Skip to content

Commit be57f0e

Browse files
sujithhanwhasujithhanwha
authored
refactored security baseline (#737)
1 parent 503cad8 commit be57f0e

File tree

1 file changed

+191
-42
lines changed

1 file changed

+191
-42
lines changed

‎doc/SecurityBaseline.xml‎

Lines changed: 191 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,8 @@
7575
<para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink"
7676
xlink:href="http://www.ietf.org/rfc/rfc5280.txt"
7777
>http://www.ietf.org/rfc/rfc5280.txt</link>&gt;</para>
78+
<para>RFC 5480 - Elliptic Curve Cryptography Subject Public Key Information</para>
79+
<para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://datatracker.ietf.org/doc/html/rfc5480"/>&gt;</para>
7880
<para>RFC 5758 - Internet X.509 Public Key Infrastructure: Additional Algorithms and Identifiers for DSA and ECDSA</para>
7981
<para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://datatracker.ietf.org/doc/html/rfc5758"/>&gt;</para>
8082
<para>RFC 5869 - HMAC-based Extract-and-Expand Key Derivation Function (HKDF)</para>
@@ -83,6 +85,8 @@
8385
<para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://datatracker.ietf.org/doc/html/rfc7292"/>&gt;</para>
8486
<para>RFC 7714 - AES-GCM Authenticated Encryption in the Secure Real-time Transport Protocol (SRTP)</para>
8587
<para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://datatracker.ietf.org/doc/html/rfc7714"/>&gt;</para>
88+
<para>RFC 7519 - JSON Web Token (JWT)</para>
89+
<para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://datatracker.ietf.org/doc/html/rfc7519"/>&gt;</para>
8690
<para>RFC 8017 - PKCS #1: RSA Cryptography Specifications Version 2.2</para>
8791
<para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://datatracker.ietf.org/doc/html/rfc8017"/>&gt;</para>
8892
<para>RFC 8018 - PKCS #5: Password-Based Cryptography Specification Version 2.1</para>
@@ -91,6 +95,8 @@
9195
<para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://datatracker.ietf.org/doc/html/rfc8439"/>&gt;</para>
9296
<para>RFC 9579 - Use of Password-Based Message Authentication Code 1 (PBMAC1) in PKCS #12 Syntax</para>
9397
<para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://datatracker.ietf.org/doc/html/rfc9579"/>&gt;</para>
98+
<para>ANSI X9.62 - Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Algorithm (ECDSA)</para>
99+
<para>&lt;<link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://webstore.ansi.org/standards/ascx9/ansix9622005"/>&gt;</para>
94100
</chapter>
95101
<chapter>
96102
<title>Definitions</title>
@@ -132,7 +138,7 @@
132138
<title>Overview</title>
133139
<para>The content of this document is based on state of the art technology as published by the American institute NIST and the German department BSI.
134140
Note, that any updates to this specification require a review of implications on technical, profile and addon specifications.</para>
135-
<para>Publication of updates must synchronized with ONVIF Technical and Technical Service Committee</para>
141+
<para>Publication of updates must be synchronized with ONVIF Technical and Technical Service Committee</para>
136142
</chapter>
137143
<chapter>
138144
<title>Asymmetric Encryption Schemes and Key Agreement</title>
@@ -181,6 +187,62 @@
181187
</tbody>
182188
</tgroup>
183189
</table>
190+
<table xml:id="curveTable">
191+
<title>Asymmetric Encryption Algorithm OIDs</title>
192+
<tgroup cols="3">
193+
<colspec colname="c1" colwidth="40*"/>
194+
<colspec colname="c2" colwidth="30*"/>
195+
<colspec colname="c3" colwidth="30*"/>
196+
<thead>
197+
<row>
198+
<entry>
199+
<para>Name</para>
200+
</entry>
201+
<entry>
202+
<para>OID</para>
203+
</entry>
204+
<entry>
205+
<para>Reference</para>
206+
</entry>
207+
</row>
208+
</thead>
209+
<tbody valign="top">
210+
<row>
211+
<entry>
212+
<para>rsaEncryption</para>
213+
</entry>
214+
<entry>
215+
<para>1.2.840.113549.1.1.1</para>
216+
</entry>
217+
<entry>
218+
<para>RFC 8017</para>
219+
</entry>
220+
</row>
221+
<row>
222+
<entry>
223+
<para>secp256r1</para>
224+
</entry>
225+
<entry>
226+
<para>1.2.840.10045.3.1.7</para>
227+
</entry>
228+
<entry>
229+
<para>RFC 5480</para>
230+
</entry>
231+
</row>
232+
<row>
233+
<entry>
234+
<para>secp384r1</para>
235+
</entry>
236+
<entry>
237+
<para>1.3.132.0.34</para>
238+
</entry>
239+
<entry>
240+
<para>RFC 5480</para>
241+
</entry>
242+
</row>
243+
</tbody>
244+
</tgroup>
245+
</table>
184246
</chapter>
185247
<chapter>
186248
<title>Symmetric Encryption Schemes</title>
@@ -246,24 +308,40 @@
246308
</entry>
247309
<entry><para>FIPS 180-4</para></entry>
248310
</row>
311+
<row>
312+
<entry>
313+
<para>SHA-2</para>
314+
</entry>
315+
<entry>
316+
<para>384 Bit</para>
317+
</entry>
318+
<entry><para>FIPS 180-4</para></entry>
319+
</row>
320+
<row>
321+
<entry>
322+
<para>SHA-2</para>
323+
</entry>
324+
<entry>
325+
<para>512 Bit</para>
326+
</entry>
327+
<entry><para>FIPS 180-4</para></entry>
328+
</row>
249329
</tbody>
250330
</tgroup>
251331
</table>
252-
</chapter>
253-
<chapter>
254-
<title>Signatures</title>
255-
<para/>
256-
<table xml:id="sigTable">
257-
<title>Signatures</title>
332+
<table xml:id="hashOidTable">
333+
<title>Standalone Hash Algorithm OIDs</title>
258334
<tgroup cols="3">
259-
<colspec colname="c1" colwidth="52*"/>
260-
<colspec colname="c2" colwidth="12*"/>
261-
<colspec colname="c3" colwidth="12*"/>
335+
<colspec colname="c1" colwidth="40*"/>
336+
<colspec colname="c2" colwidth="30*"/>
337+
<colspec colname="c3" colwidth="30*"/>
262338
<thead>
263339
<row>
264-
<entry><para>Scheme</para></entry>
265340
<entry>
266-
<para>Hash</para>
341+
<para>Name</para>
342+
</entry>
343+
<entry>
344+
<para>OID</para>
267345
</entry>
268346
<entry>
269347
<para>Reference</para>
@@ -272,71 +350,86 @@
272350
</thead>
273351
<tbody valign="top">
274352
<row>
275-
<entry><para>RSA PKCS1 v1_5</para></entry>
276-
<entry><para>SHA 256, SHA 384, SHA 512</para></entry>
277-
<entry><para>RFC 8017 not recommended</para></entry>
353+
<entry>
354+
<para>id-sha256</para>
355+
</entry>
356+
<entry>
357+
<para>2.16.840.1.101.3.4.2.1</para>
358+
</entry>
359+
<entry>
360+
<para>FIPS 180-4</para>
361+
</entry>
278362
</row>
279363
<row>
280-
<entry><para>RSASSA-PSS</para></entry>
281364
<entry>
282-
<para>SHA 256, SHA 384, SHA 512</para>
365+
<para>id-sha384</para>
366+
</entry>
367+
<entry>
368+
<para>2.16.840.1.101.3.4.2.2</para>
369+
</entry>
370+
<entry>
371+
<para>FIPS 180-4</para>
283372
</entry>
284-
<entry><para>RFC 8017</para></entry>
285373
</row>
286374
<row>
287-
<entry><para>ECDSA</para></entry>
288-
<entry><para>SHA 256, SHA 384, SHA 512</para></entry>
289-
<entry><para>RFC 5758, X9.62</para></entry>
375+
<entry>
376+
<para>id-sha512</para>
377+
</entry>
378+
<entry>
379+
<para>2.16.840.1.101.3.4.2.3</para>
380+
</entry>
381+
<entry>
382+
<para>FIPS 180-4</para>
383+
</entry>
290384
</row>
291385
</tbody>
292386
</tgroup>
293387
</table>
294388
</chapter>
295389
<chapter>
296-
<title>Key Derivation</title>
297-
<table xml:id="keyTable">
298-
<title>Key Derivation Functions</title>
390+
<title>Signatures</title>
391+
<para>This chapter defines the signature schemes and their corresponding algorithm OIDs that devices shall support.</para>
392+
<table xml:id="sigTable">
393+
<title>Signature Schemes</title>
299394
<tgroup cols="3">
300-
<colspec colname="c1" colwidth="15*"/>
395+
<colspec colname="c1" colwidth="52*"/>
301396
<colspec colname="c2" colwidth="12*"/>
302397
<colspec colname="c3" colwidth="12*"/>
303398
<thead>
304399
<row>
400+
<entry><para>Scheme</para></entry>
305401
<entry>
306-
<para>Name</para>
402+
<para>Hash</para>
307403
</entry>
308404
<entry>
309405
<para>Reference</para>
310406
</entry>
311-
<entry>
312-
<para>Comment</para>
313-
</entry>
314407
</row>
315408
</thead>
316409
<tbody valign="top">
317410
<row>
318-
<entry>
319-
<para>PBKDF2</para>
320-
</entry>
321-
<entry><para>RFC 8018 &amp; RFC 9579</para></entry>
322-
<entry><para>for passwords</para></entry>
411+
<entry><para>RSA PKCS1 v1_5</para></entry>
412+
<entry><para>SHA 256, SHA 384, SHA 512</para></entry>
413+
<entry><para>RFC 8017 not recommended</para></entry>
323414
</row>
324415
<row>
416+
<entry><para>RSASSA-PSS</para></entry>
325417
<entry>
326-
<para>HKDF</para>
418+
<para>SHA 256, SHA 384, SHA 512</para>
327419
</entry>
328-
<entry><para>RFC 5869</para></entry>
329-
<entry><para>for random keys</para></entry>
420+
<entry><para>RFC 8017</para></entry>
421+
</row>
422+
<row>
423+
<entry><para>ECDSA</para></entry>
424+
<entry><para>SHA 256, SHA 384, SHA 512</para></entry>
425+
<entry><para>RFC 5758, X9.62</para></entry>
330426
</row>
331427
</tbody>
332428
</tgroup>
333429
</table>
334-
</chapter>
335-
<chapter>
336-
<title>Certificates</title>
337-
<para>Requirements for certificate upload and creation.</para>
430+
<para>The signature algorithm OIDs listed below are applicable to certificate signatures as well as other cryptographic operations such as media signing and general-purpose digital signatures.</para>
338431
<table xml:id="signaturesTable">
339-
<title>Signature Baseline</title>
432+
<title>Signature Algorithm OIDs</title>
340433
<tgroup cols="3">
341434
<colspec colname="c1" colwidth="40*"/>
342435
<colspec colname="c2" colwidth="30*"/>
@@ -421,9 +514,65 @@
421514
<para>RFC 5758, X9.62</para>
422515
</entry>
423516
</row>
517+
<row>
518+
<entry>
519+
<para>rsassa-pss</para>
520+
</entry>
521+
<entry>
522+
<para>1.2.840.113549.1.1.10</para>
523+
</entry>
524+
<entry>
525+
<para>RFC 8017</para>
526+
</entry>
527+
</row>
424528
</tbody>
425529
</tgroup>
426530
</table>
531+
</chapter>
532+
<chapter>
533+
<title>Key Derivation</title>
534+
<para/>
535+
<table xml:id="keyTable">
536+
<title>Key Derivation Functions</title>
537+
<tgroup cols="3">
538+
<colspec colname="c1" colwidth="15*"/>
539+
<colspec colname="c2" colwidth="12*"/>
540+
<colspec colname="c3" colwidth="12*"/>
541+
<thead>
542+
<row>
543+
<entry>
544+
<para>Name</para>
545+
</entry>
546+
<entry>
547+
<para>Reference</para>
548+
</entry>
549+
<entry>
550+
<para>Comment</para>
551+
</entry>
552+
</row>
553+
</thead>
554+
<tbody valign="top">
555+
<row>
556+
<entry>
557+
<para>PBKDF2</para>
558+
</entry>
559+
<entry><para>RFC 8018 &amp; RFC 9579</para></entry>
560+
<entry><para>for passwords</para></entry>
561+
</row>
562+
<row>
563+
<entry>
564+
<para>HKDF</para>
565+
</entry>
566+
<entry><para>RFC 5869</para></entry>
567+
<entry><para>for random keys</para></entry>
568+
</row>
569+
</tbody>
570+
</tgroup>
571+
</table>
572+
</chapter>
573+
<chapter>
574+
<title>Private Key Encryption</title>
575+
<para>Requirements for encrypting private keys during certificate upload and creation.</para>
427576
<table xml:id="certTable">
428577
<title>Baseline for Encrypting Private Key</title>
429578
<tgroup cols="3">

0 commit comments

Comments
 (0)