Re: [Sidrops] mft/ee validity time window alignment issue - Re: I-D Action: draft-ietf-sidrops-6486bis-05.txt

[Stephen Kent <[e-mail]>]

Tim,
> ...
>> I propose this text for Section 4.2.1 second paragraph:
>>
>> """
>>    When signing a manifest, it is RECOMMENDED to use an "one-time-use"
>>    keypair. The EE certificate SHOULD have a validity period that
>>    coincides with the interval from thisUpdate to nextUpdate in the
>>    manifest, to prevent needless growth of the CA's CRL.
>> """
>
> This text for 4.2.1 works for me. I think the SHOULD is appropriate because of existing deployment where this restriction was not present.

It doesn't work for me ;-).

No CA indicated that they generated multi-use EE certs for manifests, 
and all the RIR CAs confirmed that they employ single-use EE certs for 
manifests. This argues for a MUST, not a SHOULD.

> Furthermore, while shortening the lifetime will help to keep the CRLs a bit shorter (in case of Krill 1 previous MFT EE revocation entry instead of 10, bear in mind there might be other entries for ROAs, certs..), I think this gain is marginal. I do not see how the security aspects are changed here, it just saves a small number of cycles.
You said earlier that you have no data indicating how often a manifest 
is issued to accommodate a change in signed products, other than CRLs. 
Thus your comment seems to be based on a perception, but not 
substantiated by any data.
> Furthermore, I fail to see why a version increment of the manifest would be needed in this context. Before discussing the 'how' of such a transition I think the 'why' should be clear.

A version number change is always used whenever formats change, and 
generally used when processing is changed in a way that would impact 
interoperability, e.g., RPs would reject published, signed objects.

So, for example, if we require CAs to use one-time EE certs, no version 
number change is needed for manifests, because an RP was required to 
accept either one-time or multi-use EE certs in this context, and there 
was no requirement for the RP to try to check which type was employed.

If we were to require CAs to align the manifest EE cert validity 
interval with the manifest update interval, this too would not require a 
version number change, UNLESS we mandate RP checking of this alignment. 
If we say that a CA SHOULD align these dates, then we can't require RPs 
to check that, so, again, no need for a version number change.

Steve