Re: [Sidrops] I-D Action: draft-ietf-sidrops-signed-tal-07.txt

[Ben Maddison <[e-mail]>]

Hi Tim,

On 07/29, Tim Bruijnzeels wrote:
> Hi all,
> 
> > On 29 Jul 2021, at 00:44, Russ Housley <[e-mail]> wrote:
> > 
> > 
> > 
> >> On 29 Jul 2021, at 7:42 am, Ben Maddison <benm=[e-mail]> wrote:
> >> 
> >> Hi all,
> >> 
> >> Re-iterating the comment that I made during the meeting, as requested...
> >> 
> >> Including the "revoked" flag *only* in the TAK object published by the
> >> "revoked" TA effectively gives anyone with access to that TA's private
> >> the key the ability to resurrect it and/or point RPs to a malicious
> >> successor TA.
> >> 
> >> Given that a prime motivation for a performing a key roll is a suspected
> >> key compromise, it is troubling that the key roll can be reversed by the
> >> compromised key!
> >> 
> >> Perhaps I am overlooking something?
> > 
> > I think we need to consider graceful transition from one trust anchor key to another separately from recovery from key compromise.
> 
> Indeed recovering from a key compromise (theft) is a different ball game altogether.
> 
> The primary motivation for starting this (when I was still at RIPE NCC and operating a TA) was to deal with the migration from one HSM vendor to another. So the intent is not to be able to deal with a *compromised* TA key (which hopefully would have been kept in an HSM) - but to allow that key A in HSM A can sign the transition to key B in HSM B and then be destroyed.
> 
Ack.
Re-reading with the benefit of your's and George's comments, the procedure
makes far more sense to me.

I think this needs spelling out far more explicitly throughout the
draft. It should not take email correspondence with the authors to
discern the intended use-case.

On reflection, I think that actually recommending that this
mechanism *not* be used in response to (suspected) key theft is
appropriate: better the TA goes away altogether for some period of time,
than risk an undetectable takeover.

Related to this, I also think "revoked" is a poor choice of word to
describe the status of the "old" TA.
For me, revoked means "no longer trustworthy", whereas in this procedure
the trust in the old key must be maintained for (at least) the purpose
of validating the TAK/MFT/CRL.
Perhaps "decommissioned" is a better choice, indicating that it will no
longer be used to issue new objects, and should be used only build a
chain to a successor.

Cheers,

Ben