Internet-Draft extendedKeyUsage for IM URIs April 2024
Mahy Expires 17 October 2024 [Page]
Intended Status:
R. Mahy

X.509 Certificate Extended Key Usage (EKU) for Instant Messaging URIs


RFC 5280 specifies several extended key purpose identifiers (KeyPurposeIds) for X.509 certificates. This document defines Instant Messaging (IM) identity KeyPurposeId for inclusion in the Extended Key Usage (EKU) extension of X.509 v3 public key certificates

About This Document

This note is to be removed before publishing as an RFC.

The latest revision of this draft can be found at Status information for this document may be found at

Discussion of this document takes place on the LAMPS WG Working Group mailing list (, which is archived at Subscribe at

Source for this draft and an issue tracker can be found at

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on 17 October 2024.

Table of Contents

1. Introduction

Instant Messaging (IM) systems using the Messaging Layer Security (MLS) [RFC9420] protocol can incorporate per-client identity certificate credentials. The subjectAltName of these certificates can be an IM URI, for example. Since IM clients could be very numerous, operators are reticent to issue certificates for these users that might accidentally be used to validate a TLS connection because it has the KeyPurposeId id-kp-serverAuth or id-kp-clientAuth.

An explanation of MLS credentials as they apply to Instant Messaging is described in [I-D.barnes-mimi-identity-arch]. These credentials are expected to be heavily used in the More Instant Messaging Interoperability (MIMI) Working Group.

2. Conventions and Definitions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

3. The IM URI Extended Key Usage

This specification defines the KeyPurposeId id-kp-imUri, which is used for signing messages to prove the identity of an Instant Messaging client. This Extended Key Usage is optionally critical.

  iso(1) identified-organization(3) dod(6) internet(1)
  security(5) mechanisms(5) pkix(7) kp(3) }

id-kp-imUri OBJECT IDENTIFIER ::= { id-kp TBD1 }

4. Security Considerations

The Security Considerations of [RFC5280] are applicable to this document. This extended key purpose does not introduce new security risks but instead reduces existing security risks by providing means to identify if the certificate is generated to sign IM identity credentials.

5. IANA Considerations

IANA is requested to register the following OIDs in the "SMI Security for PKIX Extended Key Purpose" registry ( These OIDs are defined in Section 4.

Table 1
Decimal Description References
TBD1 id-kp-imUri This-RFC

IANA is also requested to register the following ASN.1 [ITU.X690.2021] module OID in the "SMI Security for PKIX Module Identifier" registry ( This OID is defined in Appendix A.

Table 2
Decimal Description References
TBD2 id-kp-im-eku This-RFC

6. References

6.1. Normative References

International Telecommunications Union, "Information Technology — Abstract Syntax Notation One (ASN.1): Specification of basic notation", ITU-T Recommendation X.680, .
International Telecommunications Union, "Information Technology — ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)", ITU-T Recommendation X.690, .
Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, , <>.
Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, , <>.
Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, , <>.

6.2. Informative References

Barnes, R. and R. Mahy, "Identity for E2E-Secure Communications", Work in Progress, Internet-Draft, draft-barnes-mimi-identity-arch-01, , <>.
Barnes, R., Beurdouche, B., Robert, R., Millican, J., Omara, E., and K. Cohn-Gordon, "The Messaging Layer Security (MLS) Protocol", RFC 9420, DOI 10.17487/RFC9420, , <>.

Appendix A. ASN.1 Module

The following module adheres to ASN.1 specifications [ITU.X680.2021] and [ITU.X690.2021].


  { iso(1) identified-organization(3) dod(6) internet(1)
  security(5) mechanisms(5) pkix(7) id-mod(0)
  id-mod-im-eku (TBD2) }


-- OID Arc

  { iso(1) identified-organization(3) dod(6) internet(1)
    security(5) mechanisms(5) pkix(7) kp(3) }

-- Extended Key Usage Values

id-kp-imUri OBJECT IDENTIFIER ::= { id-kp TBD1 }



Appendix B. Change log

Author's Address

Rohan Mahy