Subject: [sidr] comments on draft-ietf-sidr-bgpsec-pki-profiles

From: Sean Turner <[email-masked]>
Date: Thu, 10 Mar 2016 11:55:48 +0900

Off-list, Rob correctly pointed out that there are two PKCS#10-related issues that are not describedt; both arise from requirements for BGPsec certificate extensions:

1) SIA extension is forbidden in BGPsec certificates.  

2) EKU extension is required in BGPsec certificates with a particular value.

Now we have a couple of options:

a) say nothing and rely on the CA doing the right thing

b) prohibit/require SIA/EKU (respectively) be present in the PKCS#10

c) For:

* SIA - allow SIA in the PKCS #10 and rely on the CA to discards it and issue a properly formed certificate.

* EKU - allow EKU but not require EKU in the PKCS #10; if present, the EKU must have the correct OID.

I’m partial to option c because it seems like the pragmatic approach.

Thoughts?

spt

---

From: Stephen Kent <[email-masked]>
Date: Fri, 11 Mar 2016 13:25:45 -0500

Sean,

Thanks for catching this omission.

I think option C is OK, if the text explains the rationale, as you have.

Steve
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: Randy Bush <[email-masked]>
Date: Sat, 12 Mar 2016 11:00:17 +0900

> a) say nothing and rely on the CA doing the right thing

and how has that worked out?  heck, it does not always work out when
clearly specified.

At Thu, 10 Mar 2016 11:55:48 +0900,
>   EKU must have the correct OID.

if eku missing in pkcs#10, put correct eku in cert, and issue

randy