Re: [Hipsec] I-D Action:draft-ietf-hip-cert-04.txt

[René Hummen <[e-mail]>]

Hi,

below are some questions and ideas that crossed my mind while reading the cert draft in section "2. CERT Parameter":

1.) The CERT parameter ordering is not completely clear to me. In a scenario with only one certificate per group the CERT parameters should be placed in ascending order according to the Cert group. However, when a Cert group consists of multiple Cert parameters, how should the CERT parameters of the group be ordered? In my opinion, CERT parameters of the same Cert group must also be placed in ascending order according to their Cert ID, but that's not what "The numbers in the Cert ID field MUST start from 1 up to Cert count." implies. Additionally it is not stated where you start numbering certificates in a chain: at the root (i.e. root-CA) or at leaf (i.e. Host ID)?

2.) When spanning a certificate chain across multiple packets, adding the first certificates of a group _and_ an additional list of issuers for the remaining certificates might be beneficial. The issuer list allows a verifier to validate that it trusts one of the issuing parties of the chain. If none is trusted, the verifier signals an error and drops the current and subsequent packets. Otherwise, it compares the issuer of subsequently received certificates with the ones in the list and only proceeds with the verification of the chain if the comparison was successful. This way, a verifier does not have to store/verify certificates in case there exists no trust root for the chain. Of course, a sender can still lie about the issuers, but this will be evident from the relative cheap list comparison.

3.) And finally: what is the reason behind limiting the group count to 1 in case of a certificate chain spanning multiple packets?

BR,
René


On 23.09.2010, at 13:01, Samu Varjonen wrote:
> Hi,
> 
> This is the updated version of the cert draft.
> 
>   Changes from version 03 to 04:
> 
>   o  Added the non-HIP aware use case to the Section 3.
> 
>   o  Clarified that the HITs are not always required in the
>      certificates.
> 
>   o  Rewrote the signaling section.
> 
>   o  LDAP URL to LDAP DN in Section 2 last paragraph.
> 
>   o  CERT is always covered by a signature as it's type number requires
> 
>   o  New example certificates
> 
>   o  Style and language clean-ups
> 
>   o  Changed IANA considerations
> 
>   o  Revised the type numbers
> 
>   o  RFC 2119 keywords
> 
>   o  Updated the IANA considerations section
> 
>   o  Rewrote the abstract
> 
> Comments are appreciated.
> 
> BR,
> Samu
> 
> On 09/23/2010 01:45 PM, [e-mail] wrote:
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>> This draft is a work item of the Host Identity Protocol Working Group of the IETF.
>> 
>> 
>> 	Title           : HIP Certificates
>> 	Author(s)       : T. Heer, S. Varjonen
>> 	Filename        : draft-ietf-hip-cert-04.txt
>> 	Pages           : 13
>> 	Date            : 2010-09-23
>> 
>> The CERT parameter is a container for X.509.v3 certificates and
>> Simple Public Key Infrastructure (SPKI) certificates.  It is used for
>> carrying these certificates in HIP control packets.  This document
>> only specifies the certificate parameter and the error signaling in
>> case of a failed verification.  The use of certificates including how
>> certificates are obtained, requested, and which actions are taken
>> upon successful or failed verification are to be defined in the
>> documents that use the certificate parameter.  Additionally, this
>> document specifies the representations of Host Identity Tags in
>> X.509.v3 and SPKI certificates.
>> 
>> A URL for this Internet-Draft is:
>> http://www.ietf.org/internet-drafts/draft-ietf-hip-cert-04.txt
>> 
>> Internet-Drafts are also available by anonymous FTP at:
>> ftp://ftp.ietf.org/internet-drafts/
>> 
>> Below is the data which will enable a MIME compliant mail reader
>> implementation to automatically retrieve the ASCII version of the
>> Internet-Draft.
>> 
>> 
>> 
>> _______________________________________________
>> Hipsec mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/hipsec
> 
> _______________________________________________
> Hipsec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/hipsec




--
Dipl.-Inform. Rene Hummen, Ph.D. Student
Chair of Communication and Distributed Systems
RWTH Aachen University, Germany
tel: [phone]
web: http://ds.rwth-aachen.de/members/hummen