Re: [sidr] Erratum for RFC6486? (manifests)

[Rob Austein <[e-mail]>]

At Tue, 16 Jul 2013 11:39:39 +0200, Tim Bruijnzeels wrote:
> 
> RFC6486 has this to say about the validity times of EE certificates in manifests:
> 
> http://tools.ietf.org/html/rfc6486#section-5.1
> 
>          In the case of a "one-time-use" EE certificate, the validity
>          times of the EE certificate MUST exactly match the thisUpdate
>          and nextUpdate times of the manifest.
> 
>          In the case of a "sequential-use" EE certificate, the validity
>          times of the EE certificate MUST encompass the time interval
>          from thisUpdate to nextUpdate.
> 
> 
> This causes some issues for our RP software, and I believe it would
> be better to remove the difference between one-time-use and
> sequential-use here, and go with something like this instead:
> 
>          The validity times of the EE certificate MUST encompass the time
>          interval from thisUpdate to nextUpdate.

I support this change

> In short: I think CAs should have the freedom to choose longer
> validity times for one-time-use EE certificates.

Agreed.

> As far as I know *all* implementations use one-time-use anyway,

The rpki.net implementation has always used sequential-use manifest EE
certificates.  We set the notAfter time of the manifest EE certificate
to match the notAfter time of its issuing CA certificate, on the
theory that the only reason we're even bothering with a separate EE
certificate is that PKIX doesn't allow us to use the CA certificate
directly.  If we were designing X.509 all over again to support this,
I'd class manifests as something to be covered directly by the CA
certificate, just as CRLs are.  But we're not revising X.509.

Manifest EE certificates are required to use RFC 3779 inheritance, so,
barring a key compromise, there's generally no pressing reason to
regenerate a manifest EE certificate.  We can always revoke the
manifest EE certificate if really necessary, but optimizing for the
key compromise case seems perverse. :)