Subject: [sidr] draft-ietf-res-certs

From: Geoff Huston <[email-masked]>
Date: Fri, 7 Nov 2008 07:00:45 +1100

WG Chair Hat OFF

Since Sandy's Last Call on this document there have been a few changes  
to the document which I should note here.

The first set of changes concerns the revision from -13 to -14 (http://smakd.potaroo.net/cgi-bin/htmlwdiff?f1=..%2fall-ids%2fdraft-ietf-sidr-res-certs-14.txt&f2=..%2fall-ids%2fdraft-ietf-sidr-res-certs-13.txt 
)

Following advice from Steve Kent, the section on Trust Anchors was
revised (section 6). The change has concerned the terminology used to
described the various structures proposed in the TA model.

Other changes include typography, and some clarification regarding the
treatment of signed objects and EE certificates with key rollover.

The -14 rev of the document was submitted to the drafts repository on
the 25th October.

I have prepared a -15 rev of the document to address a couple of other
concerns that appeared after the draft cut off date. This document is
at: http://www.potaroo.net/drafts/draft-ietf-sidr-res-certs-15.txt
until the draft submission process reopens in a couple of weeks.

The differences are:

a) consistent use of OID labels (GeneralNames, accessMethod,
     accessLocation) throughout the document

b) typo referring to id-ad-rpkiManifest

c) redraft part of section 3.9.7

old:
    When an EE certificate is intended for use in verifying multiple
    objects, EE certificate MUST include in the SIA an access method OID
    of id-ad-rpkiManifest, where the associated access location refers  
to
    the publication point of the objects that are verified using this EE
    certificate.

new:
    When an EE certificate is intended for use in verifying multiple
    objects, EE certificate MUST include in the SIA an accessMethod OID
    of id-ad-rpkiManifest, where the associated accessLocation refers
    to the EE's published manifest object as an object URL.

d) provide a new example certificate in Appendix that conforms to the  
spec!

new:

    The following is an example Resource Certificate.

    Certificate Name: 9JfgAEcq7Q-47IwMC5CJIJr6EJs.cer

    Data:
      Version: 3 (0x2(
      Serial: 1500 (0x5dc)
      Signature Algorithm: SHA256WithRSEEncryption
      Issuer: CN=APNIC Production-CVPQSgUkLy7pOXdNeVWGvnFX_0s
      Validity
       Not Before: Oct 25 12:50:00 2008 GMT
        Not After : Jan 31 00:00:00 2010 GMT
      Subject: CN=A91872ED
      Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
        RSA Public Key: (2048 bit)
        Modulus (2048 bit):
          00:bb:fb:4a:af:a4:b9:dc:d0:fa:6f:67:cc:27:39:
          34:d1:80:40:37:de:88:d1:64:a2:f1:b3:fa:c6:7f:
          bb:51:df:e1:c7:13:92:c3:c8:a2:aa:8c:d1:11:b3:
          aa:99:c0:ac:54:d3:65:83:c6:13:bf:0d:9f:33:2d:
          39:9f:ab:5f:cd:a3:e9:a1:fb:80:7d:1d:d0:2b:48:
          a5:55:e6:24:1f:06:41:35:1d:00:da:1f:99:85:13:
          26:39:24:c5:9a:81:15:98:fb:5f:f9:84:38:e5:d6:
          70:ce:5a:02:ca:dd:61:85:b3:43:2d:0b:35:d5:91:
          98:9d:da:1e:0f:c2:f6:97:b7:97:3e:e6:fc:c1:c4:
          3f:30:c4:81:03:25:99:09:4c:e2:4a:85:e7:46:4b:
          60:63:02:43:46:51:4d:ed:fd:a1:06:84:f1:4e:98:
          32:da:27:ee:80:82:d4:6b:cf:31:ea:21:af:6f:bd:
          70:34:e9:3f:d7:e4:24:cd:b8:e0:0f:8e:80:eb:11:
          1f:bc:c5:7e:05:8e:5c:7b:96:26:f8:2c:17:30:7d:
          08:9e:a4:72:66:f5:ca:23:2b:f2:ce:54:ec:4d:d9:
          d9:81:72:80:19:95:57:da:91:00:d9:b1:e8:8c:33:
          4a:9d:3c:4a:94:bf:74:4c:30:72:9b:1e:f5:8b:00:
          4d:e3
        Exponent: 65537 (0x10001)
      X509v3 extensions:
        X509v3 Subject Key Identifier:
          F4:97:E0:00:47:2A:ED:0F:B8:EC:8C:0C:0B:90:89:
          20:9A:FA:10:9B

        X509v3 Authority Key Identifier:
          keyid:09:53:D0:4A:05:24:2F:2E:E9:39:77:4D:79:
          55:86:BE:71:57:FF:4B

        X509v3 Key Usage: critical
          Certificate Sign, CRL Sign

        X509v3 Basic Constraints: critical
          CA:TRUE

        X509v3 CRL Distribution Points:
          URI:rsync://rpki.apnic.net/repository/A3C38A24
              D60311DCAB08F31979BDBE39/CVPQSgUkLy7pOXdNe
              VWGvnFX_0s.crl

        Authority Information Access:
           CA Issuers - URI:rsync://rpki.apnic.net/repos
              itory/8BDFC7DED5FD11DCB14CF4B1A703F9B7/CVP
              QSgUkLy7pOXdNeVWGvnFX_0s.cer

        X509v3 Certificate Policies: critical
           Policy: 1.3.6.1.5.5.7.14.2

        Subject Information Access:
           CA Repository - URI:rsync://rpki.apnic.net/mem
               ber_repository/A91872ED/06A83982887911DD81
               3F432B2086D636/
           Manifest - URI:rsync://rpki.apnic.net/member_r
               epository/A91872ED/06A83982887911DD813F432
               B2086D636/9JfgAEcq7Q-47IwMC5CJIJr6EJs.mft

         sbgp-autonomousSysNum: critical
           Autonomous System Numbers:
             24021
             38610
             131072
             131074

         sbgp-ipAddrBlock: critical
           IPv4:
             203.133.248.0/22
             203.147.108.0/23

      Signature Algorithm: sha256WithRSAEncryption
        51:4c:77:e4:21:64:80:e9:35:30:20:9f:d8:4b:88:60:b8:1f:
        73:24:9d:b5:17:60:65:6a:28:cc:43:4b:68:97:ca:76:07:eb:
        dc:bd:a2:08:3c:8c:56:38:c6:0a:1e:a8:af:f5:b9:42:02:6b:
        77:e0:b1:1c:4a:88:e6:6f:b6:17:d3:59:41:d7:a0:62:86:59:
        29:79:26:76:34:d1:16:2d:75:05:cb:b2:99:bf:ca:c6:68:1b:
        b6:a9:b0:f4:43:2e:df:e3:7f:3c:b3:72:1a:99:fa:5d:94:a1:
        eb:57:9c:9a:2c:87:d6:40:32:c9:ff:a6:54:b8:91:87:fd:90:
        55:ef:12:3e:1e:2e:cf:c5:ea:c3:4c:09:62:4f:88:00:a0:7f:
        cd:67:83:bc:27:e1:74:2c:18:4e:3f:12:1d:ef:29:0f:e3:27:
        00:ce:14:eb:f0:01:f0:36:25:a2:33:a8:c6:2f:31:18:22:30:
        cf:ca:97:43:ed:84:75:53:ab:b7:6c:75:f7:2f:55:5c:2e:82:
        0a:be:91:59:bf:c9:06:ef:bb:b4:a2:71:9e:03:b1:25:8e:29:
        7a:30:88:66:b4:f2:16:6e:df:ad:78:ff:d3:b2:9c:29:48:e3:
        be:87:5c:fc:20:2b:df:da:ca:30:58:c3:04:c9:63:72:48:8c:
        0a:5f:97:71

    Geoff

_______________________________________________
sidr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidr