RPKI Validation Reconsidered
draft-ietf-sidr-rpki-validation-reconsidered-05

Abstract

This document proposes an update to the certificate validation procedure specified in RFC 6487 that reduces aspects of operational fragility in the management of certificates in the RPKI, while retaining essential security features.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on January 2, 2017.

Copyright Notice

Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 2. Certificate Validation in the RPKI
• 3. Operational Considerations
• 4. An Amended RPKI Certification Validation Process
• 4.1. Verified Resource Sets
• 4.2. Changes to existing standards
• 4.3. An example
• 5. Security Considerations
• 6. IANA Considerations
• 7. Acknowledgements
• 8. References
• 8.1. Normative References
• 8.2. Informative References
• Authors' Addresses

1. Introduction

This document proposes an update to the certificate validation procedure specified in [RFC6487] that reduces aspects of operational fragility in the management of certificates in the RPKI, while retaining essential security features.

2. Certificate Validation in the RPKI

As currently defined in section 7.2 of [RFC6487], validation of PKIX certificates that conform to the RPKI profile relies on the use of a path validation process where each certificate in the validation path is required to meet the certificate validation criteria.

These criteria require, in particular, that the Internet Number Resources (INRs) of each certificate in the validation path are “encompassed” by INRs on the issuing certificate. The first certificate in the path is required to be a trust anchor, and its resources are considered valid by definition.

For example, in the following sequence:

 
  Certificate 1 (trust anchor):
    Issuer TA,
    Subject TA,
    Resources 192.0.2.0/24, 198.51.100.0/24,
              2001:db8::/32, AS64496-AS64500

  Certificate 2: 
   Issuer TA,
   Subject CA1,
   Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32

  Certificate 3: 
   Issuer CA1,
   Subject CA2,
   Resources 192.0.2.0/24, 2001:db8::/32

  ROA 1:
   Embedded Certificate 4 (EE certificate): 
    Issuer CA2,
    Subject R1,
    Resources 192.0.2.0/24

    Prefix 192.0.2.0/24, Max Length 24, ASN 64496

All certificates in this scenario are considered valid since the INRs of each certificate are encompassed by those of the issuing certificate. ROA1 is valid because the specified prefix is encompassed by the embedded EE certificate, as required by [RFC6482].

3. Operational Considerations

The allocations recorded in the RPKI change as a result of resource transfers. For example, the CAs involved in transfer might choose to modify CA certificates in an order that causes some of these certificates to “over-claim” temporarily. A certificate is said to “over-claim” if it includes INRs not contained in the INRs of the CA that issued the certificate in question.

It may also happen that a child CA does not voluntarily request a shrunk resource certificate when resources are being transferred or reclaimed by the parent. Furthermore operational errors that may occur during management of RPKI databases also may create CA certificates that, temporarily, no longer encompass all of the INRs of subordinate certificates.

Consider the following sequence:

 
  Certificate 1 (trust anchor):
   Issuer TA,
   Subject TA,
   Resources 192.0.2.0/24, 198.51.100.0/24,
             2001:db8::/32, AS64496-AS64500

  Certificate 2:
   Issuer TA,
   Subject CA1,
   Resources 192.0.2.0/24, 2001:db8::/32

  Certificate 3 (invalid):
   Issuer CA1,
   Subject CA2,
   Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32

  ROA 1 (invalid):
   Embedded Certificate 4 (EE certificate): 
    Issuer CA2,
    Subject R1,
    Resources 192.0.2.0/24
   
    Prefix 192.0.2.0/24, Max Length 24, ASN 64496

Here Certificate 2 from the previous example was re-issued by TA to CA1 and the prefix 198.51.100.0/24 was removed. However, CA1 failed to re-issue a new Certificate 3 to CA2. As a result Certificate 3 is now over-claiming and considered invalid; by recursion the embedded Certificate 4 used for ROA1 is also invalid. And ROA1 is invalid because the specified prefix contained in the ROA is no longer encompassed by a valid embedded EE certificate, as required by [RFC6482]

However, it should be noted that ROA1 does not make use of any of the address resources that were removed from CA1’s certificate, and thus it would be desirable if ROA1 could still be viewed as valid. Technically CA1 should re-issue a Certificate 3 to CA2 without 198.51.100.0/24, and then ROA1 would be considered valid according to [RFC6482]. But as long as CA1 does not take this action, ROA1 remains invalid. It would be preferable if ROA1 could be considered valid, since the assertion it makes was not affected by the reduced scope of CA1’s certificate.

4. An Amended RPKI Certification Validation Process

4.1. Verified Resource Sets

The problem described above can be considered as a low probability problem today. However the potential impact on routing security would be high if an over-claiming occurred near the apex of the RPKI hierarchy, as this would invalidate the entirety of the sub-tree located below this point.

The changes proposed here to the validation procedure in [RFC6487] do not change the probability of this problem, but they do limit the impact to just the over-claimed resources. This revised validation algorithm is intended to avoid causing CA certificates to be treated as completely invalid as a result of over-claims. However, these changes are designed to not degrade the security offered by the RPKI. Specifically, ROAs and router certificates will be treated as valid only if all of the resources contained in them are encompassed by all superior certificates along a path to a trust anchor.

The way this is achieved conceptually is by maintaining Verified Resource Set (VRS) for each certificate that is separate from the INRs found in the [RFC3779] resource extension in the certificate.

4.2. Changes to existing standards

The following is an amended specification to be used in place of section 7.2 of [RFC6487].

The following algorithm is employed to validate CA and EE resources certificates. It is modeled on the path validation algorithm from [RFC5280], but modified to make use of the IP Address Delegation and AS Identifier Delegation Extensions from [RFC3779].

There are two inputs to the validation algorithm:

1. a trust anchor
2. a certificate to be validated

The algorithm is initialized with two new variables for use in the RPKI: Validated Resource Set-IP (VRS-IP) and Validated Resource Set-AS (VRS-AS). These sets are used to track the set of INRs (IP address space and AS Numbers) that are considered valid for each CA certificate. The VRS-IP and VRS-AS sets are initially set to the IP Address Delegation and AS Identifier Delegation values, respectively, from the trust anchor used to perform validation.

This path validation algorithm verifies, among other things, that a prospective certification path (a sequence of n certificates) satisfies the following conditions:

1. for all 'x' in {1, ..., n-1}, the subject of certificate 'x' is the issuer of certificate ('x' + 1);
2. certificate '1' is issued by a trust anchor;
3. certificate 'n' is the certificate to be validated; and
4. for all 'x' in {1, ..., n}, certificate 'x' is valid.

Certificate validation requires verifying that all of the following conditions hold, in addition to the certification path validation criteria specified in Section 6 of [RFC5280].

1. The signature of certificate x (x>1) is verified using the public key of the issuer’s certificate (x-1), using the signature algorithm specified for that public key (in certificate x-1).
2. The current time lies within the interval defined by the NotBefore and NotAfter values in the Validity field of certificate x.
3. The Version, Issuer, and Subject fields of certificate x satisfy the constraints established in Section 4.1-4.7 of this specification.
4. Certificate x contains all the extensions that MUST be present, as defined in Section 4.8 of this specification. The value(s) for each of these extensions MUST be satisfy the constraints established for each extension in the respective sections. Any extension not identified in Section 4.8 MUST NOT appear in certificate x.
5. Certificate x MUST NOT have been revoked, i.e., it MUST NOT appear on a CRL issued by the CA represented by certificate x-1
6. If certificate x is an EE certificate, then the INRs of this certificate MUST be "encompassed" by the values of VRS-IP and VRS-AS for certificate x-1.
7. If certificate x is a CA certificate, compute the VRS-IP and VRS-AS set values as indicated below:
   • If the IP Address Delegation extension is present in certificate x, compute the intersection of the resources between this extension and the value of the VRS-IP computed for certificate x-1.
   • If the IP Address Delegation extension is absent in certificate x, set the VRS-IP to NULL.
   • If the AS Identifier Delegation extension is present in certificate x, compute the intersection of the resources between this extension and the value of the VRS-AS computed for certificate x-1
   • If the AS Identifier Delegation extension is absent in certificate x, set the VRS-AS to NULL.
   • If x = n (i.e., this is the certificate being validated), then:
     1. If IP Address Delegation extension is present, it is replaced with the intersection of the values from that extension and the current value of the VRS-IP.
     2. If an AS Identifier Delegation extension is present, it is replaced with the intersection of the values from that extension and the current value of the VRS-IP.
   • If an RP is caching the results of validation, these values MAY be stored along with the certificate, to facilitate incremental validation based on cached results.

These rules allow a CA certificate to contain resources that are not present in (all of) the certificates along the path from the trust anchor to the CA certificate. If none of the resources in the CA certificate are present in all certificates along the path, no subordinate certificates could be valid. However, the certificate is not immediately rejected as this may be a transient condition. Not immediately rejecting the certificate does not result in a security problem because the associated VRS sets accurately reflect the resources validly associated with the certificate in question.

The INRs of an EE certificate being validated MUST always be encompassed by all certificates along the path to the trust anchor used to verify that certificate. The algorithm described above ensures this.

Note that ROAs [RFC6482] and BGPSec router (EE) certificates [I-D.ietf-sidr-bgpsec-pki-profiles] can contain multiple prefixes or ASNs respectively, and an over-claim of any of these would result in the ROA or BGPSec EE certificates being considered invalid. However, operators MAY issue separate ROAs or BGPSec router certificates to avoid this type of fate sharing.

4.3. An example

Consider the following example under the amended approach:

 
  Certificate 1 (trust anchor):
   Issuer TA,
   Subject TA,
   Resources 192.0.2.0/24, 198.51.100.0/24,
             2001:db8::/32, AS64496-AS64500
    
    Verified Resource Set: 192.0.2.0/24, 198.51.100.0/24,
                           2001:db8::/32, AS64496-AS64500
    Warnings: none

  Certificate 2: 
   Issuer TA,
   Subject CA1,
   Resources 192.0.2.0/24, 2001:db8::/32, AS64496
   
    Verified Resource Set: 192.0.2.0/24,
                           2001:db8::/32, AS64496
    Warnings: none

  Certificate 3: 
   Issuer CA1,
   Subject CA2,
   Resources 192.0.2.0/24, 198.51.100.0/24, AS64496
   
    Verified Resource Set: 192.0.2.0/24, AS64496
    Warnings: over-claim for 198.51.100.0/24

  ROA 1 (valid):
   Embedded Certificate 4 (EE certificate):
    Issuer CA2,
    Subject R1,
    Resources 192.0.2.0/24

     Verified resources: 192.0.2.0/24
     Warnings: none
     
     Prefix 192.0.2.0/24, Max Length 24, ASN 64496
    
    ROA1 is considered valid because the prefix matches the Verified
    Resource Set on the embedded EE certificate, as required by
    RFC 6482.

  ROA 2 (invalid):
   Embedded Certificate 5 (EE certificate invalid):
    Issuer CA2,
    Subject R2,
    Resources 198.51.100.0/24

     EE certificate is invalid due to over-claim for 198.51.100.0/24
     
     Prefix 198.51.100.0/24, Max Length 24, ASN 64496
    
    ROA2 is considered invalid because he embedded EE certificate is
    considered invalid.
    
  BGPSec Certificate 1 (valid):
   Issuer CA2
   Subject ROUTER-64496
   Resources AS64496
    
    Verified resources: AS64496
    Warnings: none
     
  BGPSec Certificate 2 (invalid):
   Issuer CA2
   Subject ALL-ROUTERS
   Resources AS64496-AS64497
    
    EE certificate is invalid due to over-claim for AS64497 
    
    This problem can be mitigated by issuing separate certificates
    for each AS number.

5. Security Considerations

The authors believe that the revised validation algorithm introduces no new security vulnerabilities into the RPKI.

6. IANA Considerations

No updates to the registries are suggested by this document.

7. Acknowledgements

TBA.

8. References

8.1. Normative References

8.2. Informative References

Authors' Addresses