| Network Working Group | G. Huston |
| Internet-Draft | G. Michaelson |
| Intended status: Standards Track | APNIC |
| Expires: June 25, 2018 | C. Martinez |
| LACNIC | |
| T. Bruijnzeels | |
| RIPE NCC | |
| A. Newton | |
| ARIN | |
| D. Shaw | |
| AFRINIC | |
| December 22, 2017 |
RPKI Validation Reconsidered
draft-ietf-sidr-rpki-validation-reconsidered-10
This document specifies an alternative to the certificate validation procedure specified in RFC 6487 that reduces aspects of operational fragility in the management of certificates in the RPKI, while retaining essential security features.
Where the procedure specified in RFC 6487 requires that Resource Certificates are rejecting entirely if they are found to over-claim any resources not contained on the issuing certificate, the validation process defined here allows an issuing Certificate Authority to chose to communicate that such Resource Certificates should be accepted for the intersection of their resources and the issuing certificate.
It should be noted that the validation process defined here considers validation under a single Trust Anchor only. In particular, concerns regarding over-claims where multiple configured Trust Anchors claim overlapping resources are considered out of scope for this document.
This choice is signalled by form of a set of alternative Object Identifiers (OIDs) of RFC 3779 X.509 Extensions for IP Addresses and AS Identifiers, and certificate policy for the Resource Public Key Infrastructure (RFC 6484). It should be noted that in case these OIDs are not used for any certificate under a Trust Anchor, the validation procedure defined here has the same outcome as the procedure defined in RFC 6487
Furthermore this document provides an alternative to ROA (RFC 6482), and BGPSec Router Certificate (BGPSec PKI Profiles - publication requested) validation.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on June 25, 2018.
Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
As currently defined in section 7.2 of [RFC6487], validation of PKIX certificates that conform to the RPKI profile relies on the use of a path validation process where each certificate in the validation path is required to meet the certificate validation criteria.
These criteria require, in particular, that the Internet Number Resources (INRs) of each certificate in the validation path are “encompassed” by INRs on the issuing certificate. The first certificate in the path is required to be a trust anchor, and its resources are considered valid by definition.
For example, in the following sequence:
Certificate 1 (trust anchor):
Issuer TA,
Subject TA,
Resources 192.0.2.0/24, 198.51.100.0/24,
2001:db8::/32, AS64496-AS64500
Certificate 2:
Issuer TA,
Subject CA1,
Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32
Certificate 3:
Issuer CA1,
Subject CA2,
Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32
ROA 1:
Embedded Certificate 4 (EE certificate):
Issuer CA2,
Subject R1,
Resources 192.0.2.0/24
Prefix 192.0.2.0/24, Max Length 24, ASN 64496
All certificates in this scenario are considered valid since the INRs of each certificate are encompassed by those of the issuing certificate. ROA1 is valid because the specified prefix is encompassed by the embedded EE certificate, as required by [RFC6482].
The allocations recorded in the RPKI change as a result of resource transfers. For example, the CAs involved in transfer might choose to modify CA certificates in an order that causes some of these certificates to “over-claim” temporarily. A certificate is said to “over-claim” if it includes INRs not contained in the INRs of the CA that issued the certificate in question.
It may also happen that a child CA does not voluntarily request a shrunk resource certificate when resources are being transferred or reclaimed by the parent. Furthermore operational errors that may occur during management of RPKI databases also may create CA certificates that, temporarily, no longer encompass all of the INRs of subordinate certificates.
Consider the following sequence:
Certificate 1 (trust anchor):
Issuer TA,
Subject TA,
Resources 192.0.2.0/24, 198.51.100.0/24,
2001:db8::/32, AS64496-AS64500
Certificate 2:
Issuer TA,
Subject CA1,
Resources 192.0.2.0/24, 2001:db8::/32
Certificate 3 (invalid):
Issuer CA1,
Subject CA2,
Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32
ROA 1 (invalid):
Embedded Certificate 4 (EE certificate, invalid):
Issuer CA2,
Subject R1,
Resources 192.0.2.0/24
Prefix 192.0.2.0/24, Max Length 24, ASN 64496
Here Certificate 2 from the previous example was re-issued by TA to CA1 and the prefix 198.51.100.0/24 was removed. However, CA1 failed to re-issue a new Certificate 3 to CA2. As a result Certificate 3 is now over-claiming and considered invalid; by recursion the embedded Certificate 4 used for ROA1 is also invalid. And ROA1 is invalid because the specified prefix contained in the ROA is no longer encompassed by a valid embedded EE certificate, as required by [RFC6482]
However, it should be noted that ROA1 does not make use of any of the address resources that were removed from CA1’s certificate, and thus it would be desirable if ROA1 could still be viewed as valid. Technically CA1 should re-issue a Certificate 3 to CA2 without 198.51.100.0/24, and then ROA1 would be considered valid according to [RFC6482]. But as long as CA1 does not take this action, ROA1 remains invalid. It would be preferable if ROA1 could be considered valid, since the assertion it makes was not affected by the reduced scope of CA1’s certificate.
The problem described above can be considered as a low probability problem today. However the potential impact on routing security would be high if an over-claiming occurred near the apex of the RPKI hierarchy, as this would invalidate the entirety of the sub-tree located below this point.
The changes specified here to the validation procedure in [RFC6487] do not change the probability of this problem, but they do limit the impact to just the over-claimed resources. This revised validation algorithm is intended to avoid causing CA certificates to be treated as completely invalid as a result of over-claims. However, these changes are designed to not degrade the security offered by the RPKI. Specifically, ROAs and router certificates will be treated as valid only if all of the resources contained in them are encompassed by all superior certificates along a path to a trust anchor.
The way this is achieved conceptually is by maintaining a Verified Resource Set (VRS) for each certificate that is separate from the INRs found in the [RFC3779] resource extension in the certificate.
Note that section 1.2 of [RFC6484] defines the "Certificate Policy (CP) for the Resource PKI (RPKI)" with the following OID:
id-cp-ipAddr-asNumber OBJECT IDENTIFIER ::= { iso(1)
identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) cp(14) 2 }
This document requests an assignment of a new OID for an alternative "Certificate Policy (CP) for use with validation reconsidered in the Resource PKI (RPKI)" as follows:
id-cp-ipAddr-asNumber-v2 OBJECT IDENTIFIER ::= { iso(1)
identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) cp(14) TBD1 }
This alternative Certificate Policy is the same as the Certificate Policy described in [RFC6484], except that it is used to drive the decision in step 8 of the validation procedure described in Section 4.2.4.4.
This document defines an alternative to [RFC3779]. All specifications and procedures described in [RFC3779] apply, with the following notable exceptions.
This document request an OID for the extension id-pe-ipAddrBlocks-v2 (id-pe TBD2). This OID MUST only be used in conjunction with the alternative Certificate Policy OID defined in Section 4.2.1.
The following is an amended specification to be used as an alternative to the specification in section 2.2.1 of [RFC3779].
The OID for this extension is id-pe-ipAddrBlocks-v2.
id-pe-ipAddrBlocks-v2 OBJECT IDENTIFIER ::= { id-pe TBD2 }
where [RFC5280] defines:
id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
id-pe-ipAddrBlocks-v2 OBJECT IDENTIFIER ::= { id-pe TBD2 }
IPAddrBlocks ::= SEQUENCE OF IPAddressFamily
IPAddressFamily ::= SEQUENCE { -- AFI & optional SAFI --
addressFamily OCTET STRING (SIZE (2..3)),
ipAddressChoice IPAddressChoice }
IPAddressChoice ::= CHOICE {
inherit NULL, -- inherit from issuer --
addressesOrRanges SEQUENCE OF IPAddressOrRange }
IPAddressOrRange ::= CHOICE {
addressPrefix IPAddress,
addressRange IPAddressRange }
IPAddressRange ::= SEQUENCE {
min IPAddress,
max IPAddress }
IPAddress ::= BIT STRING
Note that the descriptions of objects referenced in the syntax above are defined in sections 2.2.3.1 through 2.2.3.9 of [RFC3779].
This document request an OID for the extension id-pe-autonomousSysIds-v2 ( id-pe TBD3). This OID MUST only be used in conjunction with the alternative Certificate Policy OID defined in Section 4.2.1.
The following is an amended specification to be used as an alternative to the specification in section 3.2.1 of [RFC3779].
The OID for this extension is id-pe-autonomousSysIds-v2.
id-pe-autonomousSysIds-v2 OBJECT IDENTIFIER ::= { id-pe TBD3 }
where [RFC5280] defines:
id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7) }
id-pe OBJECT IDENTIFIER ::= { id-pkix 1 }
id-pe-autonomousSysIds-v2 OBJECT IDENTIFIER ::= { id-pe TBD3 }
ASIdentifiers ::= SEQUENCE {
asnum [0] EXPLICIT ASIdentifierChoice OPTIONAL,
rdi [1] EXPLICIT ASIdentifierChoice OPTIONAL}
ASIdentifierChoice ::= CHOICE {
inherit NULL, -- inherit from issuer --
asIdsOrRanges SEQUENCE OF ASIdOrRange }
ASIdOrRange ::= CHOICE {
id ASId,
range ASRange }
ASRange ::= SEQUENCE {
min ASId,
max ASId }
ASId ::= INTEGER
Certificate path validation is performed as specified in Section 4.2.4.4.
Certificate path validation is performed as specified in Section 4.2.4.4.
This document requests an OID for id-mod-ip-addr-and-as-ident-v2, as follows:
IPAddrAndASCertExtn-v2 { iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) mod(0)
id-mod-ip-addr-and-as-ident-v2(TBD4) }
The following is an amended specification to be used as an alternative to the specification in section appendix A of [RFC3779].
This normative appendix describes the IP address and AS identifiers extensions used by conforming PKI components in ASN.1 syntax.
IPAddrAndASCertExtn-v2 { iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) mod(0)
id-mod-ip-addr-and-as-ident-v2(TBD4) }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS ALL --
IMPORTS
-- PKIX specific OIDs and arcs --
id-pe FROM PKIX1Explicit88 { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) id-pkix1-explicit(18) }
-- IP Address Block and AS Identifiers Syntax --
IPAddrBlocks, ASIdentifiers FROM IPAddrAndASCertExtn { iso(1)
identified-organization(3) dod(6) internet(1) security(5)
mechanisms(5) pkix(7) mod(0) id-mod-ip-addr-and-as-ident(30) }
;
-- Validation Reconsidered IP Address Delegation Extension OID --
id-pe-ipAddrBlocks-v2 OBJECT IDENTIFIER ::= { id-pe TBD2 }
-- Validation Reconsidered IP Address Delegation Extension Syntax --
-- Syntax is imported from [RFC3779] --
-- Validation Reconsidered Autonomous System Identifier --
-- Delegation Extension OID --
id-pe-autonomousSysIds-v2 OBJECT IDENTIFIER ::= { id-pe TBD3 }
-- Validation Reconsidered Autonomous System Identifier --
-- Delegation Extension Syntax --
-- Syntax is imported from [RFC3779] --
END
This document requests an OID for id-mod-ip-addr-and-as-ident-2v2 as follows:
IPAddrAndASCertExtn-2010v2 { iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) mod(0)
id-mod-ip-addr-and-as-ident-2v2(TBD5) }
[RFC6268] is an informational RFC that updates some auxiliary ASN.1 modules to conform to the 2008 version of ASN.1; the 1988 ASN.1 modules in Section 4.2.2.7 remain the normative version.
The following is an additional module confirming to the 2008 version of ASN.1 to be used with the extensions defined in Section 4.2.2.1 and Section 4.2.2.3.
IPAddrAndASCertExtn-2010v2 { iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) mod(0)
id-mod-ip-addr-and-as-ident-2v2(TBD5) }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
EXPORTS ALL;
IMPORTS
-- PKIX specific OIDs and arcs —
id-pe
FROM PKIX1Explicit-2009
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkix1-explicit-02(51)}
EXTENSION
FROM PKIX-CommonTypes-2009
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkixCommon-02(57)}
-- IP Address Block and AS Identifiers Syntax --
IPAddrBlocks, ASIdentifiers
FROM IPAddrAndASCertExtn-2010
{ iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) mod(0)
id-mod-ip-addr-and-as-ident-2(72) }
;
--
-- Extensions contains the set of extensions defined in this
-- module
--
-- These are intended to be placed in public key certificates
-- and thus should be added to the CertExtensions extension
-- set in PKIXImplicit-2009 defined for [RFC5280]
--
Extensions EXTENSION ::= {
ext-pe-ipAddrBlocks-v2 | ext-pe-autonomousSysIds-v2
}
-- Validation Reconsidered IP Address Delegation Extension OID —
ext-pe-ipAddrBlocks-v2 EXTENSION ::= {
SYNTAX IPAddrBlocks
IDENTIFIED BY id-pe-ipAddrBlocks-v2
}
id-pe-ipAddrBlocks-v2 OBJECT IDENTIFIER ::= { id-pe TBD2 }
-- Validation Reconsidered IP Address Delegation --
-- Extension Syntax --
-- Syntax is imported from [RFC6268] --
-- Validation Reconsidered Autonomous System Identifier --
-- Delegation Extension OID --
ext-pe-autonomousSysIds-v2 EXTENSION ::= {
SYNTAX ASIdentifiers
IDENTIFIED BY id-pe-autonomousSysIds-v2
}
id-pe-autonomousSysIds OBJECT IDENTIFIER ::= { id-pe TBD3 }
-- Validation Reconsidered Autonomous System Identifier --
-- Delegation Extension Syntax --
-- Syntax is imported from [RFC6268] --
END
This document defines an alternative Profile for X.509 PKIX Resource Certificates. This profile follows all definitions and procedures described in [RFC6487] with the following notable exceptions.
The following is an amended specification to be used in this profile, in place of section 4.8.9 of [RFC6487].
This extension MUST be present and MUST be marked critical. It MUST include exactly one policy of type id-cp-ipAddr-asNumber-v2, as specified in the updated RPKI CP in Section 4.2.1.
The following is an amended specification to be used in this profile, in place of section 4.8.10 of [RFC6487].
Either the IP Resources extension, or the AS Resources extension, or both, MUST be present in all RPKI certificates, and if present, MUST be marked critical.
This extension contains the list of IP address resources as per Section 4.2.2.1. The value may specify the "inherit" element for a particular Address Family Identifier (AFI) value. In the context of resource certificates describing public number resources for use in the public Internet, the Subsequent AFI (SAFI) value MUST NOT be used.
This extension MUST either specify a non-empty set of IP address records, or use the "inherit" setting to indicate that the IP address resource set of this certificate is inherited from that of the certificate's issuer.
The following is an amended specification to be used in this profile, in place of section 4.8.11 of [RFC6487].
Either the AS Resources extension, or the IP Resources extension, or both, MUST be present in all RPKI certificates, and if present, MUST be marked critical.
This extension contains the list of AS number resources as per Section 4.2.2.3, or it may specify the "inherit" element. Routing Domain Identifier (RDI) values are NOT supported in this profile and MUST NOT be used.
This extension MUST either specify a non-empty set of AS number records, or use the "inherit" setting to indicate that the AS number resource set of this certificate is inherited from that of the certificate's issuer.
The following is an amended specification for path validation to be used in place of section 7.2 of [RFC6487] allowing for the validation of both certificates following the profile defined in [RFC6487], as well as certificates following the profile described above.
The following algorithm is employed to validate CA and EE resources certificates. It is modelled on the path validation algorithm from [RFC5280], but modified to make use of the IP Address Delegation and AS Identifier Delegation Extensions from [RFC3779].
There are two inputs to the validation algorithm:
The algorithm is initialized with two new variables for use in the RPKI: Validated Resource Set-IP (VRS-IP) and Validated Resource Set-AS (VRS-AS). These sets are used to track the set of INRs (IP address space and AS Numbers) that are considered valid for each CA certificate. The VRS-IP and VRS-AS sets are initially set to the IP Address Delegation and AS Identifier Delegation values, respectively, from the trust anchor used to perform validation.
This path validation algorithm verifies, among other things, that a prospective certification path (a sequence of n certificates) satisfies the following conditions:
Certificate validation requires verifying that all of the following conditions hold, in addition to the certification path validation criteria specified in Section 6 of [RFC5280].
These rules allow a CA certificate to contain resources that are not present in (all of) the certificates along the path from the trust anchor to the CA certificate. If none of the resources in the CA certificate are present in all certificates along the path, no subordinate certificates could be valid. However, the certificate is not immediately rejected as this may be a transient condition. Not immediately rejecting the certificate does not result in a security problem because the associated VRS sets accurately reflect the resources validly associated with the certificate in question.
Section 4 of [RFC6482] currently has the following text on the validation of resources on a ROA:
If the end-entity certificate uses the Certificate Policy defined in Section 4.2.4.1, then the following approach must be used instead.
Note that this ensures that ROAs can be valid only, if all IP address prefixes in the ROA are encompassed by the VRS-IP of all certificates along the path to the trust anchor used to verify it.
Operators MAY issue separate ROAs for each IP address prefix, so that the loss of one or more IP address prefixes from the VRS-IP of any certificate along the path to the trust anchor would not invalidate authorizations for other IP address prefixes.
If a BGPsec Router Certificate ([I-D.ietf-sidr-bgpsec-pki-profiles]) uses the Certificate Policy defined in Section 4.2.4.1, then in addition to the BGPsec Router Certificate Validation defined in section 3.3 of [I-D.ietf-sidr-bgpsec-pki-profiles], the following constraint MUST be met:
Operators MAY issue separate BGPsec Router Certificates for different ASNs, so that the loss of on ASN from the VRS-AS of any certificate along the path to the trust anchor would not invalidate router keys for other ASNs.
In this section we will demonstrate the outcome of RPKI validation performed using the algorithm and procedures described in Section 4.2.4.4, Section 4.2.5 and Section 4.2.6, under three deployment scenarios:
In this context we refer to a certificate as using the 'old' OIDs, if the certificate uses a combination of the OIDs defined in section 4.8.9 of [RFC6487], section 2.2.1 of [RFC3779] and/or section 3.2.1 od [RFC3779]. We refer to a certificate as using the 'new' OIDS, if the certificate uses a combination of OIDs defined in Section 4.2.4.1, Section 4.2.2.1 and/or Section 4.2.2.3.
Consider the following example:
Certificate 1 (trust anchor):
Issuer: TA,
Subject: TA,
OIDs: OLD,
Resources: 0/0, ::0, AS0-4294967295 (ALL Resources)
Verified Resource Set: 0/0, ::0, AS0-4294967295 (ALL Resources)
Warnings: none
Certificate 2:
Issuer: TA,
Subject: CA1,
OIDs: OLD,
Resources: 192.0.2.0/24, 2001:db8::/32, AS64496
Verified Resource Set: 192.0.2.0/24,
2001:db8::/32, AS64496
Warnings: none
Certificate 3 (invalid):
Issuer: CA1,
Subject: CA2,
OIDs: OLD,
Resources: 192.0.2.0/24, 198.51.100.0/24, AS64496
Verified Resource Set: 192.0.2.0/24, AS64496
Certificate 3 is considered invalid because "Resources:"
contains 198.51.100.0/24 which is not found in the
Verified Resource Set.
ROA 1 (invalid):
Embedded Certificate 4 (EE certificate invalid):
Issuer: CA2,
Subject: R1,
OIDs: OLD,
Resources: 192.0.2.0/24
Prefix 192.0.2.0/24, Max Length 24, ASN 64496
ROA1 is considered invalid because Certificate 3 is invalid.
ROA 2 (invalid):
Embedded Certificate 5 (EE certificate invalid):
Issuer: CA2,
Subject: R2,
OIDs: OLD,
Resources: 198.51.100.0/24
Prefix 198.51.100.0/24, Max Length 24, ASN 64496
ROA2 is considered invalid because Certificate 3 is invalid.
BGPSec Certificate 1 (invalid):
Issuer: CA2,
Subject: ROUTER-64496,
OIDs: NEW,
Resources: AS64496
BGPSec Certificate 1 is invalid because Certificate 3 is invalid.
BGPSec Certificate 2 (invalid):
Issuer: CA2,
Subject: ALL-ROUTERS,
OIDs: NEW,
Resources: AS64496-AS64497
BGPSec Certificate 2 is invalid because Certificate 3 is invalid.
Consider the following example under the amended approach:
Certificate 1 (trust anchor):
Issuer: TA,
Subject: TA,
OIDs: NEW,
Resources: 0/0, ::0, AS0-4294967295 (ALL Resources)
Verified Resource Set: 0/0, ::0, AS0-4294967295 (ALL Resources)
Warnings: none
Certificate 2:
Issuer: TA,
Subject: CA1,
OIDs: NEW,
Resources: 192.0.2.0/24, 2001:db8::/32, AS64496
Verified Resource Set: 192.0.2.0/24,
2001:db8::/32, AS64496
Warnings: none
Certificate 3:
Issuer: CA1,
Subject: CA2,
OIDs: NEW,
Resources: 192.0.2.0/24, 198.51.100.0/24, AS64496
Verified Resource Set: 192.0.2.0/24, AS64496
Warnings: over-claim for 198.51.100.0/24
ROA 1 (valid):
Embedded Certificate 4 (EE certificate):
Issuer: CA2,
Subject: R1,
OIDs: NEW,
Resources: 192.0.2.0/24
Prefix 192.0.2.0/24, Max Length 24, ASN 64496
Verified Resource Set: 192.0.2.0/24
Warnings: none
ROA1 is considered valid because the prefix matches the Verified
Resource Set on the embedded EE certificate.
ROA 2 (invalid):
Embedded Certificate 5 (EE certificate invalid):
Issuer: CA2,
Subject: R2,
OIDs: NEW,
Resources: 198.51.100.0/24
Prefix 198.51.100.0/24, Max Length 24, ASN 64496
Verified Resource Set: none (empty set)
Warnings: 198.51.100.0/24
ROA2 is considered invalid because the ROA prefix 198.51.100.0/24
is not contained in the Verified Resource Set.
BGPSec Certificate 1 (valid):
Issuer: CA2,
Subject: ROUTER-64496,
OIDs: NEW,
Resources: AS64496
Verified Resource Set: AS64496
Warnings: none
BGPSec Certificate 2 (invalid):
Issuer: CA2,
Subject: ALL-ROUTERS,
OIDs: NEW,
Resources: AS64496-AS64497
Verified Resource Set: AS64496
BGPSec Certificate 2 is invalid because not all of its Resources
are contained in the Verified Resource Set.
Note that this problem can be mitigated by issuing separate
certificates for each AS number.
In the following example new OIDs are used only for CA certificates where the issuing CA anticipates that an over-claim could occur, and has a desire to limit the impact of this to just the over-claimed resources in question:
Certificate 1 (trust anchor):
Issuer: TA,
Subject: TA,
OIDs: OLD,
Resources: 0/0, ::0, AS0-4294967295 (ALL Resources)
Verified Resource Set: 0/0, ::0, AS0-4294967295 (ALL Resources)
Warnings: none
Note that a Trust Anchor certificate cannot be found to over-claim.
So, using the new OIDs here would not change anything with regards
to the validity of this certificate.
Certificate 2:
Issuer: TA,
Subject: CA1,
OIDs: OLD,
Resources: 192.0.2.0/24, 2001:db8::/32, AS64496
Verified Resource Set: 192.0.2.0/24,
2001:db8::/32, AS64496
Warnings: none
Note that since the TA certificate claims all resources, it is
impossible to issue a certificate below it that could be found
to be over-claiming. Therefore there is no benefit in using the
new OIDs for Certificate 2.
Certificate 3:
Issuer: CA1,
Subject: CA2,
OIDs: NEW,
Resources: 192.0.2.0/24, 198.51.100.0/24, AS64496
Verified Resource Set: 192.0.2.0/24, AS64496
Warnings: over-claim for 198.51.100.0/24
Note that CA1 anticipated that it might invalid Certificate 3
issued to CA2, if its own resources on Certificate 2 were
modified and OLD OIDs would have been used on Certificate 3.
ROA 1 (valid):
Embedded Certificate 4 (EE certificate):
Issuer: CA2,
Subject: R1,
OIDs: OLD,
Resources: 192.0.2.0/24
Prefix 192.0.2.0/24, Max Length 24, ASN 64496
Verified Resource Set: 192.0.2.0/24
Warnings: none
ROA1 is considered valid because the prefix matches the Verified
Resource Set on the embedded EE certificate.
ROA 2 (invalid):
Embedded Certificate 5 (EE certificate invalid):
Issuer: CA2,
Subject: R2,
OIDs: OLD,
Resources: 198.51.100.0/24
Prefix 198.51.100.0/24, Max Length 24, ASN 64496
Verified Resource Set: none (empty set)
ROA2 is considered invalid because "Resources:" on its EE certificate
contains 198.51.100.0/24, which is not contained in its Verified
Resource Set.
Note that if new OIDs were used here (as in example 2) ROA 2 would be
considered invalid because the Prefix is not contained in the
Verified Resource Set.
So, if there is no difference in the validity outcome one could argue
that using old OIDs here is clearest, because any over-claim of ROA
prefixes MUST result in it being considered invalid (as described in
section 4.2.5).
BGPSec Certificate 1 (valid):
Issuer: CA2,
Subject: ROUTER-64496,
OIDs: OLD,
Resources: AS64496
Verified Resource Set: AS64496
Warnings: none
BGPSec Certificate 2 (invalid):
Issuer: CA2,
Subject: ALL-ROUTERS,
OIDs: OLD,
Resources: AS64496-AS64497
Verified Resource Set: AS64496
BGPSec Certificate 2 is consider invalid because "Resources:" contains
AS64497, which is not contained in its Verified Resource Set.
Note that if new OIDs were used here (as in example 2) BGPSec
Certificate 2 would be considered invalid because the Prefix is not
contained in the Verified Resource Set.
So, if there is no difference in the validity outcome one could argue
that using old OIDs here is the clearest, because any over-claim on
this certificate MUST result in it being considered invalid (as
described in section 4.2.6).
Also note that as in example 2 this problem can be mitigated by
issuing separate certificates for each AS number.
This document defines an alternative RPKI validation algorithm, but it does not dictate how this algorithm will be deployed. This should be discussed as a separate effort. That said, the following observations may help this discussion.
Because this document introduces new OIDs and an alternative to the Profile for X.509 PKIX Resource Certificates described in [RFC6487], the use of such certificates in the global RPKI will lead to the rejection of such certificates by Relying Party tools that do not (yet) implement the alternative profile described in this document.
For this reason it is important that such tools are updated before Certificate Authorities start to use this specification.
However, because the OIDs are defined in each RPKI certificate, there is no strict requirement for all Certificate Authorities to migrate to the new OIDs at the same time, or even for all the certificates they issue. The example in Section 5.3 illustrates a possible deployment where the new OIDs are used only when issuing CA certificates where an accidental over-claim may occur.
The authors believe that the revised validation algorithm introduces no new security vulnerabilities into the RPKI, because it cannot lead to any ROA and/or Router Certificates to be accepted if they contain resources that are not held by the issuer.
IANA is to add the following to the SMI Security for PKIX Certificate Policies registry:
Decimal Description References
TBD1 id-cp-ipAddr-asNumber-v2 [section 4.2.1]
IANA is to add the following to the SMI Security for PKIX Certificate Extension registry:
Decimal Description References
TBD2 id-pe-ipAddrBlocks-v2 [section 4.2.2.1]
TBD3 id-pe-autonomousSysIds-v2 [section 4.2.2.3]
IANA is to add the following to the SMI Security for PKIX Module Identifier registry:
Decimal Description References
TBD4 id-mod-ip-addr-and-as-ident-v2 [section 4.2.2.7]
TBD5 id-mod-ip-addr-and-as-ident-2v2 [section 4.2.3]
The authors would like to thank Stephen Kent for reviewing and contributing to this document. We would like to thank Rob Austein for suggesting that separate OIDs should be used to make the behaviour of Relying Party tools deterministic, and we would like to thank Russ Hously, Sean Turner and Tom Petch for their contributions on OID and ASN.1 updates. Finally we would like to thank Tom Harrison for a general review of this document.
| [RFC6268] | Schaad, J. and S. Turner, "Additional New ASN.1 Modules for the Cryptographic Message Syntax (CMS) and the Public Key Infrastructure Using X.509 (PKIX)", RFC 6268, DOI 10.17487/RFC6268, July 2011. |