Subject: Re: [sidr] only one RPKI

From: Stephen Kent <[email-masked]>
Date: Thu, 20 Nov 2008 19:41:28 -0500

Andy,

In looking through the SIDR archives (since I am not getting messages 
directly from the list)  I saw the following posting:

>Incidentally, I thought I heard Russ Housley say at the mike that 
>the cert format says what CP appliels and it points to this CP. If I 
>understand, using a different CP means changing the cert format. Am 
>I wrong?
>I see the following, which I presume is what Russ was referring to:
>
>3.9.8.  Certificate Policies
>
>    This extension MUST reference the Resource Certificate Policy, using
>    the OID Policy Identifier value of "1.3.6.1.5.5.7.14.2".  This field
>    MUST be present and MUST contain only this value for Resource
>    Certificates.
>
>    No PolicyQualifiers are defined for use with this policy and thus
>    none must be included in this extension.
>
>    This extension MUST be present and it is critical.

If you do not follow the CP that has the OID in the CP that is under 
discussion in SIDR, then you must not issue certs containing that OID 
in the cert policy field.  You could issue certs with a different 
policy OID, or with no policy OID. Niether would meet the criteria 
for RPKI Certs, and thus should be rejected by compliant relying 
party software.

Steve
_______________________________________________
sidr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sidr

---

From: Andrei Robachevsky <[email-masked]>
Date: Fri, 21 Nov 2008 02:48:02 +0100

Steve,

Am I correct assuming that the OID will be assigned once the I-D becomes
an RFC?

But I find it rather strange that cp(14) is not registered as well. Has
it not been used in the pkix context?

Thanks,

Andrei

Stephen Kent wrote on 21-11-2008 01:41:
>> Incidentally, I thought I heard Russ Housley say at the mike that the
>> cert format says what CP appliels and it points to this CP. If I
>> understand, using a different CP means changing the cert format. Am I
>> wrong?
> discussion in SIDR, then you must not issue certs containing that OID in
> the cert policy field.  You could issue certs with a different policy
> OID, or with no policy OID. Niether would meet the criteria for RPKI
> Certs, and thus should be rejected by compliant relying party software.
> 
> Steve

---

From: Robert Loomans <[email-masked]>
Date: Fri, 21 Nov 2008 17:26:47 +1000

> it not been used in the pkix context?

The PKIX OIDs are maintained at http://www.imc.org/ietf-pkix/pkix-oid.asn

Both id-cp(id-pkix 14) and id-cp-sbgpCertificatePolicy(id-cp 1) are  
already assigned.

Cheers,
     Rob

-- 
Robert Loomans                                 Email:  [email-masked]
Senior Software Engineer, APNIC                Phone:    +61 7 3858 3100
http://www.apnic.net                             Fax:    +61 7 3858 3199

---

From: Andrei Robachevsky <[email-masked]>
Date: Fri, 21 Nov 2008 15:16:34 +0100

Thanks for clarification Rob.

Andrei

---

From: Andy Newton <[email-masked]>
Date: Fri, 21 Nov 2008 09:34:46 -0500

Steve,

This explanation helps my understanding significantly.  Thanks.

Regarding the rejection by complaint relying party software: this is because
the validation step includes looking for the specific OID assigned by the CP
draft?  In other words, if another CP assigned another OID and the relying
party software could be configured to additionally accommodate said OID,
then this specification suite could be used in a slightly different context?

-andy