Re: [Sidrops] Bug Fix Validator 3

[Tim Bruijnzeels <[e-mail]>]

Hi all,

> On 16 Dec 2019, at 16:49, Nathalie Trenaman <[e-mail]> wrote:
> 
> Hi all, 
> 
> We have just released a bug fix version of our Validator 3.
> 
> You can find them here: 
> 
> Centos7 - https://ftp.ripe.net/tools/rpki/validator3/prod/centos7/repo/rpki-validator-3.1-2019.12.16.15.18.18.noarch.rpm <https://ftp.ripe.net/tools/rpki/validator3/prod/centos7/repo/rpki-validator-3.1-2019.12.16.15.18.18.noarch.rpm>
> Debian - https://ftp.ripe.net/tools/rpki/validator3/prod/deb/rpki-validator-3.1-2019.12.16.15.18.18.deb <https://ftp.ripe.net/tools/rpki/validator3/prod/deb/rpki-validator-3.1-2019.12.16.15.18.18.deb>
> Generic build - https://ftp.ripe.net/tools/rpki/validator3/prod/generic/rpki-validator-3.1-2019.12.16.15.18.18-dist.tar.gz <https://ftp.ripe.net/tools/rpki/validator3/prod/generic/rpki-validator-3.1-2019.12.16.15.18.18-dist.tar.gz>
> 
> If you have yum repository configured, "yum install rpki-validator" will do the job.
> 
> This was an interesting bug - We always relied on the idea that serial numbers of manifest objects increase --- apparently all the Trust Anchors so far (except for some of the sub-repositories under APNIC) generated increasing serial numbers and it always worked. It looks like Krill doesn't do it, that's why Validator 3 doesn't always pick up the latest manifest and can use stale data. According to the RFC serial numbers don't have to increase, they just need to be different (the Krill implementation follows that RFC), so it was a bug on our side that is now fixed. 


To be precise: the 'manifestNumber' (section 4.2.1 of RFC 6486) increases with '1' every new publication, but the embedded EE certificate's Serial Number (4.2.2.2 of RFC5280) is a random number. I remember reading advice that this certificate Serial Number should not be predictable, but I can't find where right now.

Thanks,

Tim