Network Working Group G. Huston Internet-Draft G. Michaelson Updates: 3779 6482 6484 6487 (if APNIC approved) C. Martinez Intended status: Standards Track LACNIC Expires: April 6, 2017 T. Bruijnzeels RIPE NCC A. Newton ARIN D. Shaw AFRINIC October 3, 2016 RPKI Validation Reconsidered draft-ietf-sidr-rpki-validation-reconsidered-07 Abstract This document proposes an update to the certificate validation procedure specified in RFC 6487 that reduces aspects of operational fragility in the management of certificates in the RPKI, while retaining essential security features. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on April 6, 2017. Copyright Notice Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents Huston, et al. Expires April 6, 2017 [Page 1] Internet-Draft RPKI Validation October 2016 (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Certificate Validation in the RPKI . . . . . . . . . . . . . 2 3. Operational Considerations . . . . . . . . . . . . . . . . . 3 4. An Amended RPKI Certification Validation Process . . . . . . 5 4.1. Verified Resource Sets . . . . . . . . . . . . . . . . . 5 4.2. Changes to existing standards . . . . . . . . . . . . . . 5 4.2.1. Changes to RFC6484 . . . . . . . . . . . . . . . . . 5 4.2.2. Changes to RFC3779 . . . . . . . . . . . . . . . . . 6 4.2.3. Addendum to RFC6268 . . . . . . . . . . . . . . . . . 9 4.2.4. Changes to RFC6487 . . . . . . . . . . . . . . . . . 11 4.2.5. Changes to RFC6482 . . . . . . . . . . . . . . . . . 15 4.2.6. Changes to BGPSec PKI Profiles . . . . . . . . . . . 16 4.3. An example . . . . . . . . . . . . . . . . . . . . . . . 16 5. Deployment Considerations . . . . . . . . . . . . . . . . . . 17 6. Security Considerations . . . . . . . . . . . . . . . . . . . 18 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 18 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 19 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 19 9.1. Normative References . . . . . . . . . . . . . . . . . . 19 9.2. Informative References . . . . . . . . . . . . . . . . . 20 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20 1. Introduction This document proposes an update to the certificate validation procedure specified in [RFC6487] that reduces aspects of operational fragility in the management of certificates in the RPKI, while retaining essential security features. 2. Certificate Validation in the RPKI As currently defined in section 7.2 of [RFC6487], validation of PKIX certificates that conform to the RPKI profile relies on the use of a path validation process where each certificate in the validation path is required to meet the certificate validation criteria. These criteria require, in particular, that the Internet Number Resources (INRs) of each certificate in the validation path are Huston, et al. Expires April 6, 2017 [Page 2] Internet-Draft RPKI Validation October 2016 "encompassed" by INRs on the issuing certificate. The first certificate in the path is required to be a trust anchor, and its resources are considered valid by definition. For example, in the following sequence: Certificate 1 (trust anchor): Issuer TA, Subject TA, Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32, AS64496-AS64500 Certificate 2: Issuer TA, Subject CA1, Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32 Certificate 3: Issuer CA1, Subject CA2, Resources 192.0.2.0/24, 2001:db8::/32 ROA 1: Embedded Certificate 4 (EE certificate): Issuer CA2, Subject R1, Resources 192.0.2.0/24 Prefix 192.0.2.0/24, Max Length 24, ASN 64496 All certificates in this scenario are considered valid since the INRs of each certificate are encompassed by those of the issuing certificate. ROA1 is valid because the specified prefix is encompassed by the embedded EE certificate, as required by [RFC6482]. 3. Operational Considerations The allocations recorded in the RPKI change as a result of resource transfers. For example, the CAs involved in transfer might choose to modify CA certificates in an order that causes some of these certificates to "over-claim" temporarily. A certificate is said to "over-claim" if it includes INRs not contained in the INRs of the CA that issued the certificate in question. It may also happen that a child CA does not voluntarily request a shrunk resource certificate when resources are being transferred or reclaimed by the parent. Furthermore operational errors that may occur during management of RPKI databases also may create CA Huston, et al. Expires April 6, 2017 [Page 3] Internet-Draft RPKI Validation October 2016 certificates that, temporarily, no longer encompass all of the INRs of subordinate certificates. Consider the following sequence: Certificate 1 (trust anchor): Issuer TA, Subject TA, Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32, AS64496-AS64500 Certificate 2: Issuer TA, Subject CA1, Resources 192.0.2.0/24, 2001:db8::/32 Certificate 3 (invalid): Issuer CA1, Subject CA2, Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32 ROA 1 (invalid): Embedded Certificate 4 (EE certificate): Issuer CA2, Subject R1, Resources 192.0.2.0/24 Prefix 192.0.2.0/24, Max Length 24, ASN 64496 Here Certificate 2 from the previous example was re-issued by TA to CA1 and the prefix 198.51.100.0/24 was removed. However, CA1 failed to re-issue a new Certificate 3 to CA2. As a result Certificate 3 is now over-claiming and considered invalid; by recursion the embedded Certificate 4 used for ROA1 is also invalid. And ROA1 is invalid because the specified prefix contained in the ROA is no longer encompassed by a valid embedded EE certificate, as required by [RFC6482] However, it should be noted that ROA1 does not make use of any of the address resources that were removed from CA1's certificate, and thus it would be desirable if ROA1 could still be viewed as valid. Technically CA1 should re-issue a Certificate 3 to CA2 without 198.51.100.0/24, and then ROA1 would be considered valid according to [RFC6482]. But as long as CA1 does not take this action, ROA1 remains invalid. It would be preferable if ROA1 could be considered valid, since the assertion it makes was not affected by the reduced scope of CA1's certificate. Huston, et al. Expires April 6, 2017 [Page 4] Internet-Draft RPKI Validation October 2016 4. An Amended RPKI Certification Validation Process 4.1. Verified Resource Sets The problem described above can be considered as a low probability problem today. However the potential impact on routing security would be high if an over-claiming occurred near the apex of the RPKI hierarchy, as this would invalidate the entirety of the sub-tree located below this point. The changes proposed here to the validation procedure in [RFC6487] do not change the probability of this problem, but they do limit the impact to just the over-claimed resources. This revised validation algorithm is intended to avoid causing CA certificates to be treated as completely invalid as a result of over-claims. However, these changes are designed to not degrade the security offered by the RPKI. Specifically, ROAs and router certificates will be treated as valid only if all of the resources contained in them are encompassed by all superior certificates along a path to a trust anchor. The way this is achieved conceptually is by maintaining Verified Resource Set (VRS) for each certificate that is separate from the INRs found in the [RFC3779] resource extension in the certificate. 4.2. Changes to existing standards 4.2.1. Changes to RFC6484 The following is an amended specification to be used in place of section 1.2 of [RFC6484]. The name of this document is "Certificate Policy (CP) for the Resource PKI (RPKI)". This policy has been assigned the following two OIDs: id-cp-ipAddr-asNumber OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) cp(14) 2 } id-cp-ipAddr-asNumber-v2 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) cp(14) TBD1 } id-cp-ipAddr-asNumber and the extensions defined in [RFC3779] indicate that the original certification path validation rules are to be used. id-cp-ipAddr-asNumber-v2 and the extensions defined in [this document] indicate that the validation reconsidered Huston, et al. Expires April 6, 2017 [Page 5] Internet-Draft RPKI Validation October 2016 certification path validation rules defined in Section 4.2.4.4 are to be used. 4.2.2. Changes to RFC3779 To ensure that Relying Parties use the reconsidered certification path validation rules defined in Section 4.2.4.4, the following amended version of [RFC3779] is to be used. 4.2.2.1. OID for id-pe-ipAddrBlocks-v2 The following is an amended specification to be used in place of section 2.2.1 of [RFC3779]. The OID for this extension is id-pe-ipAddrBlocks-v2. id-pe-ipAddrBlocks-v2 OBJECT IDENTIFIER ::= { TBD2 } where [RFC3280] defines: id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) } id-pe OBJECT IDENTIFIER ::= { id-pkix 1 } 4.2.2.2. Syntax for id-pe-ipAddrBlocks-v2 The following is amended specification to be used in place of section 2.2.3 of [RFC3779]. Huston, et al. Expires April 6, 2017 [Page 6] Internet-Draft RPKI Validation October 2016 id-pe-ipAddrBlocks OBJECT IDENTIFIER ::= { TBD2 } IPAddrBlocks ::= SEQUENCE OF IPAddressFamily IPAddressFamily ::= SEQUENCE { -- AFI & optional SAFI -- addressFamily OCTET STRING (SIZE (2..3)), ipAddressChoice IPAddressChoice } IPAddressChoice ::= CHOICE { inherit NULL, -- inherit from issuer -- addressesOrRanges SEQUENCE OF IPAddressOrRange } IPAddressOrRange ::= CHOICE { addressPrefix IPAddress, addressRange IPAddressRange } IPAddressRange ::= SEQUENCE { min IPAddress, max IPAddress } IPAddress ::= BIT STRING 4.2.2.3. OID for id-pe-autonomousSysIds-v2 The following is an amended specification to be used in place of section 3.2.1 of [RFC3779]. The OID for this extension is id-pe-autonomousSysIds-v2. id-pe-autonomousSysIds-v2 OBJECT IDENTIFIER ::= { TBD3 } where [RFC3280] defines: id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) } id-pe OBJECT IDENTIFIER ::= { id-pkix 1 } 4.2.2.4. Syntax for id-pe-autonomousSysIds-v2 The following is an amended specification to be used in place of section 3.2.3 of [RFC3779]. Huston, et al. Expires April 6, 2017 [Page 7] Internet-Draft RPKI Validation October 2016 id-pe-autonomousSysIds OBJECT IDENTIFIER ::= { TBD3 } ASIdentifiers ::= SEQUENCE { asnum [0] EXPLICIT ASIdentifierChoice OPTIONAL, rdi [1] EXPLICIT ASIdentifierChoice OPTIONAL} ASIdentifierChoice ::= CHOICE { inherit NULL, -- inherit from issuer -- asIdsOrRanges SEQUENCE OF ASIdOrRange } ASIdOrRange ::= CHOICE { id ASId, range ASRange } ASRange ::= SEQUENCE { min ASId, max ASId } ASId ::= INTEGER 4.2.2.5. Amended IP Address Delegation Extension Certification Path Validation The following is an amended specification to be used in place of section 2.3 of [RFC3779]. Certificate path validation is performed as specified in Section 4.2.4.4 of [this document]. 4.2.2.6. Amended Autonomous System Identifier Delegation Extension Certification Path Validation The following is an amended specification to be used in place of section 3.3 of [RFC3779]. Certificate path validation is performed as specified in Section 4.2.4.4 of [this document]. 4.2.2.7. Amended ASN.1 module The following is an amended specification to be used in place of appendix A of [RFC3779]. This normative appendix describes the IP address and AS identifiers extensions used by conforming PKI components in ASN.1 syntax. Huston, et al. Expires April 6, 2017 [Page 8] Internet-Draft RPKI Validation October 2016 IPAddrAndASCertExtn-v2 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) mod(0) id-mod-ip-addr-and-as-ident-v2(TBD4) } DEFINITIONS EXPLICIT TAGS ::= BEGIN -- EXPORTS ALL -- IMPORTS -- PKIX specific OIDs and arcs -- id-pe FROM PKIX1Explicit88 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit(18) } -- IP Address Block and AS Identifiers Syntax -- IPAddrBlocks, ASIdentifiers FROM IPAddrAndASCertExtn { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) mod(0) id-mod-ip-addr-and-as-ident(30) } ; -- Validation Reconsidered IP Address Delegation Extension OID -- id-pe-ipAddrBlocks-v2 OBJECT IDENTIFIER ::= { id-pe TBD2 } -- Validation Reconsidered IP Address Delegation Extension Syntax -- -- Syntax is imported from [RFC3779] -- -- Validation Reconsidered Autonomous System Identifier Delegation Extension OID -- id-pe-autonomousSysIds-v2 OBJECT IDENTIFIER ::= { id-pe TBD3 } -- Validation Reconsidered Autonomous System Identifier Delegation Extension Syntax -- -- Syntax is imported from [RFC3779] -- END 4.2.3. Addendum to RFC6268 [RFC6268] is an informational RFC that updates some auxiliary ASN.1 modules to conform to the 2008 version of ASN.1; the 1988 ASN.1 modules for which we provided an update in Section 4.2.2.7 remain the normative version. Huston, et al. Expires April 6, 2017 [Page 9] Internet-Draft RPKI Validation October 2016 The following is an additional module confirming to the 2008 version of ASN.1 to be used with the updated version of [RFC3779] defined in [this document]. IPAddrAndASCertExtn-2010v2 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) mod(0) id-mod-ip-addr-and-as-ident-2v2(TBD5) } DEFINITIONS EXPLICIT TAGS ::= BEGIN EXPORTS ALL; IMPORTS -- PKIX specific OIDs and arcs -- id-pe FROM PKIX1Explicit-2009 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)} EXTENSION FROM PKIX-CommonTypes-2009 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)} -- IP Address Block and AS Identifiers Syntax -- IPAddrBlocks, ASIdentifiers FROM IPAddrAndASCertExtn-2010 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) mod(0) id-mod-ip-addr-and-as-ident-2(72) } ; -- -- Extensions contains the set of extensions defined in this -- module -- -- These are intended to be placed in public key certificates -- and thus should be added to the CertExtensions extension -- set in PKIXImplicit-2009 defined for [RFC5280] -- Extensions EXTENSION ::= { Huston, et al. Expires April 6, 2017 [Page 10] Internet-Draft RPKI Validation October 2016 ext-pe-ipAddrBlocks-v2 | ext-pe-autonomousSysIds-v2 } -- Validation Reconsidered IP Address Delegation Extension OID -- ext-pe-ipAddrBlocks-v2 EXTENSION ::= { SYNTAX IPAddrBlocks IDENTIFIED BY id-pe-ipAddrBlocks-v2 } id-pe-ipAddrBlocks-v2 OBJECT IDENTIFIER ::= { id-pe TBD2 } -- Validation Reconsidered IP Address Delegation Extension Syntax -- -- Syntax is imported from [RFC6268] -- -- Validation Reconsidered Autonomous System Identifier Delegation Extension OID -- ext-pe-autonomousSysIds-v2 EXTENSION ::= { SYNTAX ASIdentifiers IDENTIFIED BY id-pe-autonomousSysIds-v2 } id-pe-autonomousSysIds OBJECT IDENTIFIER ::= { id-pe TBD3 } -- Validation Reconsidered Autonomous System Identifier Delegation Extension Syntax -- -- Syntax is imported from [RFC6268] -- END 4.2.4. Changes to RFC6487 Certificate Authorities MUST issue certificates either as specified in [RFC6487] or with all the amendments specified in the following sections. 4.2.4.1. Amended Certificate Policies The following is an amended specification to be used in place of section 4.8.9 of [RFC6487]. This extension MUST be present and MUST be marked critical. It MUST include exactly one policy of type id-cp-ipAddr-asNumber-v2, as specified in the updated RPKI CP in Section 4.2.1 of [this document]. Huston, et al. Expires April 6, 2017 [Page 11] Internet-Draft RPKI Validation October 2016 4.2.4.2. Amended IP Resources The following is an amended specification to be used in place of section 4.8.10 of [RFC6487]. Either the IP Resources extension, or the AS Resources extension, or both, MUST be present in all RPKI certificates, and if present, MUST be marked critical. This extension contains the list of IP address resources as per Section 4.2.2.1 of [this document]. The value may specify the "inherit" element for a particular Address Family Identifier (AFI) value. In the context of resource certificates describing public number resources for use in the public Internet, the Subsequent AFI (SAFI) value MUST NOT be used. This extension MUST either specify a non-empty set of IP address records, or use the "inherit" setting to indicate that the IP address resource set of this certificate is inherited from that of the certificate's issuer. 4.2.4.3. Amended AS Resources The following is an amended specification to be used in place of section 4.8.11 of [RFC6487]. Either the AS Resources extension, or the IP Resources extension, or both, MUST be present in all RPKI certificates, and if present, MUST be marked critical. This extension contains the list of AS number resources as per Section 4.2.2.3 of [this document], or it may specify the "inherit" element. Routing Domain Identifier (RDI) values are NOT supported in this profile and MUST NOT be used. This extension MUST either specify a non-empty set of AS number records, or use the "inherit" setting to indicate that the AS number resource set of this certificate is inherited from that of the certificate's issuer. 4.2.4.4. Amended Resource Certificate Path Validation The following is an amended specification to be used in place of section 7.2 of [RFC6487]. The following algorithm is employed to validate CA and EE resources certificates. It is modeled on the path validation algorithm from Huston, et al. Expires April 6, 2017 [Page 12] Internet-Draft RPKI Validation October 2016 [RFC5280], but modified to make use of the IP Address Delegation and AS Identifier Delegation Extensions from [RFC3779]. There are two inputs to the validation algorithm: 1. a trust anchor 2. a certificate to be validated The algorithm is initialized with two new variables for use in the RPKI: Validated Resource Set-IP (VRS-IP) and Validated Resource Set- AS (VRS-AS). These sets are used to track the set of INRs (IP address space and AS Numbers) that are considered valid for each CA certificate. The VRS-IP and VRS-AS sets are initially set to the IP Address Delegation and AS Identifier Delegation values, respectively, from the trust anchor used to perform validation. This path validation algorithm verifies, among other things, that a prospective certification path (a sequence of n certificates) satisfies the following conditions: a. for all 'x' in {1, ..., n-1}, the subject of certificate 'x' is the issuer of certificate ('x' + 1); b. certificate '1' is issued by a trust anchor; c. certificate 'n' is the certificate to be validated; and d. for all 'x' in {1, ..., n}, certificate 'x' is valid. Certificate validation requires verifying that all of the following conditions hold, in addition to the certification path validation criteria specified in Section 6 of [RFC5280]. 1. The signature of certificate x (x>1) is verified using the public key of the issuer's certificate (x-1), using the signature algorithm specified for that public key (in certificate x-1). 2. The current time lies within the interval defined by the NotBefore and NotAfter values in the Validity field of certificate x. 3. The Version, Issuer, and Subject fields of certificate x satisfy the constraints established in Section 4.1-4.7 of this specification. 4. Certificate x contains all the extensions that MUST be present, as defined in Section 4.8 of this specification. The value(s) Huston, et al. Expires April 6, 2017 [Page 13] Internet-Draft RPKI Validation October 2016 for each of these extensions MUST be satisfy the constraints established for each extension in the respective sections. Any extension not identified in Section 4.8 MUST NOT appear in certificate x. 5. Certificate x MUST NOT have been revoked, i.e., it MUST NOT appear on a CRL issued by the CA represented by certificate x-1 6. Compute the VRS-IP and VRS-AS set values as indicated below: * If the IP Address Delegation extension is present in certificate x, compute the intersection of the resources between this extension and the value of the VRS-IP computed for certificate x-1. * If the IP Address Delegation extension is absent in certificate x, set the VRS-IP to NULL. * If the AS Identifier Delegation extension is present in certificate x, compute the intersection of the resources between this extension and the value of the VRS-AS computed for certificate x-1 * If the AS Identifier Delegation extension is absent in certificate x, set the VRS-AS to NULL. * If x = n (i.e., this is the certificate being validated), then: 1. If IP Address Delegation extension is present, it is replaced with the intersection of the values from that extension and the current value of the VRS-IP. 2. If an AS Identifier Delegation extension is present, it is replaced with the intersection of the values from that extension and the current value of the VRS-IP. * If an RP is caching the results of validation, these values MAY be stored along with the certificate, to facilitate incremental validation based on cached results. 7. If there is any difference in resources in the VRS-IP and the IP Address Delegation extension on certificate x, or the VRS-AS and the AS Identifier Delegation extension on certificate x, then: * If certificate x uses the updated version of [RFC6487] with the amended policy and extension defined in Section 4.2.4 a Huston, et al. Expires April 6, 2017 [Page 14] Internet-Draft RPKI Validation October 2016 warning listing the over-claiming resources for certificate x SHOULD be issued. * If certificate x uses the original version of [RFC6487], then certificate x MUST be rejected. These rules allow a CA certificate to contain resources that are not present in (all of) the certificates along the path from the trust anchor to the CA certificate. If none of the resources in the CA certificate are present in all certificates along the path, no subordinate certificates could be valid. However, the certificate is not immediately rejected as this may be a transient condition. Not immediately rejecting the certificate does not result in a security problem because the associated VRS sets accurately reflect the resources validly associated with the certificate in question. 4.2.5. Changes to RFC6482 Section 4 of [RFC6482] currently has the following text on the validation of resources on a ROA: o The IP address delegation extension [RFC3779] is present in the end-entity (EE) certificate (contained within the ROA), and each IP address prefix(es) in the ROA is contained within the set of IP addresses specified by the EE certificate's IP address delegation extension. The following is an amended specification to be used in place of this text. o The IP address delegation extension [RFC3779] is present in the end-entity (EE) certificate (contained within the ROA), and each IP address prefix(es) in the ROA is contained within the VRS-IP set that is specified as an outcome of EE certificate validation. Note that this ensures that ROAs can be valid only, if all IP address prefixes in the ROA are encompassed by the VRS-IP of all certificates along the path to the trust anchor used to verify it. Operators MAY issue separate ROAs for each IP address prefix, so that the loss of on IP address prefix from the VRS-IP of any certificate along the path to the trust anchor would not invalidate authorizations for other IP address prefixes. Huston, et al. Expires April 6, 2017 [Page 15] Internet-Draft RPKI Validation October 2016 4.2.6. Changes to BGPSec PKI Profiles In addition to the BGPsec Router Certificate Validation defined in section 3.3 of [I-D.ietf-sidr-bgpsec-pki-profiles], the following constraint MUST be met: o The VRS-AS of BGPsec Router Certificates MUST encompass all ASNs in the AS Resource Identifier Delegation extension. Furthermore we wish to note that operators MAY issue separate BGPsec Router Certificates for different ASNs, so that the loss of on ASN from the VRS-AS of any certificate along the path to the trust anchor would not invalidate router keys for other ASNs. 4.3. An example Consider the following example under the amended approach: Certificate 1 (trust anchor): Issuer TA, Subject TA, Resources 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32, AS64496-AS64500 Verified Resource Set: 192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32, AS64496-AS64500 Warnings: none Certificate 2: Issuer TA, Subject CA1, Resources 192.0.2.0/24, 2001:db8::/32, AS64496 Verified Resource Set: 192.0.2.0/24, 2001:db8::/32, AS64496 Warnings: none Certificate 3: Issuer CA1, Subject CA2, Resources 192.0.2.0/24, 198.51.100.0/24, AS64496 Verified Resource Set: 192.0.2.0/24, AS64496 Warnings: over-claim for 198.51.100.0/24 ROA 1 (valid): Embedded Certificate 4 (EE certificate): Issuer CA2, Huston, et al. Expires April 6, 2017 [Page 16] Internet-Draft RPKI Validation October 2016 Subject R1, Resources 192.0.2.0/24 Verified resources: 192.0.2.0/24 Warnings: none Prefix 192.0.2.0/24, Max Length 24, ASN 64496 ROA1 is considered valid because the prefix matches the Verified Resource Set on the embedded EE certificate, as required by RFC 6482. ROA 2 (invalid): Embedded Certificate 5 (EE certificate invalid): Issuer CA2, Subject R2, Resources 198.51.100.0/24 EE certificate is invalid due to over-claim for 198.51.100.0/24 Prefix 198.51.100.0/24, Max Length 24, ASN 64496 ROA2 is considered invalid because the embedded EE certificate is considered invalid. BGPSec Certificate 1 (valid): Issuer CA2 Subject ROUTER-64496 Resources AS64496 Verified resources: AS64496 Warnings: none BGPSec Certificate 2 (invalid): Issuer CA2 Subject ALL-ROUTERS Resources AS64496-AS64497 EE certificate is invalid due to over-claim for AS64497 This problem can be mitigated by issuing separate certificates for each AS number. 5. Deployment Considerations Because the use of the version of [RFC6487] updated in Section 4.2.4 in RPKI certificates and objects will lead to the rejection of such objects by Relying Party tools that do not implement this updated Huston, et al. Expires April 6, 2017 [Page 17] Internet-Draft RPKI Validation October 2016 version, it is important that such tools are updated before Certificate Authorities start to use this updated specification. However, because the choice of algorithm is well-defined for each certificate and/or RPKI signed object, there is no strict requirement for all Certificate Authorities to migrate to this new algorithm within a specific time period. The choice to opt-in to this can be made by each CA independently. CAs MAY also choose to use the new algorithm for new certificates or objects only, without pro-actively re-issuing existing objects - for example because the latter would require an active authorisation by a user of the system. Therefore the following deployment time line applies: +---------------+---------------------------------------------------+ | Months since | Step | | RFC | | +---------------+---------------------------------------------------+ | 6 | Relying Party tools MUST implement the updated | | | specification. | | 9 | Certificate Authorities MAY implement the updated | | | specification. | +---------------+---------------------------------------------------+ Table 1 6. Security Considerations The authors believe that the revised validation algorithm introduces no new security vulnerabilities into the RPKI. 7. IANA Considerations IANA is to add the following to the SMI Security for PKIX Certificate Policies registry: Decimal Description References TBD1 id-cp-ipAddr-asNumber-v2 [this RFC] IANA is to add the following to the SMI Security for PKIX Certificate Extension registry: Decimal Description References TBD2 id-pe-ipAddrBlocks-v2 [this RFC] TBD3 id-pe-autonomousSysIds-v2 [this RFC] Huston, et al. Expires April 6, 2017 [Page 18] Internet-Draft RPKI Validation October 2016 IANA is to add the following to the SMI Security for PKIX Module Identifier registry: Decimal Description References TBD4 IPAddrAndASCertExtn-v2 [this RFC] TBD5 IPAddrAndASCertExtn-2010v2 [this RFC] 8. Acknowledgements The authors would like to thank Stephen Kent for reviewing and contributing to this document. We would like to thank Rob Austein for suggesting that separate OIDs should be used to make the behaviour of Relying Party tools deterministic, and we would like to thank Russ Hously, Sean Turner and Tom Petch for their contributions on OID and ASN.1 updates. Finally we would like to thank Tom Harrison for a general review of this document. 9. References 9.1. Normative References [I-D.ietf-sidr-bgpsec-pki-profiles] Reynolds, M., Turner, S., and S. Kent, "A Profile for BGPsec Router Certificates, Certificate Revocation Lists, and Certification Requests", draft-ietf-sidr-bgpsec-pki- profiles-18 (work in progress), July 2016. [RFC3280] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 3280, DOI 10.17487/RFC3280, April 2002, . [RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP Addresses and AS Identifiers", RFC 3779, DOI 10.17487/RFC3779, June 2004, . [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, . Huston, et al. Expires April 6, 2017 [Page 19] Internet-Draft RPKI Validation October 2016 [RFC6268] Schaad, J. and S. Turner, "Additional New ASN.1 Modules for the Cryptographic Message Syntax (CMS) and the Public Key Infrastructure Using X.509 (PKIX)", RFC 6268, DOI 10.17487/RFC6268, July 2011, . [RFC6482] Lepinski, M., Kent, S., and D. Kong, "A Profile for Route Origin Authorizations (ROAs)", RFC 6482, DOI 10.17487/RFC6482, February 2012, . [RFC6484] Kent, S., Kong, D., Seo, K., and R. Watro, "Certificate Policy (CP) for the Resource Public Key Infrastructure (RPKI)", BCP 173, RFC 6484, DOI 10.17487/RFC6484, February 2012, . [RFC6487] Huston, G., Michaelson, G., and R. Loomans, "A Profile for X.509 PKIX Resource Certificates", RFC 6487, DOI 10.17487/RFC6487, February 2012, . 9.2. Informative References [RFC3849] Huston, G., Lord, A., and P. Smith, "IPv6 Address Prefix Reserved for Documentation", RFC 3849, DOI 10.17487/RFC3849, July 2004, . [RFC5398] Huston, G., "Autonomous System (AS) Number Reservation for Documentation Use", RFC 5398, DOI 10.17487/RFC5398, December 2008, . [RFC5737] Arkko, J., Cotton, M., and L. Vegoda, "IPv4 Address Blocks Reserved for Documentation", RFC 5737, DOI 10.17487/RFC5737, January 2010, . Authors' Addresses Geoff Huston Asia Pacific Network Information Centre 6 Cordelia St South Brisbane, QLD 4101 Australia Phone: +61 7 3858 3100 Email: gih@apnic.net Huston, et al. Expires April 6, 2017 [Page 20] Internet-Draft RPKI Validation October 2016 George Michaelson Asia Pacific Network Information Centre 6 Cordelia St South Brisbane, QLD 4101 Australia Phone: +61 7 3858 3100 Email: ggm@apnic.net Carlos M. Martinez Latin American and Caribbean IP Address Regional Registry Rambla Mexico 6125 Montevideo 11400 Uruguay Phone: +598 2604 2222 Email: carlos@lacnic.net Tim Bruijnzeels RIPE Network Coordination Centre Singel 258 Amsterdam 1016 AB The Netherlands Email: tim@ripe.net Andrew Lee Newton American Registry for Internet Numbers 3635 Concorde Parkway Chantilly, VA 20151 USA Email: andy@arin.net Daniel Shaw African Network Information Centre (AFRINIC) 11th Floor, Standard Chartered Tower Cybercity, Ebene Mauritius Phone: +230 403 51 00 Email: daniel@afrinic.net Huston, et al. Expires April 6, 2017 [Page 21]