Subject: Re: [Sidrops] I-D Action: draft-ietf-sidrops-rpki-rsc-03.txt

From: Job Snijders <[email-masked]>
Date: Fri, 28 May 2021 11:56:25 +0200

Dear all,

To follow up on posting -03 of the RSC draft. Attached is an example
'checklist.sig' file from which the eContent can be decoded as
following:

    Signed With Resources:
        1: IP: 2001:67c:208c::/48
    Filenames and Hashes:
        1: b42_ipv6_loa.png
            hash lRbdZL58FyW5/KEXEg5Y6NhCpSBoczmbPd/8kcS2rPA=
        2: <no filename>
            hash CuE5RyIAXNkvTGqgJNXWs+LmfWKfEXINlHimM6EXocc=

The X.509 EE certificate in 'checklist.sig' should decode like below and
should be valid under the RIPE NCC Trust Anchor.

Kind regards,

Job

    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number: 0 (0x0)
            Signature Algorithm: sha256WithRSAEncryption
            Issuer: CN = 38e14f92fdc7ccfbfc182361523ae27d697e952f
            Validity
                Not Before: May 28 09:31:47 2021 GMT
                Not After : May 28 09:31:47 2022 GMT
            Subject: CN = EE
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                    RSA Public-Key: (2048 bit)
                    Modulus:
                        00:95:a7:18:25:5e:ed:e9:4e:32:82:fa:19:7a:a9:
                        9d:54:75:ad:0f:7d:8a:2a:ed:6a:27:8e:c1:1e:c4:
                        62:86:07:6d:ff:1b:a6:71:8d:3e:60:72:fd:6b:a8:
                        34:93:64:dd:e1:e3:4f:0a:43:f8:7e:4b:b2:83:d2:
                        2e:0b:f8:ce:9c:70:54:1b:18:6d:20:89:40:0d:f0:
                        33:76:af:e9:27:b2:15:5d:4e:51:84:7f:37:85:e2:
                        d8:f2:4a:3b:17:0a:e9:2c:32:f6:ce:f8:ab:81:e5:
                        c8:69:d4:78:ce:30:41:92:95:5f:32:0b:ac:c2:12:
                        87:30:a9:bb:c8:6a:92:7d:10:1f:6c:06:be:d1:c2:
                        ea:ac:32:af:5b:f7:09:4d:7d:66:e2:c9:c3:ff:b3:
                        f9:8f:4c:e5:d9:2a:be:2d:a6:25:95:43:5a:79:97:
                        27:c1:bb:c8:43:80:bb:9f:83:c9:06:8b:5f:24:d2:
                        7c:4b:55:0a:36:10:bc:f7:62:9e:f2:42:2f:81:22:
                        99:f7:60:0f:84:39:cd:75:c7:f8:9d:ad:19:d6:71:
                        39:82:13:73:36:ae:73:27:58:ba:d1:94:ec:79:b9:
                        1f:34:1d:f0:e7:55:fe:45:65:5e:26:dd:1b:c8:71:
                        16:6a:fd:fb:53:5b:0e:af:5f:d1:0a:76:27:06:5d:
                        f8:cb
                    Exponent: 65537 (0x10001)
            X509v3 extensions:
                X509v3 Key Usage: critical
                    Digital Signature
                X509v3 Subject Key Identifier: 
                    B7:D4:EF:59:EE:7C:0E:60:DA:55:97:E3:71:31:90:92:20:C2:8A:A1
                X509v3 Authority Key Identifier: 
                    keyid:38:E1:4F:92:FD:C7:CC:FB:FC:18:23:61:52:3A:E2:7D:69:7E:95:2F
    
                X509v3 Certificate Policies: critical
                    Policy: 1.3.6.1.5.5.7.14.2
    
                sbgp-ipAddrBlock: critical
                    IPv6:
                      2001:67c:208c::/48
    
                Authority Information Access: 
                    CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/OOFPkv3HzPv8GCNhUjrifWl-lS8.cer
    
                X509v3 CRL Distribution Points: 
    
                    Full Name:
                      URI:rsync://chloe.sobornost.net/rpki/RIPE-nljobsnijders/OOFPkv3HzPv8GCNhUjrifWl-lS8.crl
    
        Signature Algorithm: sha256WithRSAEncryption
             07:56:ed:55:a3:07:55:5b:53:b2:05:fc:d3:08:42:65:87:18:
             70:bd:d6:01:40:1c:23:15:ab:f8:eb:7a:44:13:be:ea:99:ed:
             c9:ad:38:fa:43:e2:64:be:6f:ba:2b:83:74:6f:22:16:1f:8b:
             52:ca:c6:01:60:20:ec:2c:1a:9b:2d:8a:fd:9b:8b:4a:be:31:
             76:c1:56:a2:97:30:01:57:e6:75:a3:85:73:72:7e:92:16:2a:
             9b:a6:79:f6:b1:71:9a:a6:1e:d3:96:d0:7b:37:31:96:b0:1b:
             8b:91:7d:40:0e:63:6f:46:da:44:1d:16:99:61:89:0f:bd:71:
             76:88:28:94:90:18:1b:c8:d3:0e:33:b3:42:1d:80:69:be:7a:
             28:26:22:bd:55:b4:8e:fe:fd:dc:c9:04:78:26:70:16:82:dc:
             fe:1d:a5:f3:3a:5f:a8:3c:d3:5c:24:17:fb:cd:b3:d7:25:42:
             ca:21:50:c2:4a:8c:e0:bf:ac:6a:c4:19:27:49:84:eb:10:45:
             51:a2:6c:0a:df:a2:16:f6:9c:6f:91:58:24:0a:97:f3:50:41:
             81:8b:7d:6a:17:06:2e:2c:7d:b6:de:99:f2:bc:1e:d7:e7:b1:
             eb:56:1f:c9:36:da:5b:0b:ec:e0:06:b8:99:ec:17:54:b3:fd:
             81:25:b2:f3
    -----BEGIN CERTIFICATE-----
    MIIEGzCCAwOgAwIBAgIBADANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygzOGUx
    NGY5MmZkYzdjY2ZiZmMxODIzNjE1MjNhZTI3ZDY5N2U5NTJmMB4XDTIxMDUyODA5
    MzE0N1oXDTIyMDUyODA5MzE0N1owDTELMAkGA1UEAwwCRUUwggEiMA0GCSqGSIb3
    DQEBAQUAA4IBDwAwggEKAoIBAQCVpxglXu3pTjKC+hl6qZ1Uda0PfYoq7WonjsEe
    xGKGB23/G6ZxjT5gcv1rqDSTZN3h408KQ/h+S7KD0i4L+M6ccFQbGG0giUAN8DN2
    r+knshVdTlGEfzeF4tjySjsXCuksMvbO+KuB5chp1HjOMEGSlV8yC6zCEocwqbvI
    apJ9EB9sBr7RwuqsMq9b9wlNfWbiycP/s/mPTOXZKr4tpiWVQ1p5lyfBu8hDgLuf
    g8kGi18k0nxLVQo2ELz3Yp7yQi+BIpn3YA+EOc11x/idrRnWcTmCE3M2rnMnWLrR
    lOx5uR80HfDnVf5FZV4m3RvIcRZq/ftTWw6vX9EKdicGXfjLAgMBAAGjggFeMIIB
    WjAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFLfU71nufA5g2lWX43ExkJIgwoqh
    MB8GA1UdIwQYMBaAFDjhT5L9x8z7/BgjYVI64n1pfpUvMBgGA1UdIAEB/wQOMAww
    CgYIKwYBBQUHDgIwIgYIKwYBBQUHAQcBAf8EEzARMA8EAgACMAkDBwAgAQZ8IIww
    ZAYIKwYBBQUHAQEEWDBWMFQGCCsGAQUFBzAChkhyc3luYzovL3Jwa2kucmlwZS5u
    ZXQvcmVwb3NpdG9yeS9ERUZBVUxUL09PRlBrdjNIelB2OEdDTmhVanJpZldsLWxT
    OC5jZXIwZAYDVR0fBF0wWzBZoFegVYZTcnN5bmM6Ly9jaGxvZS5zb2Jvcm5vc3Qu
    bmV0L3Jwa2kvUklQRS1ubGpvYnNuaWpkZXJzL09PRlBrdjNIelB2OEdDTmhVanJp
    ZldsLWxTOC5jcmwwDQYJKoZIhvcNAQELBQADggEBAAdW7VWjB1VbU7IF/NMIQmWH
    GHC91gFAHCMVq/jrekQTvuqZ7cmtOPpD4mS+b7org3RvIhYfi1LKxgFgIOwsGpst
    iv2bi0q+MXbBVqKXMAFX5nWjhXNyfpIWKpumefaxcZqmHtOW0Hs3MZawG4uRfUAO
    Y29G2kQdFplhiQ+9cXaIKJSQGBvI0w4zs0IdgGm+eigmIr1VtI7+/dzJBHgmcBaC
    3P4dpfM6X6g801wkF/vNs9clQsohUMJKjOC/rGrEGSdJhOsQRVGibArfohb2nG+R
    WCQKl/NQQYGLfWoXBi4sfbbemfK8HtfnsetWH8k22lsL7OAGuJnsF1Sz/YElsvM=
    ----END CERTIFICATE-----

---

From: Job Snijders <[email-masked]>
Date: Fri, 28 May 2021 11:58:28 +0200

> should be valid under the RIPE NCC Trust Anchor.

Whoops, forgot to actually attach the attachment! :-) Here you go

Kind regards,

Job

---

From: Russ Housley <[email-masked]>
Date: Fri, 28 May 2021 08:36:17 -0400

Hi Job.

I updated my ASN.1 decoder to the (slightly) revised syntax, and it is able to decode your example.  I did not try to validate the signature.

Russ

> On May 28, 2021, at 5:58 AM, Job Snijders <job=[email-masked]> wrote:
> 
> <checklist.sig>_______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops

---

From: Job Snijders <[email-masked]>
Date: Fri, 28 May 2021 14:38:30 +0200

On Fri, May 28, 2021 at 08:36:17AM -0400, Russ Housley wrote:
> I updated my ASN.1 decoder to the (slightly) revised syntax, and it is
> able to decode your example.  I did not try to validate the signature.

Great - thank you.

Kind regards,

Job