Subject: [Sidrops] Do ALL CA implementers include ALL *current* certificates in the "Resource Class List Response"?

From: Tim Bruijnzeels <[email-masked]>
Date: Wed, 4 Aug 2021 10:24:45 +0200

Dear group,

CA implementers in particular,

I am looking for clarity on RFC 6492 section 3.3.2: The provisioning protocol "Resource Class List Response".

This response payload includes information on resource and validity time entitlements for a child CA, as well as a list of current certificates. My issue is that I cannot find a normative "MUST" that says that the parent CA MUST include any and all current certificate for each of the child CA's keys. I believe that this is the intention, but I cannot assume now that every parent CA in fact does this.

So my question to other CA implementers is whether they will always include the full set of (current) certificates for all child keys known by the parent? And furthermore whether it's just me having doubts here, or that a small clarification on this point would be good to add or keep in mind for RFC 6492.

This is important, because IF the parent CA always includes the full set of current certificates for all keys, then the child CA can detect whether there is any inconsistency in what it believes the certified key is (or keys in case of a roll) versus the parent's view on this. And then it could take actions to recover (e.g. request revocation of surplus keys, certification of its current key, or even perform an emergency roll to a new key state).

Kind regards,

Tim Bruijnzeels

(implementer of the Krill CA)

---

From: Rob Austein <[email-masked]>
Date: Wed, 04 Aug 2021 21:43:21 -0400

On Wed, 04 Aug 2021 04:24:45 -0400, Tim Bruijnzeels wrote:
...
> This response payload includes information on resource and validity
> time entitlements for a child CA, as well as a list of current
> certificates. My issue is that I cannot find a normative "MUST" that
> says that the parent CA MUST include any and all current certificate
> for each of the child CA's keys. I believe that this is the
> intention, but I cannot assume now that every parent CA in fact does
> this.

Um, the section you cite explicitly says otherwise:

   Where the issuer has issued multiple certificates in a resource class
   signed with different keys (as may occur during a staged issuer-key
   rollover), only the most recent certificate issued with the currently
   "active" issuer's key is to be listed in the response.

As to what my (elderly) implementation does, we return any certs which:

a) Are marked "active", and

b) Have some resource overlap with what the back-end database says
   this child should have.

For grotty details, see
https://github.com/dragonresearch/rpki.net/blob/master/rpki/rpkidb/models.py#L1669