[Sidrops] current state of TA certificate issuances & validity periods

[Job Snijders <[e-mail]>]

Dear group,

I'd like to share more information on the relevancy of
https://datatracker.ietf.org/doc/draft-spaghetti-sidrops-rpki-ta-tiebreaker/
in context of old but still valid TA certificates.

I've done some spelunking and discovered that in the past (at least) two
TA certificates have been issued which contain constraining INRs, which
by now are woefully outdated. However, these TA certs are valid for at
least another year or two:

  Certificate issuer:       /CN=arin-rpki-ta
  Certificate serial:       010D0C9F4328576D51CC73C042CFC15024AF3A1B
  Hash identifier:          x0GxHqdGhsdJnlXnzpu2CSPL9XwYPowW/ECKqzZysBI=
  Manifest:                 rsync://rpki.arin.net/repository/arin-rpki-ta/arin-rpki-ta.mft
  caRepository:             rsync://rpki.arin.net/repository/arin-rpki-ta/
  Certificate not before:   Thu 01 Oct 2015 18:34:34 +0000
  Certificate not after:    Wed 01 Oct 2025 18:34:34 +0000
  Subordinate resources:    AS: 1 -- 6
                            AS: 8 -- 27
                            AS: 29 -- 136
                            AS: 138 -- 172
                            ...
  
  Certificate issuer:       /CN=AfriNIC-Root-Certificate
  Certificate serial:       D462C96A060634CE
  Hash identifier:          6oniYNeHhwxwMOqOCY8sxpRyIf9JKQum37pe6y2Sd18=
  Manifest:                 rsync://rpki.afrinic.net/repository/04E8B0D80F4D11E0B657D8931367AE7D/62gPOPXWxxu0sQa4vQZYUBLaMbY.mft
  caRepository:             rsync://rpki.afrinic.net/repository/04E8B0D80F4D11E0B657D8931367AE7D/
  Certificate not before:   Thu 22 Dec 2016 11:13:39 +0000
  Certificate not after:    Sun 20 Dec 2026 11:13:39 +0000
  Subordinate resources:    AS: 1228 -- 1232
                            AS: 2018
                            AS: 2561
                            ...

If copies of the above two certificates somehow are brought back into
circulation, RPs (without the ta-tiebreaker mechanism or without a
cached copy) are likely to end up rejecting 100% of subordinate products
(in the case of AfriNIC), or ~ 50% (in the case of ARIN). The difference
in impact between the two is be explained through ARIN's use of
'inherit' elements in various top-level certs.

RISK ASSESSMENT OF REPLAYS
==========================

In this working group the phrase 'on-path attacker' is a nice shortcut
to reference a fairly elaborate concept, but I don't think actual
adverserial on-path attacks are the highest risk that needs addressing.
A lot of RPs nowadays use TLS verification on the HTTPS channel when
fetching TA certs which helps increase confidence in the download.

I deem a more probable risk that TA operators accidentally place an
older issuance on the URI's referenced from the TAL file. I suspect
there is a number of manually executed steps in the TA resigning
ceremonies, so to me it isn't beyond imagination that at some point in
the future the wrong files are copied to the online location.

Another probable risk is when CDNs are in use and one of the CDN's
caching nodes for some reason is out-of-sync with the origin, serving an
older version of the TA certificate.

>From the RP perspective, the latter two cases are indistinguishable from
an actual on-path attacker.

THE CASE FOR SHORTER VALIDITY PERIODS
=====================================

The two issuances of TA certificates mentioned before would obviously no
longer pose a risk had their validity period expired by now.

TA operators require agility, specifically for two cases: updating the
subjectInformationAccess extension and updating the INRs in the RFC 3779
extensions. TA operators might think "we will NEVER change the SIA and
ALWAYS stick to 0.0.0.0/0 + ::/0 as INRs!", then again Charles Dickens
warned us "Never say never" :-)

It probably is reasonable to confidently state "in the coming 12 months
we do not anticipate to change the SIA or INRs", but confidence probably
start waivering when imagining the coming 5, 10, or even 100 years.

Now that there is a formal description in the form of
draft-spaghetti-sidrops-rpki-ta-tiebreaker to favor shorter validity
periods, I think there now is a (small) incentive for TA operators to
- going forward - issue TA certs with shorter validity periods.

It seems beneficial for both TA operators and RP instances for older
issuances with (now) outdated SIA or INR information to expire in
accordance with the length of internal planning cycles related to
possible future SIA or INR changes.

CURRENT VALIDITY WINDOWS OF TA CERTS
====================================

AfriNIC: Mon 30 Mar 2020 09:58:36 - Thu 28 Mar 2030 09:58:36
APNIC:   Wed 01 Nov 2023 23:48:07 - Mon 30 Oct 2028 23:48:07
ARIN:    Tue 30 Jan 2024 16:17:49 - Mon 04 May 2026 15:17:49
LACNIC:  Tue 05 Mar 2024 14:14:56 - Sun 05 Mar 2124 14:19:56
RIPENCC: Tue 28 Nov 2017 14:39:55 - Sun 28 Nov 2117 14:39:55

ARIN's validity period clocking in at 2 years is the shortest, followed
by APNIC (5 years), AfriNIC (10 years), and then LACNIC & RIPE NCC both
at 100 years. In this context, I personally favor ARIN's approach.

Kind regards,

Job