Re: [Hipsec] I-D Action:draft-ietf-hip-cert-03.txt

["Mattes, David" <[e-mail]>]

> > Section 3, can we add another example that describes a managed PKI
> environment?  If you agree with my comment about HITs in the
> certificate, I will write up an example for this case.
> >
> 
> This is one of the remaining items on the todo list and we would
> appreciate your
> contribution.
> 

Here is proposed text for Section 3 and Section 4:

3.  X.509.v3 Certificate Object and Host Identities

   When using X.509.v3 certificates to transmit information related to
   HIP hosts, HITs may be enclosed within the certificates.  HITs can
   represent an issuer, a subject, or both.  In X.509.v3 HITs are
   represented as issuer and subject alternative name extensions as
   defined in [RFC2459].  If only HIP information is presented as either
   the issuer or the subject the HIT is also placed into the respective
   entity's DNs Common Name (CN) section in a colon delimited
   presentation format.  Inclusion of CN is not necessary if DN contains
   any other information.  It is RECOMMENDED to use FQDN/NAI from the

   hosts HOST_ID parameter in DN if one exists.  Full HIs are presented
   in the public key entries of X.509.v3 certificates.

   As an example, in a case where the issuer and the subject are both
   HIP enabled, the HITs are expressed as follows:


       Format:
           Issuer: CN=hit-of-host
           Subject: CN=hit-of-host

           X509v3 extensions:
               X509v3 Issuer Alternative Name:
                   IP Address:HIT-OF-HOST
               X509v3 Subject Alternative Name:
                   IP Address:HIT-OF-HOST

       Example:
           Issuer: CN=2001:14:6cf:fae7:bb79:bf78:7d64:c056
           Subject: CN=2001:14:6cf:fae7:bb79:bf78:7d64:c056

           X509v3 extensions:
               X509v3 Issuer Alternative Name:
                   IP Address:2001:14:6CF:FAE7:BB79:BF78:7D64:C056
               X509v3 Subject Alternative Name:
                   IP Address:2001:14:6CF:FAE7:BB79:BF78:7D64:C056

   Appendix B shows a full example X.509.v3 certificate with HIP
   content.

   As another example, consider a managed PKI environment in which the
   peers have certificates that are anchored in (potentially different)
   managed trust chains.  In this scenario, the certificates issued to
   HIP hosts are signed by intermediate Certificate Authorities (CAs) up
   to a root CA.  In this example, the managed PKI environment is
   neither HIP aware, nor can it be configured to compute HITs and
   include them in the certificates.

   In this scenario, it is recommended that the HIP peers have and use
   some mechanism of defining trusted root CAs for the purpose of
   establishing HIP communications.  Furthermore it is recommended that
   the HIP peers have and use some mechanism of checking peer
   certificate validity for revocation, signature, minimum cryptographic
   strength, etc., up to the trusted root CA.

   When HIP communications are established, the HIP hosts not only need
   to send their identity certificates (or pointers to their
   certificates), but also the chain of intermediate CAs (or pointers to
   the CAs) up to the root CA, or to a CA that is trusted by the remote
   peer.  This chain of certificates must be sent in a Cert group as
   specified in Section 2.  The HIP peers validate each other's
   Certificates and compute peer HITs based on the Certificate public
   keys. 


4.  SPKI Cert Object and Host Identities

   When using SPKI certificates to transmit information related to HIP
   hosts, HITs need to be enclosed within the certificates.  HITs can
   represent an issuer, a subject, or both.  In the following we define
   the representation of those identifiers for SPKI given as
   S-expressions.  Note that the S-expressions are only the human-
   readable representation of SPKI certificates.  Full HIs are presented
   in the public key sequences of SPKI certificates.

   As an example the Host Identity Tag of a host is expressed as
   follows:


       Format:  (hash hit hit-of-host)
       Example: (hash hit 2001:13:724d:f3c0:6ff0:33c2:15d8:5f50)

   Appendix A shows a full example SPKI certificate with HIP content.