Internet Engineering Task Force (IETF) J. Schaad
Request for Comments: 6955 Soaring Hawk Consulting
Obsoletes: 2875 H. Prafullchandra
Category: Standards Track HyTrust, Inc.
ISSN: 2070-1721 May 2013
Diffie-Hellman Proof-of-Possession Algorithms
Abstract
This document describes two methods for producing an integrity check
value from a Diffie-Hellman key pair and one method for producing an
integrity check value from an Elliptic Curve key pair. This behavior
is needed for such operations as creating the signature of a Public-
Key Cryptography Standards (PKCS) #10 Certification Request. These
algorithms are designed to provide a Proof-of-Possession of the
private key and not to be a general purpose signing algorithm.
This document obsoletes RFC 2875.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/RFC 6955.
Schaad & Prafullchandra Standards Track [Page 1]
RFC 6955 DH POP Algorithms May 2013
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
This document may contain material from IETF Documents or IETF
Contributions published or made publicly available before November
10, 2008. The person(s) controlling the copyright in some of this
material may not have granted the IETF Trust the right to allow
modifications of such material outside the IETF Standards Process.
Without obtaining an adequate license from the person(s) controlling
the copyright in such materials, this document may not be modified
outside the IETF Standards Process, and derivative works of it may
not be created outside the IETF Standards Process, except to format
it for publication as an RFC or to translate it into languages other
than English.
Schaad & Prafullchandra Standards Track [Page 2]
RFC 6955 DH POP Algorithms May 2013
Table of Contents
1. Introduction ....................................................3
1.1. Changes since RFC 2875 .....................................4
1.2. Requirements Terminology ...................................5
2. Terminology .....................................................5
3. Notation ........................................................5
4. Static DH Proof-of-Possession Process ...........................6
4.1. ASN.1 Encoding .............................................8
5. Discrete Logarithm Signature ...................................11
5.1. Expanding the Digest Value ................................11
5.2. Signature Computation Algorithm ...........................12
5.3. Signature Verification Algorithm ..........................13
5.4. ASN.1 Encoding ............................................14
6. Static ECDH Proof-of-Possession Process ........................16
6.1. ASN.1 Encoding ............................................18
7. Security Considerations ........................................20
8. References .....................................................21
8.1. Normative References ......................................21
8.2. Informative References ....................................21
Appendix A. ASN.1 Modules .........................................23
A.1. 2008 ASN.1 Module ..........................................23
A.2. 1988 ASN.1 Module ..........................................28
Appendix B. Example of Static DH Proof-of-Possession ..............30
Appendix C. Example of Discrete Log Signature .....................38
1. Introduction
Among the responsibilities of a Certification Authority (CA) in
issuing certificates is a requirement that it verifies the identity
for the entity to which it is issuing a certificate and that the
private key for the public key to be placed in the certificate is in
the possession of that entity. The process of validating that the
private key is held by the requester of the certificate is called
Proof-of-Possession (POP). Further details on why POP is important
can be found in Appendix C of RFC 4211 [CRMF].
This document is designed to deal with the problem of how to support
POP for encryption-only keys. PKCS #10 [RFC 2986] and the Certificate
Request Message Format (CRMF) [CRMF] both define syntaxes for
Certification Requests. However, while CRMF supports an alternative
method to support POP for encryption-only keys, PKCS #10 does not.
PKCS #10 assumes that the public key being requested for
certification corresponds to an algorithm that is capable of
producing a POP by a signature operation. Diffie-Hellman (DH) and
Elliptic Curve Diffie-Hellman (ECDH) are key agreement algorithms
and, as such, cannot be directly used for signing or encryption.
Schaad & Prafullchandra Standards Track [Page 3]
RFC 6955 DH POP Algorithms May 2013
This document describes a set of three POP algorithms. Two methods
use the key agreement process (one for DH and one for ECDH) to
provide a shared secret as the basis of an integrity check value.
For these methods, the value is constructed for a specific recipient/
verifier by using a public key of that verifier. The third method
uses a modified signature algorithm (for DH). This method allows for
arbitrary verifiers.
It should be noted that we did not create an algorithm that parallels
the Elliptical Curve Digital Signature Algorithm (ECDSA) as was done
for the Digital Signature Algorithm (DSA). When using ECDH, the
common practice is to use one of a set of predefined curves; each of
these curves has been designed to be paired with one of the commonly
used hash algorithms. This differs in practice from the DH case
where the common practice is to generate a set of group parameters,
either on a single machine or for a given community, that are aligned
to encryption algorithms rather than hash algorithms. The
implication is that, if a key has the ability to perform the modified
DSA algorithm for ECDSA, it should be able to use the correct hash
algorithm and perform the regular ECDSA signature algorithm with the
correctly sized hash.
1.1. Changes since RFC 2875
The following changes have been made:
o The Static DH POP algorithm has been rewritten for
parameterization of the hash algorithm and the Message
Authentication Code (MAC) algorithm.
o New instances of the Static DH POP algorithm have been created
using the Hashed Message Authentication Code (HMAC) paired with
the SHA-224, SHA-256, SHA-384, and SHA-512 hash algorithms.
However, the current SHA-1 algorithm remains identical.
o The Discrete Logarithm Signature algorithm has been rewritten for
parameterization of the hash algorithm.
o New instances of the Discrete Logarithm Signature have been
created for the SHA-224, SHA-256, SHA-384, and SHA-512 hash
functions. However, the current SHA-1 algorithm remains
identical.
o A new Static ECDH POP algorithm has been added.
o New instances of the Static ECDH POP algorithm have been created
using HMAC paired with the SHA-224, SHA-256, SHA-384, and SHA-512
hash functions.
Schaad & Prafullchandra Standards Track [Page 4]
RFC 6955 DH POP Algorithms May 2013
1.2. Requirements Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC 2119].
When the words are in lower case they have their natural language
meaning.
2. Terminology
The following definitions will be used in this document:
DH certificate = a certificate whose SubjectPublicKey is a DH public
value and is signed with any signature algorithm (e.g., RSA or DSA).
ECDH certificate = a certificate whose SubjectPublicKey is an ECDH
public value and is signed with any signature algorithm (e.g., RSA
or ECDSA).
Proof-of-Possession (POP) = a means that provides a method for a
second party to perform an algorithm to establish with some degree of
assurance that the first party does possess and has the ability to
use a private key. The reasoning behind doing POP can be found in
Appendix C in [CRMF].
3. Notation
This section describes mathematical notations, conventions, and
symbols used throughout this document.
a | b : Concatenation of a and b
a ^ b : a raised to the power of b
a mod b : a modulo b
a / b : a divided by b using integer division
a * b : a times b
Depending on context, multiplication may be within
an EC or normal multiplication
KDF(a) : Key Derivation Function producing a value from a
MAC(a, b) : Message Authentication Code function where
a is the key and b is the text
LEFTMOST(a, b) : Return the b left most bits of a
FLOOR(a) : Return n where n is the largest integer such that
n <= a
Schaad & Prafullchandra Standards Track [Page 5]
RFC 6955 DH POP Algorithms May 2013
Details on how to implement the HMAC version of a MAC function used
in this document can be found in RFC 2104 [RFC 2104], RFC 6234
[RFC 6234], and RFC 4231 [RFC 4231].
4. Static DH Proof-of-Possession Process
The Static DH POP algorithm is set up to use a Key Derivation
Function (KDF) and a MAC. This algorithm requires that a common set
of group parameters be used by both the creator and verifier of the
POP value.
The steps for creating a DH POP are:
1. An entity (E) chooses the group parameters for a DH key
agreement.
This is done simply by selecting the group parameters from a
certificate for the recipient of the POP process. A certificate
with the correct group parameters has to be available.
Let the common DH parameters be g and p; and let the DH key pair
from the certificate be known as the recipient (R) key pair (Rpub
and Rpriv).
Rpub = g^x mod p (where x=Rpriv, the private DH value)
2. The entity generates a DH public/private key pair using the group
parameters from step 1.
For an entity (E):
Epriv = DH private value = y
Epub = DH public value = g^y mod p
Schaad & Prafullchandra Standards Track [Page 6]
RFC 6955 DH POP Algorithms May 2013
3. The POP computation process will then consist of the following
steps:
(a) The value to be signed (text) is obtained. (For a PKCS #10
object, the value is the DER-encoded
certificationRequestInfo field represented as an octet
string.)
(b) A shared DH secret is computed as follows:
shared secret = ZZ = g^(x*y) mod p
[This is done by E as Rpub^y and by the recipient as Epub^x,
where Rpub is retrieved from the recipient's DH certificate
(or is provided in the protocol) and Epub is retrieved from
the Certification Request.]
(c) A temporary key K is derived from the shared secret ZZ as
follows:
K = KDF(LeadingInfo | ZZ | TrailingInfo)
LeadingInfo ::= Subject Distinguished Name from
recipient's certificate
TrailingInfo ::= Issuer Distinguished Name from
recipient's certificate
(d) Using the defined MAC function, compute MAC(K, text).
The POP verification process requires the recipient to carry out
steps (a) through (d) and then simply compare the result of step (d)
with what it received as the signature component. If they match,
then the following can be concluded:
(a) The entity possesses the private key corresponding to the public
key in the Certification Request because it needs the private
key to calculate the shared secret; and
(b) Only the recipient that the entity sent the request to could
actually verify the request because it would require its own
private key to compute the same shared secret. In the case
where the recipient is a CA, this protects the entity from
rogue CAs.
Schaad & Prafullchandra Standards Track [Page 7]
RFC 6955 DH POP Algorithms May 2013
4.1. ASN.1 Encoding
The algorithm outlined above allows for the use of an arbitrary hash
function in computing the temporary key and the MAC algorithm. In
this specification, we define object identifiers for the SHA-1,
SHA-224, SHA-256, SHA-384, and SHA-512 hash values and use HMAC for
the MAC algorithm. The ASN.1 structures associated with the Static
DH POP algorithm are:
DhSigStatic ::= SEQUENCE {
issuerAndSerial IssuerAndSerialNumber OPTIONAL,
hashValue MessageDigest
}
sa-dhPop-static-sha1-hmac-sha1 SIGNATURE-ALGORITHM ::= {
IDENTIFIER id-dhPop-static-sha1-hmac-sha1
VALUE DhSigStatic
PARAMS ARE absent
PUBLIC-KEYS { pk-dh }
}
id-dh-sig-hmac-sha1 OBJECT IDENTIFIER ::= {
id-pkix id-alg(6) 3
}
id-dhPop-static-sha1-hmac-sha1 OBJECT IDENTIFIER ::=
id-dh-sig-hmac-sha1
sa-dhPop-static-sha224-hmac-sha224 SIGNATURE-ALGORITHM ::= {
IDENTIFIER id-alg-dhPop-static-sha224-hmac-sha224
VALUE DhSigStatic
PARAMS ARE absent
PUBLIC-KEYS { pk-dh }
}
id-alg-dhPop-static-sha224-hmac-sha224 OBJECT IDENTIFIER ::= {
id-pkix id-alg(6) 15
}
sa-dhPop-static-sha256-hmac-sha256 SIGNATURE-ALGORITHM ::= {
IDENTIFIER id-alg-dhPop-static-sha256-hmac-sha256
VALUE DhSigStatic
PARAMS ARE absent
PUBLIC-KEYS { pk-dh }
}
Schaad & Prafullchandra Standards Track [Page 8]
RFC 6955 DH POP Algorithms May 2013
id-alg-dhPop-static-sha256-hmac-sha256 OBJECT IDENTIFIER ::= {
id-pkix id-alg(6) 16
}
sa-dhPop-static-sha384-hmac-sha384 SIGNATURE-ALGORITHM ::= {
IDENTIFIER id-alg-dhPop-static-sha384-hmac-sha384
VALUE DhSigStatic
PARAMS ARE absent
PUBLIC-KEYS { pk-dh }
}
id-alg-dhPop-static-sha384-hmac-sha384 OBJECT IDENTIFIER ::= {
id-pkix id-alg(6) 17
}
sa-dhPop-static-sha512-hmac-sha512 SIGNATURE-ALGORITHM ::= {
IDENTIFIER id-alg-dhPop-static-sha512-hmac-sha512
VALUE DhSigStatic
PARAMS ARE absent
PUBLIC-KEYS { pk-dh }
}
id-alg-dhPop-static-sha512-hmac-sha512 OBJECT IDENTIFIER ::= {
id-pkix id-alg(6) 18
}
In the above ASN.1, the following items are defined:
DhSigStatic
This ASN.1 type structure holds the information describing the
signature. The structure has the following fields:
issuerAndSerial
This field contains the issuer name and serial number of the
certificate from which the public key was obtained. The
issuerAndSerial field is omitted if the public key did not come
from a certificate.
hashValue
This field contains the result of the MAC operation in
step 3(d) (Section 4).
sa-dhPop-static-sha1-hmac-sha1
An ASN.1 SIGNATURE-ALGORITHM object that associates together the
information describing a signature algorithm. The structure
DhSigStatic represents the signature value, and the parameters
MUST be absent.
Schaad & Prafullchandra Standards Track [Page 9]
RFC 6955 DH POP Algorithms May 2013
id-dhPop-static-sha1-hmac-sha1
This OID identifies the Static DH POP algorithm that uses SHA-1 as
the KDF and HMAC-SHA1 as the MAC function. The new OID was
created for naming consistency with the other OIDs defined here.
The value of the OID is the same value as id-dh-sig-hmac-sha1,
which was defined in the previous version of this document
[RFC 2875].
sa-dhPop-static-sha224-hmac-sha224
An ASN.1 SIGNATURE-ALGORITHM object that associates together the
information describing this signature algorithm. The structure
DhSigStatic represents the signature value, and the parameters
MUST be absent.
id-dhPop-static-sha224-hmac-sha224
This OID identifies the Static DH POP algorithm that uses SHA-224
as the KDF and HMAC-SHA224 as the MAC function.
sa-dhPop-static-sha256-hmac-sha256
An ASN.1 SIGNATURE-ALGORITHM object that associates together the
information describing this signature algorithm. The structure
DhSigStatic represents the signature value, and the parameters
MUST be absent.
id-dhPop-static-sha256-hmac-sha256
This OID identifies the Static DH POP algorithm that uses SHA-256
as the KDF and HMAC-SHA256 as the MAC function.
sa-dhPop-static-sha384-hmac-sha384
An ASN.1 SIGNATURE-ALGORITHM object that associates together the
information describing this signature algorithm. The structure
DhSigStatic represents the signature value, and the parameters
MUST be absent.
id-dhPop-static-sha384-hmac-sha384
This OID identifies the Static DH POP algorithm that uses SHA-384
as the KDF and HMAC-SHA384 as the MAC function.
sa-dhPop-static-sha512-hmac-sha512
An ASN.1 SIGNATURE-ALGORITHM object that associates together the
information describing this signature algorithm. The structure
DhSigStatic represents the signature value, and the parameters
MUST be absent.
id-dhPop-static-sha512-hmac-sha512
This OID identifies the Static DH POP algorithm that uses SHA-512
as the KDF and HMAC-SHA512 as the MAC function.
Schaad & Prafullchandra Standards Track [Page 10]
RFC 6955 DH POP Algorithms May 2013
5. Discrete Logarithm Signature
When a single set of parameters is used for a large group of keys,
the chance that a collision will occur in the set of keys, either by
accident or design, increases as the number of keys used increases.
A large number of keys from a single parameter set also encourages
the use of brute force methods of attack, as the entire set of keys
in the parameters can be attacked in a single operation rather than
having to attack each key parameter set individually.
For this reason, we need to create a POP for DH keys that does not
require the use of a common set of parameters.
This POP algorithm is based on DSA, but we have removed the
restrictions dealing with the hash and key sizes imposed by the
[FIPS-186-3] standard. The use of this method does impose some
additional restrictions on the set of keys that may be used; however,
if the key-generation algorithm documented in [RFC 2631] is used, the
required restrictions are met. The additional restrictions are the
requirement for the existence of a q parameter. Adding the q
parameter is generally accepted as a good practice, as it allows for
checking of small subgroup attacks.
The following definitions are used in the rest of this section:
p is a large prime
g = h^((p-1)/q) mod p,
where h is any integer 1 < h < p-1 such that h^((p-1)/q) mod p > 1
(g has order q mod p)
q is a large prime
j is a large integer such that p = q*j + 1
x is a randomly or pseudo-randomly generated integer with 1 < x < q
y = g^x mod p
HASH is a hash function such that
b = the output size of HASH in bits
Note: These definitions match the ones in [RFC 2631].
5.1. Expanding the Digest Value
Besides the addition of a q parameter, [FIPS-186-3] also imposes size
restrictions on the parameters. The length of q must be 160 bits
(matching the output length of the SHA-1 digest algorithm), and the
length of p must be 1024 bits. The size restriction on p is
eliminated in this document, but the size restriction on q is
replaced with the requirement that q must be at least b bits in
length. (If the hash function is SHA-1, then b=160 bits and the size
restriction on b is identical with that in [FIPS-186-3].) Given that
Schaad & Prafullchandra Standards Track [Page 11]
RFC 6955 DH POP Algorithms May 2013
there is not a random length-hashing algorithm, a hash value of the
message will need to be derived such that the hash is in the range
from 0 to q-1. If the length of q is greater than b, then a method
must be provided to expand the hash.
The method for expanding the digest value used in this section does
not provide any additional security beyond the b bits provided by the
hash algorithm. For this reason, the hash algorithm should be the
largest size possible to match q. The value being signed is
increased mainly to enhance the difficulty of reversing the signature
process.
This algorithm produces m, the value to be signed.
Let L = the size of q (i.e., 2^L <= q < 2^(L+1)).
Let M be the original message to be signed.
Let b be the length of HASH output.
1. Compute d = HASH(M), the digest of the original message.
2. If L == b, then m = d.
3. If L > b, then follow steps (a) through (d) below.
(a) Set n = FLOOR(L / b)
(b) Set m = d, the initial computed digest value
(c) For i = 0 to n - 1
m = m | HASH(m)
(d) m = LEFTMOST(m, L-1)
Thus, the final result of the process meets the criteria that
0 <= m < q.
5.2. Signature Computation Algorithm
The signature algorithm produces the pair of values (r, s), which is
the signature. The signature is computed as follows:
Given m, the value to be signed, as well as the parameters defined
earlier in Section 5:
1. Generate a random or pseudo-random integer k, such that
0 < k-1 < q.
2. Compute r = (g^k mod p) mod q.
Schaad & Prafullchandra Standards Track [Page 12]
RFC 6955 DH POP Algorithms May 2013
3. If r is zero, repeat from step 1.
4. Compute s = ((k^-1) * (m + x*r)) mod q.
5. If s is zero, repeat from step 1.
5.3. Signature Verification Algorithm
The signature verification process is far more complicated than is
normal for DSA, as some assumptions about the validity of parameters
cannot be taken for granted.
Given a value m to be validated, the signature value pair (r, s) and
the parameters for the key:
1. Perform a strong verification that p is a prime number.
2. Perform a strong verification that q is a prime number.
3. Verify that q is a factor of p-1; if any of the above checks
fail, then the signature cannot be verified and must be
considered a failure.
4. Verify that r and s are in the range [1, q-1].
5. Compute w = (s^-1) mod q.
6. Compute u1 = m*w mod q.
7. Compute u2 = r*w mod q.
8. Compute v = ((g^u1 * y^u2) mod p) mod q.
9. Compare v and r; if they are the same, then the signature
verified correctly.
Schaad & Prafullchandra Standards Track [Page 13]
RFC 6955 DH POP Algorithms May 2013
5.4. ASN.1 Encoding
The signature algorithm is parameterized by the hash algorithm. The
ASN.1 structures associated with the Discrete Logarithm Signature
algorithm are:
sa-dhPop-SHA1 SIGNATURE-ALGORITHM ::= {
IDENTIFIER id-alg-dh-pop
VALUE DSA-Sig-Value
PARAMS TYPE DomainParameters ARE preferredAbsent
HASHES { mda-sha1 }
PUBLIC-KEYS { pk-dh }
}
id-alg-dhPop-sha1 OBJECT IDENTIFIER ::= id-alg-dh-pop
id-alg-dh-pop OBJECT IDENTIFIER ::= { id-pkix id-alg(6) 4 }
sa-dhPop-sha224 SIGNATURE-ALGORITHM ::= {
IDENTIFIER id-alg-dhPop-sha224
VALUE DSA-Sig-Value
PARAMS TYPE DomainParameters ARE preferredAbsent
HASHES { mda-sha224 }
PUBLIC-KEYS { pk-dh }
}
id-alg-dhPop-sha224 OBJECT IDENTIFIER ::= {
id-pkix id-alg(6) 5
}
sa-dhPop-sha256 SIGNATURE-ALGORITHM ::= {
IDENTIFIER id-alg-dhPop-sha256
VALUE DSA-Sig-Value
PARAMS TYPE DomainParameters ARE preferredAbsent
HASHES { mda-sha256 }
PUBLIC-KEYS { pk-dh }
}
id-alg-dhPop-sha256 OBJECT IDENTIFIER ::= {
id-pkix id-alg(6) 6
}
Schaad & Prafullchandra Standards Track [Page 14]
RFC 6955 DH POP Algorithms May 2013
sa-dhPop-sha384 SIGNATURE-ALGORITHM ::= {
IDENTIFIER id-alg-dhPop-sha384
VALUE DSA-Sig-Value
PARAMS TYPE DomainParameters ARE preferredAbsent
HASHES { mda-sha384 }
PUBLIC-KEYS { pk-dh }
}
id-alg-dhPop-sha384 OBJECT IDENTIFIER ::= {
id-pkix id-alg(6) 7
}
sa-dhPop-sha512 SIGNATURE-ALGORITHM ::= {
IDENTIFIER id-alg-dhPop-sha512
VALUE DSA-Sig-Value
PARAMS TYPE DomainParameters ARE preferredAbsent
HASHES { mda-sha512 }
PUBLIC-KEYS { pk-dh }
}
id-alg-dhPop-sha512 OBJECT IDENTIFIER ::= {
id-pkix id-alg(6) 8
}
In the above ASN.1, the following items are defined:
sa-dhPop-sha1
A SIGNATURE-ALGORITHM object that associates together the
information describing this signature algorithm. The structure
DSA-Sig-Value represents the signature value, and the structure
DomainParameters SHOULD be omitted in the signature but MUST be
present in the associated key request.
id-alg-dhPop-sha1
This OID identifies the Discrete Logarithm Signature using SHA-1
as the hash algorithm. The new OID was created for naming
consistency with the others defined here. The value of the OID is
the same as id-alg-dh-pop, which was defined in the previous
version of this document [RFC 2875].
sa-dhPop-sha224
A SIGNATURE-ALGORITHM object that associates together the
information describing this signature algorithm. The structure
DSA-Sig-Value represents the signature value, and the structure
DomainParameters SHOULD be omitted in the signature but MUST be
present in the associated key request.
Schaad & Prafullchandra Standards Track [Page 15]
RFC 6955 DH POP Algorithms May 2013
id-alg-dhPop-sha224
This OID identifies the Discrete Logarithm Signature using SHA-224
as the hash algorithm.
sa-dhPop-sha256
A SIGNATURE-ALGORITHM object that associates together the
information describing this signature algorithm. The structure
DSA-Sig-Value represents the signature value, and the structure
DomainParameters SHOULD be omitted in the signature but MUST be
present in the associated key request.
id-alg-dhPop-sha256
This OID identifies the Discrete Logarithm Signature using SHA-256
as the hash algorithm.
sa-dhPop-sha384
A SIGNATURE-ALGORITHM object that associates together the
information describing this signature algorithm. The structure
DSA-Sig-Value represents the signature value, and the structure
DomainParameters SHOULD be omitted in the signature but
RFC 6955 - úplné znění
Plné znění RFC 6955:
English version: RFC 6955