Re: [Sidrops] 6486bis: referenced object validation

[Ties de Kock <[e-mail]>]

On 4 Dec 2020, at 12:17, Job Snijders <[e-mail]> wrote:
> 
> On Fri, Dec 04, 2020 at 11:57:33AM +0100, Ties de Kock wrote:
>>>> However, validating these requirements for just CMS objects (as per
>>>> -03, instead of for CAs as well as per -00) leaves open the situation
>>>> where only part of the objects for a CA apply. When the ROAs are
>>>> correct, but the sub-CA is not, this can cause outages.
>>>> 
>>>> I don't have a preference on which way to go, but I would propose that
>>>> we treat invalidation (time, c.f. because of semantic errors) for both
>>>> CA certificates and other objects similarly.
>>> 
>>> I am not sure I follow, can you construct an example data set where the
>>> 'situation left open' you describe appears?
>>> 
>> 
>> Thanks for asking for clarification. I'll try to explain the scenario:
>> 
>> CA certificate with <AS64496, 192.0.2.0/24>
>>  * Manifest, containing
>> 	  * ROA: AS0, 192.0.2.0/24
>> 	  * sub-CA, resources: <AS64496, 192.0.2.0/24>
>> 	  	* Manifest, containing:
>> 			  * ROA: <AS64496, 192.0.2.0/24>
>> 
>> We have "all or nothing" for ROAs. I argue that a similar situation is present
>> for sub-CAs if the sub-CA expires.
> 
> You list two manifests, which means that software should:
> 
> round 1: process Manifest 1 containing AS0.roa + sub-CA.cer + crl
>    check if as0.roa and sub-CA.cer + crl are present and if the hashes
>    match
> 
> round 2: process Manifest 2 containing AS64496.roa + crl
>    check if AS64496.roa + crl are present and if the hashes match
> 
> Now let's image sub-CA.cer is present and the hash match, but turns out
> to be expired, it just invalidates sub-CA.cer and thus the software
> would never even open manifest 2, because sub-CA.cer is expired.
> 
> If sub-CA.cer is expired the ROA for AS64496 indeed will 'disappear' (as
> if never existed), leaving just the AS0 ROA. This is as the CA intended.

Compare that to:

Valid CA certificate with <AS64496, 192.0.2.0/24>
 * Manifest, with valid EE certificate, containing
   * valid CRL
   * ROA: AS0, 192.0.2.0/24, EE cert with 2020-12-01 expiration
   * ROA: AS64496, 192.0.2.0/25, EE cert with 2021-01-01 expiration

This results in a failed fetch when validated today.

Under our interpretation of -00, this manifest would be rejected, since all
objects on a manifest need to be valid (present, hash match, correct, non-expired)
for a fetch to succeed.

I would argue that to be consistent, this should not result in failed fetch, the
expired ROA should not apply, because this is what the CA intended.

What do you think the outcome should be?

Kind regards,
Ties