IETF Logo Mail Archive

Re: [Acme] Internet-Draft: PQC Algorithm negotiation in ACME

Russ Housley <housley@vigilsec.com> Fri, 11 August 2023 16:57 UTC

Return-Path: <housley@vigilsec.com>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E5B9C151095 for <acme@ietfa.amsl.com>; Fri, 11 Aug 2023 09:57:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Level:
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id owtiO3oFiML0 for <acme@ietfa.amsl.com>; Fri, 11 Aug 2023 09:57:30 -0700 (PDT)
Received: from mail3.g24.pair.com (mail3.g24.pair.com [66.39.134.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42300C14CF1D for <acme@ietf.org>; Fri, 11 Aug 2023 09:57:30 -0700 (PDT)
Received: from mail3.g24.pair.com (localhost [127.0.0.1]) by mail3.g24.pair.com (Postfix) with ESMTP id 9ED741493E4 for <acme@ietf.org>; Fri, 11 Aug 2023 12:57:29 -0400 (EDT)
Received: from smtpclient.apple (pfs.iad.rg.net [198.180.150.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail3.g24.pair.com (Postfix) with ESMTPSA id 92510149029 for <acme@ietf.org>; Fri, 11 Aug 2023 12:57:29 -0400 (EDT)
From: Russ Housley <housley@vigilsec.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.600.7\))
Date: Fri, 11 Aug 2023 12:57:19 -0400
References: <CABLzjm-8W4yFeJr1dOMc0Uk5sA_B0gZGduVioH0EAL5WpCiaZg@mail.gmail.com> <2dea03ee-6c91-4994-bf3f-84744ae9fcc3@gmail.com> <CAEmnErdykcSkPewOX2REGBKm8mukaShT9iVHU5e6uNLYvVNFKQ@mail.gmail.com> <ZNZbIjXenekH4hZ4@LK-Perkele-VII2.locald>
To: IETF ACME <acme@ietf.org>
In-Reply-To: <ZNZbIjXenekH4hZ4@LK-Perkele-VII2.locald>
Message-Id: <C8887FFB-FA11-4205-AD8C-03FDCA2DBBC9@vigilsec.com>
X-Mailer: Apple Mail (2.3731.600.7)
X-Scanned-By: mailmunge 3.11 on 66.39.134.11
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/NI8nAuWz2akwHfG0cz9bgSbzwQY>
Subject: Re: [Acme] Internet-Draft: PQC Algorithm negotiation in ACME
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Aug 2023 16:57:31 -0000

Thinking about KEM PoP in the context of ACME. The subject must provide the KEM subject public key as part of the certificate request.  A new challenge could be defined (for example, dns-kem-00) where the token is a KEM ciphertext, and the subject needs to put the corresponding plaintext in to DNS.  This proves possession of the KEM private key as well as administrative control over the domain.

This does not totally match the flow in RFC 8555, which is:

   1.  Submit an order for a certificate to be issued

   2.  Prove control of any identifiers requested in the certificate

   3.  Finalize the order by submitting a CSR

   4.  Await issuance and download the issued certificate

The KEM public key would need to be provided in step 1.  I guess it is not a big deal for the KEM public key to be repeated in step 3, as long as the ACME server checked for a match.

Russ

v2.46.0 | Report a Bug | By Email | System Status