RPKI Validation Reconsidered
draft-ietf-sidr-rpki-validation-reconsidered-06
The information below is for an old version of the document.
| Document | Type |
This is an older version of an Internet-Draft that was ultimately published as RFC 8360.
|
|
|---|---|---|---|
| Authors | Geoff Huston , George G. Michaelson , Carlos M. Martínez , Tim Bruijnzeels , Andy Newton , Daniel Shaw | ||
| Last updated | 2016-07-08 | ||
| Replaces | draft-huston-rpki-validation | ||
| RFC stream | Internet Engineering Task Force (IETF) | ||
| Formats | |||
| Reviews | |||
| Additional resources | Mailing list discussion | ||
| Stream | WG state | WG Document | |
| Document shepherd | (None) | ||
| IESG | IESG state | Became RFC 8360 (Proposed Standard) | |
| Consensus boilerplate | Unknown | ||
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-ietf-sidr-rpki-validation-reconsidered-06
Network Working Group G. Huston
Internet-Draft G. Michaelson
Intended status: Standards Track APNIC
Expires: January 9, 2017 C. Martinez
LACNIC
T. Bruijnzeels
RIPE NCC
A. Newton
ARIN
D. Shaw
AFRINIC
July 8, 2016
RPKI Validation Reconsidered
draft-ietf-sidr-rpki-validation-reconsidered-06
Abstract
This document proposes an update to the certificate validation
procedure specified in RFC 6487 that reduces aspects of operational
fragility in the management of certificates in the RPKI, while
retaining essential security features.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on January 9, 2017.
Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
Huston, et al. Expires January 9, 2017 [Page 1]
Internet-Draft RPKI Validation July 2016
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Certificate Validation in the RPKI . . . . . . . . . . . . . 2
3. Operational Considerations . . . . . . . . . . . . . . . . . 3
4. An Amended RPKI Certification Validation Process . . . . . . 4
4.1. Verified Resource Sets . . . . . . . . . . . . . . . . . 5
4.2. Changes to existing standards . . . . . . . . . . . . . . 5
4.2.1. Resource Certificate Path Validation . . . . . . . . 5
4.2.2. ROA Validation . . . . . . . . . . . . . . . . . . . 7
4.2.3. BGPsec Router Certificate Validation . . . . . . . . 8
4.3. An example . . . . . . . . . . . . . . . . . . . . . . . 8
5. Security Considerations . . . . . . . . . . . . . . . . . . . 10
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 10
8.1. Normative References . . . . . . . . . . . . . . . . . . 10
8.2. Informative References . . . . . . . . . . . . . . . . . 11
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 11
1. Introduction
This document proposes an update to the certificate validation
procedure specified in [RFC6487] that reduces aspects of operational
fragility in the management of certificates in the RPKI, while
retaining essential security features.
2. Certificate Validation in the RPKI
As currently defined in section 7.2 of [RFC6487], validation of PKIX
certificates that conform to the RPKI profile relies on the use of a
path validation process where each certificate in the validation path
is required to meet the certificate validation criteria.
These criteria require, in particular, that the Internet Number
Resources (INRs) of each certificate in the validation path are
"encompassed" by INRs on the issuing certificate. The first
certificate in the path is required to be a trust anchor, and its
resources are considered valid by definition.
Huston, et al. Expires January 9, 2017 [Page 2]
Internet-Draft RPKI Validation July 2016
For example, in the following sequence:
Certificate 1 (trust anchor):
Issuer TA,
Subject TA,
Resources 192.0.2.0/24, 198.51.100.0/24,
2001:db8::/32, AS64496-AS64500
Certificate 2:
Issuer TA,
Subject CA1,
Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32
Certificate 3:
Issuer CA1,
Subject CA2,
Resources 192.0.2.0/24, 2001:db8::/32
ROA 1:
Embedded Certificate 4 (EE certificate):
Issuer CA2,
Subject R1,
Resources 192.0.2.0/24
Prefix 192.0.2.0/24, Max Length 24, ASN 64496
All certificates in this scenario are considered valid since the INRs
of each certificate are encompassed by those of the issuing
certificate. ROA1 is valid because the specified prefix is
encompassed by the embedded EE certificate, as required by [RFC6482].
3. Operational Considerations
The allocations recorded in the RPKI change as a result of resource
transfers. For example, the CAs involved in transfer might choose to
modify CA certificates in an order that causes some of these
certificates to "over-claim" temporarily. A certificate is said to
"over-claim" if it includes INRs not contained in the INRs of the CA
that issued the certificate in question.
It may also happen that a child CA does not voluntarily request a
shrunk resource certificate when resources are being transferred or
reclaimed by the parent. Furthermore operational errors that may
occur during management of RPKI databases also may create CA
certificates that, temporarily, no longer encompass all of the INRs
of subordinate certificates.
Consider the following sequence:
Huston, et al. Expires January 9, 2017 [Page 3]
Internet-Draft RPKI Validation July 2016
Certificate 1 (trust anchor):
Issuer TA,
Subject TA,
Resources 192.0.2.0/24, 198.51.100.0/24,
2001:db8::/32, AS64496-AS64500
Certificate 2:
Issuer TA,
Subject CA1,
Resources 192.0.2.0/24, 2001:db8::/32
Certificate 3 (invalid):
Issuer CA1,
Subject CA2,
Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32
ROA 1 (invalid):
Embedded Certificate 4 (EE certificate):
Issuer CA2,
Subject R1,
Resources 192.0.2.0/24
Prefix 192.0.2.0/24, Max Length 24, ASN 64496
Here Certificate 2 from the previous example was re-issued by TA to
CA1 and the prefix 198.51.100.0/24 was removed. However, CA1 failed
to re-issue a new Certificate 3 to CA2. As a result Certificate 3 is
now over-claiming and considered invalid; by recursion the embedded
Certificate 4 used for ROA1 is also invalid. And ROA1 is invalid
because the specified prefix contained in the ROA is no longer
encompassed by a valid embedded EE certificate, as required by
[RFC6482]
However, it should be noted that ROA1 does not make use of any of the
address resources that were removed from CA1's certificate, and thus
it would be desirable if ROA1 could still be viewed as valid.
Technically CA1 should re-issue a Certificate 3 to CA2 without
198.51.100.0/24, and then ROA1 would be considered valid according to
[RFC6482]. But as long as CA1 does not take this action, ROA1
remains invalid. It would be preferable if ROA1 could be considered
valid, since the assertion it makes was not affected by the reduced
scope of CA1's certificate.
4. An Amended RPKI Certification Validation Process
Huston, et al. Expires January 9, 2017 [Page 4]
Internet-Draft RPKI Validation July 2016
4.1. Verified Resource Sets
The problem described above can be considered as a low probability
problem today. However the potential impact on routing security
would be high if an over-claiming occurred near the apex of the RPKI
hierarchy, as this would invalidate the entirety of the sub-tree
located below this point.
The changes proposed here to the validation procedure in [RFC6487] do
not change the probability of this problem, but they do limit the
impact to just the over-claimed resources. This revised validation
algorithm is intended to avoid causing CA certificates to be treated
as completely invalid as a result of over-claims. However, these
changes are designed to not degrade the security offered by the RPKI.
Specifically, ROAs and router certificates will be treated as valid
only if all of the resources contained in them are encompassed by all
superior certificates along a path to a trust anchor.
The way this is achieved conceptually is by maintaining Verified
Resource Set (VRS) for each certificate that is separate from the
INRs found in the [RFC3779] resource extension in the certificate.
4.2. Changes to existing standards
4.2.1. Resource Certificate Path Validation
The following is an amended specification to be used in place of
section 7.2 of [RFC6487].
The following algorithm is employed to validate CA and EE resources
certificates. It is modeled on the path validation algorithm from
[RFC5280], but modified to make use of the IP Address Delegation and
AS Identifier Delegation Extensions from [RFC3779].
There are two inputs to the validation algorithm:
1. a trust anchor
2. a certificate to be validated
The algorithm is initialized with two new variables for use in the
RPKI: Validated Resource Set-IP (VRS-IP) and Validated Resource Set-
AS (VRS-AS). These sets are used to track the set of INRs (IP
address space and AS Numbers) that are considered valid for each CA
certificate. The VRS-IP and VRS-AS sets are initially set to the IP
Address Delegation and AS Identifier Delegation values, respectively,
from the trust anchor used to perform validation.
Huston, et al. Expires January 9, 2017 [Page 5]
Internet-Draft RPKI Validation July 2016
This path validation algorithm verifies, among other things, that a
prospective certification path (a sequence of n certificates)
satisfies the following conditions:
a. for all 'x' in {1, ..., n-1}, the subject of certificate 'x' is
the issuer of certificate ('x' + 1);
b. certificate '1' is issued by a trust anchor;
c. certificate 'n' is the certificate to be validated; and
d. for all 'x' in {1, ..., n}, certificate 'x' is valid.
Certificate validation requires verifying that all of the following
conditions hold, in addition to the certification path validation
criteria specified in Section 6 of [RFC5280].
1. The signature of certificate x (x>1) is verified using the public
key of the issuer's certificate (x-1), using the signature
algorithm specified for that public key (in certificate x-1).
2. The current time lies within the interval defined by the
NotBefore and NotAfter values in the Validity field of
certificate x.
3. The Version, Issuer, and Subject fields of certificate x satisfy
the constraints established in Section 4.1-4.7 of this
specification.
4. Certificate x contains all the extensions that MUST be present,
as defined in Section 4.8 of this specification. The value(s)
for each of these extensions MUST be satisfy the constraints
established for each extension in the respective sections. Any
extension not identified in Section 4.8 MUST NOT appear in
certificate x.
5. Certificate x MUST NOT have been revoked, i.e., it MUST NOT
appear on a CRL issued by the CA represented by certificate x-1
6. Compute the VRS-IP and VRS-AS set values as indicated below:
* If the IP Address Delegation extension is present in
certificate x, compute the intersection of the resources
between this extension and the value of the VRS-IP computed
for certificate x-1.
* If the IP Address Delegation extension is absent in
certificate x, set the VRS-IP to NULL.
Huston, et al. Expires January 9, 2017 [Page 6]
Internet-Draft RPKI Validation July 2016
* If the AS Identifier Delegation extension is present in
certificate x, compute the intersection of the resources
between this extension and the value of the VRS-AS computed
for certificate x-1
* If the AS Identifier Delegation extension is absent in
certificate x, set the VRS-AS to NULL.
* If x = n (i.e., this is the certificate being validated),
then:
1. If IP Address Delegation extension is present, it is
replaced with the intersection of the values from that
extension and the current value of the VRS-IP.
2. If an AS Identifier Delegation extension is present, it is
replaced with the intersection of the values from that
extension and the current value of the VRS-IP.
* If an RP is caching the results of validation, these values
MAY be stored along with the certificate, to facilitate
incremental validation based on cached results.
These rules allow a CA certificate to contain resources that are not
present in (all of) the certificates along the path from the trust
anchor to the CA certificate. If none of the resources in the CA
certificate are present in all certificates along the path, no
subordinate certificates could be valid. However, the certificate is
not immediately rejected as this may be a transient condition. Not
immediately rejecting the certificate does not result in a security
problem because the associated VRS sets accurately reflect the
resources validly associated with the certificate in question.
4.2.2. ROA Validation
Section 4 of [RFC6482] currently has the following text on the
validation of resources on a ROA:
o The IP address delegation extension [RFC3779] is present in the
end-entity (EE) certificate (contained within the ROA), and each
IP address prefix(es) in the ROA is contained within the set of IP
addresses specified by the EE certificate's IP address delegation
extension.
The following is an amended specification to be used in place of this
text.
Huston, et al. Expires January 9, 2017 [Page 7]
Internet-Draft RPKI Validation July 2016
o The IP address delegation extension [RFC3779] is present in the
end-entity (EE) certificate (contained within the ROA), and each
IP address prefix(es) in the ROA is contained within the VRS-IP
set that is specified as an outcome of EE certificate validation.
Note that this ensures that ROAs can be valid only, if all IP address
prefixes in the ROA are encompassed by the VRS-IP of all certificates
along the path to the trust anchor used to verify it.
Operators MAY issue separate ROAs for each IP address prefix, so that
the loss of on IP address prefix from the VRS-IP of any certificate
along the path to the trust anchor would not invalidate
authorizations for other IP address prefixes.
4.2.3. BGPsec Router Certificate Validation
BGPsec Router Certificate Validation is defined in section 3.3 of
[I-D.ietf-sidr-bgpsec-pki-profiles]. Path validation defined section
7 of [RFC6487] is used as the first step in validation, and a number
of additional constraints are applied.
We request that the authors add the following constraint:
o The VRS-AS of BGPsec Router Certificates MUST encompass all ASNs
in the AS Resource Identifier Delegation extension.
Furthermore we request that the authors include text instructing
operators that they MAY issue separate BGPsec Router Certificates for
different ASNs, so that the loss of on ASN from the VRS-AS of any
certificate along the path to the trust anchor would not invalidate
router keys for other ASNs.
4.3. An example
Consider the following example under the amended approach:
Certificate 1 (trust anchor):
Issuer TA,
Subject TA,
Resources 192.0.2.0/24, 198.51.100.0/24,
2001:db8::/32, AS64496-AS64500
Verified Resource Set: 192.0.2.0/24, 198.51.100.0/24,
2001:db8::/32, AS64496-AS64500
Warnings: none
Certificate 2:
Issuer TA,
Huston, et al. Expires January 9, 2017 [Page 8]
Internet-Draft RPKI Validation July 2016
Subject CA1,
Resources 192.0.2.0/24, 2001:db8::/32, AS64496
Verified Resource Set: 192.0.2.0/24,
2001:db8::/32, AS64496
Warnings: none
Certificate 3:
Issuer CA1,
Subject CA2,
Resources 192.0.2.0/24, 198.51.100.0/24, AS64496
Verified Resource Set: 192.0.2.0/24, AS64496
Warnings: over-claim for 198.51.100.0/24
ROA 1 (valid):
Embedded Certificate 4 (EE certificate):
Issuer CA2,
Subject R1,
Resources 192.0.2.0/24
Verified resources: 192.0.2.0/24
Warnings: none
Prefix 192.0.2.0/24, Max Length 24, ASN 64496
ROA1 is considered valid because the prefix matches the Verified
Resource Set on the embedded EE certificate, as required by
RFC 6482.
ROA 2 (invalid):
Embedded Certificate 5 (EE certificate invalid):
Issuer CA2,
Subject R2,
Resources 198.51.100.0/24
EE certificate is invalid due to over-claim for 198.51.100.0/24
Prefix 198.51.100.0/24, Max Length 24, ASN 64496
ROA2 is considered invalid because he embedded EE certificate is
considered invalid.
BGPSec Certificate 1 (valid):
Issuer CA2
Subject ROUTER-64496
Resources AS64496
Huston, et al. Expires January 9, 2017 [Page 9]
Internet-Draft RPKI Validation July 2016
Verified resources: AS64496
Warnings: none
BGPSec Certificate 2 (invalid):
Issuer CA2
Subject ALL-ROUTERS
Resources AS64496-AS64497
EE certificate is invalid due to over-claim for AS64497
This problem can be mitigated by issuing separate certificates
for each AS number.
5. Security Considerations
The authors believe that the revised validation algorithm introduces
no new security vulnerabilities into the RPKI.
6. IANA Considerations
No updates to the registries are suggested by this document.
7. Acknowledgements
The authors would like to thank Stephen Kent for reviewing and
contributing to this document.
8. References
8.1. Normative References
[I-D.ietf-sidr-bgpsec-pki-profiles]
Reynolds, M., Turner, S., and S. Kent, "A Profile for
BGPsec Router Certificates, Certificate Revocation Lists,
and Certification Requests", draft-ietf-sidr-bgpsec-pki-
profiles-17 (work in progress), June 2016.
[RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP
Addresses and AS Identifiers", RFC 3779,
DOI 10.17487/RFC3779, June 2004,
<http://www.rfc-editor.org/info/rfc3779>.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
Housley, R., and W. Polk, "Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List
(CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
<http://www.rfc-editor.org/info/rfc5280>.
Huston, et al. Expires January 9, 2017 [Page 10]
Internet-Draft RPKI Validation July 2016
[RFC6482] Lepinski, M., Kent, S., and D. Kong, "A Profile for Route
Origin Authorizations (ROAs)", RFC 6482,
DOI 10.17487/RFC6482, February 2012,
<http://www.rfc-editor.org/info/rfc6482>.
[RFC6487] Huston, G., Michaelson, G., and R. Loomans, "A Profile for
X.509 PKIX Resource Certificates", RFC 6487,
DOI 10.17487/RFC6487, February 2012,
<http://www.rfc-editor.org/info/rfc6487>.
8.2. Informative References
[RFC3849] Huston, G., Lord, A., and P. Smith, "IPv6 Address Prefix
Reserved for Documentation", RFC 3849,
DOI 10.17487/RFC3849, July 2004,
<http://www.rfc-editor.org/info/rfc3849>.
[RFC5398] Huston, G., "Autonomous System (AS) Number Reservation for
Documentation Use", RFC 5398, DOI 10.17487/RFC5398,
December 2008, <http://www.rfc-editor.org/info/rfc5398>.
[RFC5737] Arkko, J., Cotton, M., and L. Vegoda, "IPv4 Address Blocks
Reserved for Documentation", RFC 5737,
DOI 10.17487/RFC5737, January 2010,
<http://www.rfc-editor.org/info/rfc5737>.
Authors' Addresses
Geoff Huston
Asia Pacific Network Information Centre
6 Cordelia St
South Brisbane, QLD 4101
Australia
Phone: +61 7 3858 3100
Email: gih@apnic.net
George Michaelson
Asia Pacific Network Information Centre
6 Cordelia St
South Brisbane, QLD 4101
Australia
Phone: +61 7 3858 3100
Email: ggm@apnic.net
Huston, et al. Expires January 9, 2017 [Page 11]
Internet-Draft RPKI Validation July 2016
Carlos M. Martinez
Latin American and Caribbean IP Address Regional Registry
Rambla Mexico 6125
Montevideo 11400
Uruguay
Phone: +598 2604 2222
Email: carlos@lacnic.net
Tim Bruijnzeels
RIPE Network Coordination Centre
Singel 258
Amsterdam 1016 AB
The Netherlands
Email: tim@ripe.net
Andrew Lee Newton
American Registry for Internet Numbers
3635 Concorde Parkway
Chantilly, VA 20151
USA
Email: andy@arin.net
Daniel Shaw
African Network Information Centre (AFRINIC)
11th Floor, Standard Chartered Tower
Cybercity, Ebene
Mauritius
Phone: +230 403 51 00
Email: daniel@afrinic.net
Huston, et al. Expires January 9, 2017 [Page 12]