Skip to content

STANDARDS.md

Latest commit

 

History

History
309 lines (202 loc) · 8.06 KB

STANDARDS.md

File metadata and controls

309 lines (202 loc) · 8.06 KB
Raw

Standards Reference

Overview

Digital Trust Interoperability Lab implements only open, publicly documented standards. This document details each standard used, its purpose, and how it is implemented.

Standards Summary

Standard Version Category RFC/Spec
X.509 v3 Certificate format RFC 5280
PKCS#11 v2.20+ Token interface OASIS
PKCS#7 / CMS Current Message syntax RFC 5652
PKCS#1 v2.1 RSA signatures RFC 8017
CryptoAPI Win32 Windows API Microsoft
CNG / KSP Vista+ Modern Windows Microsoft
FIPS 180-4 Current Hash algorithms NIST
OCSP Current Revocation RFC 6960
CRL Current Revocation RFC 5280 §5

Detailed Standards

Certificate Format & Path Validation

X.509 (RFC 5280)

Standard for public key certificate format.

The tool implements:

  • Certificate parsing (CertGetCertificateContextProperty)
  • Chain building (CertGetCertificateChain)
  • Extension inspection:
    • KeyUsage
    • ExtendedKeyUsage (EKU)
    • BasicConstraints
    • Subject Key Identifier (SKI)
    • Authority Key Identifier (AKI)
    • CRL Distribution Points (CDP)
    • Authority Information Access (AIA)
  • Validity period checking
  • Serial number extraction
  • Subject/Issuer parsing (RDN)
  • Thumbprint calculation (SHA-1, SHA-256)

Reference: RFC 5280

Cryptographic Message Syntax

PKCS#7 / CMS (RFC 5652)

Message syntax for signed and encrypted data.

The tool uses this for:

  • Understanding signature format
  • Certificate chain packaging (future phases)

Reference: RFC 5652

Token & Smart Card Interface

PKCS#11 v2.20+

Standard interface for hardware cryptographic tokens.

The tool implements 9 core test cases:

Code Function Purpose
P11-01 C_Initialize Library initialization
P11-02 C_GetInfo Library version/manufacturer
P11-03 C_GetSlotList Enumerate slots
P11-04 C_GetSlotInfo Slot capabilities
P11-05 C_GetTokenInfo Token identity
P11-06 C_OpenSession Session establishment
P11-07 C_GetMechanismList Supported algorithms
P11-08 C_FindObjects (Cert) Certificate discovery
P11-09 C_FindObjects (Key) Private key discovery

Additionally, for signing:

  • C_Login (with PIN)
  • C_SignInit
  • C_Sign
  • C_Logout
  • C_FindObjectsInit, C_FindObjectsFinal
  • C_CloseSession
  • C_Finalize

Reference: OASIS PKCS#11

Signature Algorithms

PKCS#1 v2.1 (RFC 8017)

RSA cryptography standard. The tool uses:

  • RSA-PKCS#1 v1.5 padding for signature operations
  • DigestInfo ASN.1 encoding for hash algorithm identification

ASN.1 DigestInfo prefixes (hardcoded per RFC 3447 Appendix A.2.4):

SHA-1:   30 21 30 09 06 05 2b 0e 03 02 1a 05 00 04 14
SHA-256: 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20
SHA-384: 30 41 30 0d 06 09 60 86 48 01 65 03 04 02 02 05 00 04 30
SHA-512: 30 51 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 04 40

These prefixes are prepended to the hash value before RSA signing via PKCS#11's CKM_RSA_PKCS mechanism.

Reference: RFC 8017

FIPS 180-4

Secure Hash Standard.

The tool supports:

  • SHA-1 (160-bit) — legacy compatibility
  • SHA-256 (256-bit) — recommended
  • SHA-384 (384-bit) — high security
  • SHA-512 (512-bit) — maximum security

Implementation paths:

  • Legacy CSP (via CryptCreateHash)
  • Modern CSP (via CryptCreateHash with SHA-2 ALG_IDs)
  • CNG (via BCrypt algorithms)
  • HP_HASHVAL injection (for legacy compatibility)

Reference: FIPS 180-4

Windows Cryptographic APIs

CryptoAPI (CAPI)

Legacy Windows crypto interface (Windows 2000+).

Used for:

  • CSP enumeration (CryptEnumProviders)
  • Provider acquisition (CryptAcquireContext)
  • Certificate operations
  • Hash operations (CryptCreateHash, CryptHashData)
  • Signing (CryptSignHash)
  • Verification (CryptVerifySignature)

Reference: Microsoft CryptoAPI Documentation

CNG (Cryptography Next Generation)

Modern Windows crypto interface (Vista+).

Used for:

  • KSP enumeration (NCryptEnumProviders)
  • Modern algorithm support
  • BCrypt hashing (BCryptCreateHash)
  • CNG key operations (NCryptOpenKey, NCryptSignHash)

Reference: Microsoft CNG Documentation

Certificate Revocation

OCSP (RFC 6960)

Online Certificate Status Protocol.

The tool uses Windows' built-in OCSP support via CertGetCertificateChain with revocation flags:

  • CERT_CHAIN_REVOCATION_CHECK_END_CERT
  • CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY

Reference: RFC 6960

CRL (RFC 5280 Section 5)

Certificate Revocation Lists.

Handled automatically by Windows chain building.

Reference: RFC 5280 §5

Future Standards (Roadmap)

Time-Stamp Protocol

RFC 3161 — Internet X.509 PKI Time-Stamp Protocol

Planned for Phase 6. Will include:

  • TSP client
  • Verification of RFC 3161 timestamps
  • CAdES / PAdES long-term signature support

Reference: RFC 3161

Post-Quantum Cryptography

NIST PQC Standards (once finalized)

Planned for Phase 8. Will include:

  • CRYSTALS-Kyber (KEM)
  • CRYSTALS-Dilithium (signatures)
  • Falcon (signatures)
  • SPHINCS+ (signatures)

Compliance Verification

All standards used are:

  • ✅ Publicly documented — IETF RFCs, OASIS, NIST FIPS
  • ✅ Vendor-neutral — no proprietary extensions
  • ✅ Backward-compatible — works on Windows 7 and later
  • ✅ Auditable — full source code available

Non-Standard Features (None)

Digital Trust Interoperability Lab uses zero non-standard features. This includes:

  • ❌ No vendor-specific PKCS#11 extensions
  • ❌ No Microsoft-proprietary APIs beyond documented CryptoAPI/CNG
  • ❌ No undocumented Win32 APIs
  • ❌ No registry hacks
  • ❌ No kernel-mode code

This ensures the tool works uniformly across all vendors and Windows versions.

Testing Against Standards

For each standard, the tool provides diagnostic evidence:

X.509 Compliance Test

Any RFC 5280-compliant certificate is correctly parsed and displayed with all fields.

PKCS#11 Compliance Test

Any PKCS#11 v2.20+ compliant library passes all 9 basic tests (P11-01 through P11-08 always pass; P11-09 may WARNING due to silent mode).

RSA-PKCS#1 v1.5 Compliance Test

Cross-Path Signature Determinism proves that any two RSA-PKCS#1 v1.5 compliant implementations produce byte-identical signatures given the same input and key.

References

Full RFC and specification URLs:

Standard URL
RFC 5280 (X.509) https://tools.ietf.org/html/rfc5280
RFC 5652 (CMS) https://tools.ietf.org/html/rfc5652
RFC 6960 (OCSP) https://tools.ietf.org/html/rfc6960
RFC 8017 (PKCS#1 v2.2) https://tools.ietf.org/html/rfc8017
RFC 3161 (TSP) https://tools.ietf.org/html/rfc3161
FIPS 180-4 https://csrc.nist.gov/publications/detail/fips/180/4/final
PKCS#11 v2.20 http://docs.oasis-open.org/pkcs11/
CryptoAPI Docs https://learn.microsoft.com/en-us/windows/win32/seccrypto/
CNG Docs https://learn.microsoft.com/en-us/windows/win32/seccng/

Digital Trust Interoperability Lab — 100% Standards-Based