL" in this documentare to be interpreted as described in BCP 14[RFC2119][RFC8174] when, and onlywhen, they appear in all capitals, as shown here.¶
This section specifies the NFTypes certificate extension, which providesa list of NF Types associated with the certificate subject.¶
The NFTypes certificate extensionMAY be included in public key certificates[RFC5280]. The NFTypes certificate extensionMUST be identified by thefollowing object identifier:¶
id-pe-nftype OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-pe(1) 34 }¶This extensionMUST NOT be marked critical.¶
The NFTypes extensionMUST have the following syntax:¶
NFTypes ::= SEQUENCE SIZE (1..MAX) OF NFType NFType ::= IA5String (SIZE (1..32))¶
The NFTypesMUST contain at least one NFType.¶
Each NFTypeMUST contain only an ASCII string; however, thestringMUST NOT include control characters (values 0 through 31),the space character (value 32), or the delete character (value 127).¶
Each NFTypeMUST contain at least one ASCII character andMUST NOT contain more than 32 ASCII characters.¶
The NFTypesMUST NOT contain the same NFType more than once.¶
If the NFTypes contain more than one NFType, the NFTypesMUST appear in ascending lexicographic order using the ASCII values.¶
The NFType uses the IA5String type to permit inclusion of the underscorecharacter ('_'), which is not part of the PrintableString character set.¶
This section provides an ASN.1 Module[X.680] for the NFTypescertificate extension, and it follows the conventions establishedin[RFC5912] and[RFC6268].¶
<CODE BEGINS> NFTypeCertExtn { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-nftype(106) } DEFINITIONS IMPLICIT TAGS ::= BEGIN IMPORTS EXTENSION FROM PKIX-CommonTypes-2009 -- RFC 5912 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57) } ; -- NFTypes Certificate Extension ext-NFType EXTENSION ::= { SYNTAX NFTypes IDENTIFIED BY id-pe-nftype } -- NFTypes Certificate Extension OID id-pe-nftype OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-pe(1) 34 } -- NFTypes Certificate Extension Syntax NFTypes ::= SEQUENCE SIZE (1..MAX) OF NFType NFType ::= IA5String (SIZE (1..32)) END<CODE ENDS>¶The security considerations of[RFC5280] are applicable to this document.¶
Some of the ASCII strings that specify the NF Types are standard. SeeAppendix A for values defined in 3GPP Release 17. Additionally, an operatorMAYassign its own NF Types for use in their own network. Since the NF Typeis used for role-based access control decisions, an operator-assignedNF TypeMUST NOT overlap with a value already defined in the commonlydefined set. Use of the same ASCII string by two different operatorsfor different roles could lead to confusion or incorrect access controldecisions. The mechanism for an operator to determine whether an ASCIIstring associated with a NF Type is unique across operators is outsidethe scope of this document.¶
The certificate extension supports many different forms of role-basedaccess control to support the diversity of activities that NFs aretrusted to perform in the overall system. Different levels of confidencethat the NFTypes were properly assigned might be needed to contribute to theoverall security of the 5G System. For example, more confidence might beneeded to make access control decisions related to a scarce resource thanimplementation of filtering policies. As a result, different operatorsmight have different trust models for the NFTypes certificate extension.¶
In some security protocols, such as TLS 1.2[RFC5246], certificates areexchanged in the clear. In other security protocols, such as TLS 1.3[RFC8446],the certificates are encrypted. The inclusion of the NFTypes certificate extensioncan help an observer determine which systems are of most interest based onthe plaintext certificate transmission.¶
For the NFTypes certificate extension defined inSection 3, IANA hasassigned an object identifier (OID) for the certificate extension. TheOID for the certificate extension has been allocated in the "SMI Securityfor PKIX Certificate Extension" registry (1.3.6.1.5.5.7.1).¶
For the ASN.1 Module defined inSection 4, IANA has assigned anOID for the module identifier. The OID for the modulehas been allocated in the "SMI Security for PKIX Module Identifier"registry (1.3.6.1.5.5.7.0).¶
Table 6.1.6.3.3-1 of[TS29.510] defines the ASCII strings for theNF Types specified in 3GPP documents; these enumeration values in 3GPP Release 17 are listed below inascending lexicographic order. This list is not exhaustive.¶
"5G_DDNMF" "LMF" "PKMF" "5G_EIR" "MBSF" "SCEF" "AANF" "MBSTF" "SCP" "ADRF" "MB_SMF" "SCSAS" "AF" "MB_UPF" "SCSCF" "AMF" "MFAF" "SEPP" "AUSF" "MME" "SMF" "BSF" "MNPF" "SMSF" "CBCF" "N3IWF" "SMS_GMSC" "CEF" "NEF" "SMS_IWMSC" "CHF" "NRF" "SOR_AF" "DCCF" "NSACF" "SPAF" "DRA" "NSSAAF" "TSCTSF" "EASDF" "NSSF" "UCMF" "GBA_BSF" "NSWOF" "UDM" "GMLC" "NWDAF" "UDR" "HSS" "PANF" "UDSF" "ICSCF" "PCF" "UPF" "IMS_AS" "PCSCF"¶
The example certificate conforms to the certificate profile inTable 6.1.3c.3-1 of[TS33.310]. In addition, the NFTypescertificate is included with only one NFType, and it is "AMF". TheSubjectAltName certificate extension contains a fully qualified domainname (FQDN) and a uniformResourceIdentifier, which carries theNF Instance ID as specified in Clause 5.3.2 of[TS29.571].¶
-----BEGIN CERTIFICATE-----MIIC0DCCAlagAwIBAgIUDD5o44zEdfSghT2hMK+P/EjGHlowCgYIKoZIzj0EAwMwFTETMBEGA1UECgwKRXhhbXBsZSBDQTAeFw0yMjExMjkxODE0NThaFw0yMzExMjkxODE0NThaMDkxCzAJBgNVBAYTAlVTMSowKAYDVQQKEyE1Z2MubW5jNDAwLm1jYzMxMS4zZ3BwbmV0d29yay5vcmcwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATJ6IFHI683q/JJjsJUfEiRFqGQ6uKDGJ0oqDP6wEhRAuvyEyz5pgRmz/7Mze1+s1qcnPU9mo1vrIW9rjKhb/Hm8H9TPvnMQwCRCtKvCD90MkWvc/G8qyCBpCms3zNOJOijggFBMIIBPTATBggrBgEFBQcBIgQHMAUWA0FNRjAXBgNVHSAEEDAOMAwGCmCGSAFlAwIBMDAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBRMZ5KgwYlYn885mKID55ZcEznIBzAfBgNVHSMEGDAWgBSIf6IE6QtqjXR2+p/xCtRh4PqzNTAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vZXhhbXBsZS5jb20vZXhhbXBsZWNhLmNybDB1BgNVHREBAf8EazBpgjhhbWYxLmNsdXN0ZXIxLm5ldDIuYW1mLjVnYy5tbmM0MDAubWNjMzExLjNncHBuZXR3b3JrLm9yZ4YtdXJuOnV1aWQ6ZjgxZDRmYWUtN2RlYy0xMWQwLWE3NjUtMDBhMGM5MWU2YmY2MAoGCCqGSM49BAMDA2gAMGUCMEtQEut9kelkiMIMR+QzkSNGIuR30Lr23ftarLi9wMp3ZRIJYQgaAWc6gmf3MVAp7QIxAKMoYAtw5srkNjE+Zg6CqEkf9f2banFltRuPbTp4B0Xraz5z/jn3NDPM9ataSHUxOQ==-----END CERTIFICATE-----¶
The following shows the example certificate. The values on the leftare the ASN.1 tag (in hexadecimal) and the length (in decimal).¶
30 720: SEQUENCE {30 598: SEQUENCE {A0 3: [0] {02 1: INTEGER 2 : }02 20: INTEGER : 0C 3E 68 E3 8C C4 75 F4 A0 85 3D A1 30 AF 8F FC : 48 C6 1E 5A30 10: SEQUENCE {06 8: OBJECT IDENTIFIER ecdsaWithSHA384 (1 2 840 10045 4 3 3) : }30 21: SEQUENCE {31 19: SET {30 17: SEQUENCE {06 3: OBJECT IDENTIFIER organizationName (2 5 4 10)0C 10: UTF8String 'Example CA' : } : } : }30 30: SEQUENCE {17 13: UTCTime 29/11/2022 18:14:58 GMT17 13: UTCTime 29/11/2023 18:14:58 GMT : }30 57: SEQUENCE {31 11: SET {30 9: SEQUENCE {06 3: OBJECT IDENTIFIER countryName (2 5 4 6)13 2: PrintableString 'US' : } : }31 42: SET {30 40: SEQUENCE {06 3: OBJECT IDENTIFIER organizationName (2 5 4 10)13 33: PrintableString '5gc.mnc400.mcc311.3gppnetwork.org' : } : } : }30 118: SEQUENCE {30 16: SEQUENCE {06 7: OBJECT IDENTIFIER ecPublicKey (1 2 840 10045 2 1)06 5: OBJECT IDENTIFIER secp384r1 (1 3 132 0 34) : }03 98: BIT STRING : 04 C9 E8 81 47 23 AF 37 AB F2 49 8E C2 54 7C 48 : 91 16 A1 90 EA E2 83 18 9D 28 A8 33 FA C0 48 51 : 02 EB F2 13 2C F9 A6 04 66 CF FE CC CD ED 7E B3 : 5A 9C 9C F5 3D 9A 8D 6F AC 85 BD AE 32 A1 6F F1 : E6 F0 7F 53 3E F9 CC 43 00 91 0A D2 AF 08 3F 74 : 32 45 AF 73 F1 BC AB 20 81 A4 29 AC DF 33 4E 24 : E8 : }A3 321: [3] {30 317: SEQUENCE {30 19: SEQUENCE {06 8: OBJECT IDENTIFIER nfTypes (1 3 6 1 5 5 7 1 34)04 7: OCTET STRING, encapsulates {30 5: SEQUENCE {16 3: IA5String 'AMF' : } : } : }30 23: SEQUENCE {06 3: OBJECT IDENTIFIER certificatePolicies (2 5 29 32)04 16: OCTET STRING, encapsulates {30 14: SEQUENCE {30 12: SEQUENCE {06 10: OBJECT IDENTIFIER '2 16 840 1 101 3 2 1 48 48' : } : } : } : }30 14: SEQUENCE {06 3: OBJECT IDENTIFIER keyUsage (2 5 29 15)01 1: BOOLEAN TRUE04 4: OCTET STRING, encapsulates {03 2: BIT STRING 7 unused bits : '1'B (bit 0) : } : }30 19: SEQUENCE {06 3: OBJECT IDENTIFIER extKeyUsage (2 5 29 37)04 12: OCTET STRING, encapsulates {30 10: SEQUENCE {06 8: OBJECT IDENTIFIER clientAuth (1 3 6 1 5 5 7 3 2) : } : } : }30 29: SEQUENCE {06 3: OBJECT IDENTIFIER subjectKeyIdentifier (2 5 29 14)04 22: OCTET STRING, encapsulates {04 20: OCTET STRING : 4C 67 92 A0 C1 89 58 9F CF 39 98 A2 03 E7 96 5C : 13 39 C8 07 : } : }30 31: SEQUENCE {06 3: OBJECT IDENTIFIER authorityKeyIdentifier (2 5 29 35)04 24: OCTET STRING, encapsulates {30 22: SEQUENCE {80 20: [0] : 88 7F A2 04 E9 0B 6A 8D 74 76 FA 9F F1 0A D4 61 : E0 FA B3 35 : } : } : }30 49: SEQUENCE {06 3: OBJECT IDENTIFIER cRLDistributionPoints (2 5 29 31)04 42: OCTET STRING, encapsulates {30 40: SEQUENCE {30 38: SEQUENCE {A0 36: [0] {A0 34: [0] {86 32: [6] 'http://example.com/exampleca.crl' : } : } : } : } : } : }30 117: SEQUENCE {06 3: OBJECT IDENTIFIER subjectAltName (2 5 29 17)01 1: BOOLEAN TRUE04 107: OCTET STRING, encapsulates {30 105: SEQUENCE {82 56: [2] : 'amf1.cluster1.net2.amf.5gc.mnc400.mcc311.3gppnet' : 'work.org'86 45: [6] : 'urn:uuid:f81d4fae-7dec-11d0-a765-00a0c91e6bf6' : } : } : } : } : } : }30 10: SEQUENCE {06 8: OBJECT IDENTIFIER ecdsaWithSHA384 (1 2 840 10045 4 3 3) : }03 104: BIT STRING, encapsulates {30 101: SEQUENCE {02 48: INTEGER : 4B 50 12 EB 7D 91 E9 64 88 C2 0C 47 E4 33 91 23 : 46 22 E4 77 D0 BA F6 DD FB 5A AC B8 BD C0 CA 77 : 65 12 09 61 08 1A 01 67 3A 82 67 F7 31 50 29 ED02 49: INTEGER : 00 A3 28 60 0B 70 E6 CA E4 36 31 3E 66 0E 82 A8 : 49 1F F5 FD 9B 6A 71 65 B5 1B 8F 6D 3A 78 07 45 : EB 6B 3E 73 FE 39 F7 34 33 CC F5 AB 5A 48 75 31 : 39 : } : } : }¶Many thanks toBen Smeets,Michael Li,Tim Hollebeek,Roman Danyliw,Bernie Volz, andÉric Vyncke for their review, comments, and assistance.¶