Re: [Sidrops] 6486bis: referenced object validation

[Job Snijders <[e-mail]>]

On Fri, Dec 04, 2020 at 11:47:17AM +0100, Ties de Kock wrote:
> > On 4 Dec 2020, at 11:40, Job Snijders <[e-mail]> wrote:
> > On Fri, Dec 04, 2020 at 11:16:51AM +0100, Martin Hoffmann wrote:
> >> Under this approach, the manifest expresses which objects the CA
> >> intended to publish. If all the objects listed on the manifest are
> >> present with a matching hash, the publication point reflects the
> >> intent of the CA and can be processed. If it contains invalid objects,
> >> these can be discarded individually.
> > 
> > Indeed, I believe you've now captured the essence of why manifests
> > exists at all. This is what rpki-client & FORT seem to have implemented.
> > 
> > Other than the hashes matching & files being present, additional
> > conditions apply: the manifest & EE certificate need to be valid,
> > current, latest, correctly encoded, part of the cert chain, CRL present,
> > etc.
> 
> However, validating these requirements for just CMS objects (as per
> -03, instead of for CAs as well as per -00) leaves open the situation
> where only part of the objects for a CA apply. When the ROAs are
> correct, but the sub-CA is not, this can cause outages.
> 
> I don't have a preference on which way to go, but I would propose that
> we treat invalidation (time, c.f. because of semantic errors) for both
> CA certificates and other objects similarly.

I am not sure I follow, can you construct an example data set where the
'situation left open' you describe appears?

Kind regards,

Job