Skip to main content

RPKI Validation Reconsidered
draft-ietf-sidr-rpki-validation-reconsidered-09

The information below is for an old version of the document.
Document Type
This is an older version of an Internet-Draft that was ultimately published as RFC 8360.
Authors Geoff Huston , George G. Michaelson , Carlos M. Martínez , Tim Bruijnzeels , Andy Newton , Daniel Shaw
Last updated 2017-12-01 (Latest revision 2017-11-15)
Replaces draft-huston-rpki-validation
RFC stream Internet Engineering Task Force (IETF)
Formats
Reviews
Additional resources Mailing list discussion
Stream WG state Submitted to IESG for Publication
Document shepherd Chris Morrow
Shepherd write-up Show Last changed 2016-10-26
IESG IESG state Became RFC 8360 (Proposed Standard)
Consensus boilerplate Yes
Telechat date (None)
Needs a YES. Needs 9 more YES or NO OBJECTION positions to pass.
Responsible AD Alvaro Retana
Send notices to "Chris Morrow" <morrowc@ops-netman.net>, aretana.ietf@gmail.com
IANA IANA review state Version Changed - Review Needed
draft-ietf-sidr-rpki-validation-reconsidered-09
The following Last Call announcement was sent out:

From: The IESG To: "IETF-Announce" CC: kitten-chairs@ietf.org, "Benjamin Kaduk" , kitten@ietf.org, kaduk@mit.edu, draft-ietf-kitten-krb-auth-indicator@ietf.org, stephen.farrell@cs.tcd.ie Reply-To: ietf@ietf.org Sender: Subject: Last Call: (Authentication Indicator in Kerberos Tickets) to Proposed Standard The IESG has received a request from the Common Authentication Technology Next Generation WG (kitten) to consider the following document: - 'Authentication Indicator in Kerberos Tickets' Internet-Draft RPKI Validation November 2017 Domain Identifier (RDI) values are NOT supported in this profile and MUST NOT be used. This extension MUST either specify a non-empty set of AS number records, or use the "inherit" setting to indicate that the AS number resource set of this certificate is inherited from that of the certificate's issuer. 4.2.4.4. Amended Resource Certificate Path Validation The following is an amended specification for path validation to be used in place of section 7.2 of [RFC6487] allowing for the validation of both certificates following the profile defined in [RFC6487], as well as certificates following the profile described above. The following algorithm is employed to validate CA and EE resources certificates. It is modelled on the path validation algorithm from [RFC5280], but modified to make use of the IP Address Delegation and AS Identifier Delegation Extensions from [RFC3779]. There are two inputs to the validation algorithm: 1. a trust anchor 2. a certificate to be validated The algorithm is initialized with two new variables for use in the RPKI: Validated Resource Set-IP (VRS-IP) and Validated Resource Set- AS (VRS-AS). These sets are used to track the set of INRs (IP address space and AS Numbers) that are considered valid for each CA certificate. The VRS-IP and VRS-AS sets are initially set to the IP Address Delegation and AS Identifier Delegation values, respectively, from the trust anchor used to perform validation. This path validation algorithm verifies, among other things, that a prospective certification path (a sequence of n certificates) satisfies the following conditions: a. for all 'x' in {1, ..., n-1}, the subject of certificate 'x' is the issuer of certificate ('x' + 1); b. certificate '1' is issued by a trust anchor; c. certificate 'n' is the certificate to be validated; and d. for all 'x' in {1, ..., n}, certificate 'x' is valid. Huston, et al. Expires May 19, 2018 [Page 14] Internet-Draft RPKI Validation November 2017 Certificate validation requires verifying that all of the following conditions hold, in addition to the certification path validation criteria specified in Section 6 of [RFC5280]. 1. The signature of certificate x (x>1) is verified using the public key of the issuer's certificate (x-1), using the signature algorithm specified for that public key (in certificate x-1). 2. The current time lies within the interval defined by the NotBefore and NotAfter values in the Validity field of certificate x. 3. The Version, Issuer, and Subject fields of certificate x satisfy the constraints established in Section 4.1-4.7 of this specification. 4. If certificate x uses the Certificate Policy defined in section 4.8.9 of [RFC6487], then the certificate MUST contain all extensions defined in section 4.8 of [RFC6487] that must be present. The value(s) for each of these extensions MUST satisfy the constraints established for each extension in the respective sections. Any extension not thus identified MUST NOT appear in certificate x. 5. If certificate x uses the Certificate Policy defined in Section 4.2.4.1, then all extensions defined in section 4.8 of [RFC6487], except sections 4.8.9, 4.8.10 and 4.8.10 MUST be present. The certificate MUST contain an extension as defined in Section 4.2.4.2 or Section 4.2.4.3, or both. The value(s) for each of these extensions MUST satisfy the constraints established for each extension in the respective sections. Any extension not thus identified MUST NOT appear in certificate x. 6. Certificate x MUST NOT have been revoked, i.e., it MUST NOT appear on a CRL issued by the CA represented by certificate x-1 7. Compute the VRS-IP and VRS-AS set values as indicated below: * If the IP Address Delegation extension is present in certificate x and x=1, set the VRS-IP to the resources found in this extension. * If the IP Address Delegation extension is present in certificate x and x>1, set the VRS-IP to the intersection of the resources between this extension and the value of the VRS- IP computed for certificate x-1. Huston, et al. Expires May 19, 2018 [Page 15] Internet-Draft RPKI Validation November 2017 * If the IP Address Delegation extension is absent in certificate x, set the VRS-IP to NULL. * If the IP Address Delegation extension is present in certificate x and x=1, set the VRS-IP to the resources found in this extension. * If the AS Identifier Delegation extension is present in certificate x and x>1, set the VRS-AS to the intersection of the resources between this extension and the value of the VRS- AS computed for certificate x-1 * If the AS Identifier Delegation extension is absent in certificate x, set the VRS-AS to NULL. 8. If there is any difference in resources in the VRS-IP and the IP Address Delegation extension on certificate x, or the VRS-AS and the AS Identifier Delegation extension on certificate x, then: * If certificate x uses the Certificate Policy defined in Section 4.2.4.1 a warning listing the over-claiming resources for certificate x SHOULD be issued. * If certificate x uses the Certificate Policy defined in section 4.8.9 of [RFC6487], then certificate x MUST be rejected. These rules allow a CA certificate to contain resources that are not present in (all of) the certificates along the path from the trust anchor to the CA certificate. If none of the resources in the CA certificate are present in all certificates along the path, no subordinate certificates could be valid. However, the certificate is not immediately rejected as this may be a transient condition. Not immediately rejecting the certificate does not result in a security problem because the associated VRS sets accurately reflect the resources validly associated with the certificate in question. 4.2.5. An alternative ROA validation RFC6482 Section 4 of [RFC6482] currently has the following text on the validation of resources on a ROA: o The IP address delegation extension [RFC3779] is present in the end-entity (EE) certificate (contained within the ROA), and each IP address prefix(es) in the ROA is contained within the set of IP addresses specified by the EE certificate's IP address delegation extension. Huston, et al. Expires May 19, 2018 [Page 16] Internet-Draft RPKI Validation November 2017 If the end-entity certificate uses the Certificate Policy defined in Section 4.2.4.1, then the following approach must be used instead. o The amended IP address delegation extension described in Section 4.2.4.2 is present in the end-entity (EE) certificate (contained within the ROA), and each IP address prefix(es) in the ROA is contained within the VRS-IP set that is specified as an outcome of EE certificate validation described in Section 4.2.4.4. Note that this ensures that ROAs can be valid only, if all IP address prefixes in the ROA are encompassed by the VRS-IP of all certificates along the path to the trust anchor used to verify it. Operators MAY issue separate ROAs for each IP address prefix, so that the loss of one or more IP address prefixes from the VRS-IP of any certificate along the path to the trust anchor would not invalidate authorizations for other IP address prefixes. 4.2.6. An alternative to BGPSec Router Certificate Validation If a BGPsec Router Certificate ([I-D.ietf-sidr-bgpsec-pki-profiles]) uses the Certificate Policy defined in Section 4.2.4.1, then in addition to the BGPsec Router Certificate Validation defined in section 3.3 of [I-D.ietf-sidr-bgpsec-pki-profiles], the following constraint MUST be met: o The VRS-AS of BGPsec Router Certificates MUST encompass all ASNs in the AS Resource Identifier Delegation extension. Operators MAY issue separate BGPsec Router Certificates for different ASNs, so that the loss of on ASN from the VRS-AS of any certificate along the path to the trust anchor would not invalidate router keys for other ASNs. 4.3. An example Consider the following example under the amended approach: Certificate 1 (trust anchor): Issuer TA, Subject TA, Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32, AS64496-AS64500 Verified Resource Set: 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32, AS64496-AS64500 Warnings: none Huston, et al. Expires May 19, 2018 [Page 17] Internet-Draft RPKI Validation November 2017 Certificate 2: Issuer TA, Subject CA1, Resources 192.0.2.0/24, 2001:db8::/32, AS64496 Verified Resource Set: 192.0.2.0/24, 2001:db8::/32, AS64496 Warnings: none Certificate 3: Issuer CA1, Subject CA2, Resources 192.0.2.0/24, 198.51.100.0/24, AS64496 Verified Resource Set: 192.0.2.0/24, AS64496 Warnings: over-claim for 198.51.100.0/24 ROA 1 (valid): Embedded Certificate 4 (EE certificate): Issuer CA2, Subject R1, Resources 192.0.2.0/24 Verified resources: 192.0.2.0/24 Warnings: none Prefix 192.0.2.0/24, Max Length 24, ASN 64496 ROA1 is considered valid because the prefix matches the Verified Resource Set on the embedded EE certificate. ROA 2 (invalid): Embedded Certificate 5 (EE certificate invalid): Issuer CA2, Subject R2, Resources 198.51.100.0/24 EE certificate is invalid due to over-claim for 198.51.100.0/24 Prefix 198.51.100.0/24, Max Length 24, ASN 64496 ROA2 is considered invalid because the embedded EE certificate is considered invalid. BGPSec Certificate 1 (valid): Issuer CA2 Subject ROUTER-64496 Resources AS64496 Huston, et al. Expires May 19, 2018 [Page 18] Internet-Draft RPKI Validation November 2017 Verified resources: AS64496 Warnings: none BGPSec Certificate 2 (invalid): Issuer CA2 Subject ALL-ROUTERS Resources AS64496-AS64497 EE certificate is invalid due to over-claim for AS64497 This problem can be mitigated by issuing separate certificates for each AS number. 5. Deployment Considerations Because this document introduces new OIDs and an alternative the Profile for X.509 PKIX Resource Certificates described in [RFC6487], the use of such certificates in the global RPKI will lead to the rejection of such certificates by Relying Party tools that do not (yet) implement the alternative profile described in this document. For this reason it is important that such tools are updated before Certificate Authorities start to use this specification. However, because the choice of algorithm is well-defined for each certificate and/or RPKI signed object, there is no strict requirement for all Certificate Authorities to migrate to this new algorithm within a specific time period. The choice to opt-in to this can be made by each CA independently. CAs MAY also choose to use the new algorithm for new certificates or objects only, without pro-actively re-issuing existing objects - for example because the latter would require an active authorisation by a user of the system. 6. Security Considerations The authors believe that the revised validation algorithm introduces no new security vulnerabilities into the RPKI, because it cannot lead to any ROA and/or Router Certificates to be accepted if they contain resources that are not held by the issuer. 7. IANA Considerations IANA is to add the following to the SMI Security for PKIX Certificate Policies registry: Decimal Description References TBD1 id-cp-ipAddr-asNumber-v2 [section 4.2.1] Huston, et al. Expires May 19, 2018 [Page 19] Internet-Draft RPKI Validation November 2017 IANA is to add the following to the SMI Security for PKIX Certificate Extension registry: Decimal Description References TBD2 id-pe-ipAddrBlocks-v2 [section 4.2.2.1] TBD3 id-pe-autonomousSysIds-v2 [section 4.2.2.3] IANA is to add the following to the SMI Security for PKIX Module Identifier registry: Decimal Description References TBD4 id-mod-ip-addr-and-as-ident-v2 [section 4.2.2.7] TBD5 id-mod-ip-addr-and-as-ident-2v2 [section 4.2.3] 8. Acknowledgements The authors would like to thank Stephen Kent for reviewing and contributing to this document. We would like to thank Rob Austein for suggesting that separate OIDs should be used to make the behaviour of Relying Party tools deterministic, and we would like to thank Russ Hously, Sean Turner and Tom Petch for their contributions on OID and ASN.1 updates. Finally we would like to thank Tom Harrison for a general review of this document. 9. References 9.1. Normative References [I-D.ietf-sidr-bgpsec-pki-profiles] Reynolds, M., Turner, S., and S. Kent, "A Profile for BGPsec Router Certificates, Certificate Revocation Lists, and Certification Requests", draft-ietf-sidr-bgpsec-pki- profiles-21 (work in progress), January 2017. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/info/rfc2119>. [RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP Addresses and AS Identifiers", RFC 3779, DOI 10.17487/RFC3779, June 2004, <https://www.rfc-editor.org/info/rfc3779>. Huston, et al. Expires May 19, 2018 [Page 20] Internet-Draft RPKI Validation November 2017 [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, <https://www.rfc-editor.org/info/rfc5280>. [RFC6482] Lepinski, M., Kent, S., and D. Kong, "A Profile for Route Origin Authorizations (ROAs)", RFC 6482, DOI 10.17487/RFC6482, February 2012, <https://www.rfc-editor.org/info/rfc6482>. [RFC6484] Kent, S., Kong, D., Seo, K., and R. Watro, "Certificate Policy (CP) for the Resource Public Key Infrastructure (RPKI)", BCP 173, RFC 6484, DOI 10.17487/RFC6484, February 2012, <https://www.rfc-editor.org/info/rfc6484>. [RFC6487] Huston, G., Michaelson, G., and R. Loomans, "A Profile for X.509 PKIX Resource Certificates", RFC 6487, DOI 10.17487/RFC6487, February 2012, <https://www.rfc-editor.org/info/rfc6487>. 9.2. Informative References [RFC6268] Schaad, J. and S. Turner, "Additional New ASN.1 Modules for the Cryptographic Message Syntax (CMS) and the Public Key Infrastructure Using X.509 (PKIX)", RFC 6268, DOI 10.17487/RFC6268, July 2011, <https://www.rfc-editor.org/info/rfc6268>. Authors' Addresses Geoff Huston Asia Pacific Network Information Centre 6 Cordelia St South Brisbane, QLD 4101 Australia Phone: +61 7 3858 3100 Email: gih@apnic.net Huston, et al. Expires May 19, 2018 [Page 21] Internet-Draft RPKI Validation November 2017 George Michaelson Asia Pacific Network Information Centre 6 Cordelia St South Brisbane, QLD 4101 Australia Phone: +61 7 3858 3100 Email: ggm@apnic.net Carlos M. Martinez Latin American and Caribbean IP Address Regional Registry Rambla Mexico 6125 Montevideo 11400 Uruguay Phone: +598 2604 2222 Email: carlos@lacnic.net Tim Bruijnzeels RIPE Network Coordination Centre Singel 258 Amsterdam 1016 AB The Netherlands Email: tim@ripe.net Andrew Lee Newton American Registry for Internet Numbers 3635 Concorde Parkway Chantilly, VA 20151 USA Email: andy@arin.net Daniel Shaw African Network Information Centre (AFRINIC) 11th Floor, Standard Chartered Tower Cybercity, Ebene Mauritius Phone: +230 403 51 00 Email: daniel@afrinic.net Huston, et al. Expires May 19, 2018 [Page 22]