Re: [Sidrops] what to do when the CRL is hosed?

[Job Snijders <[e-mail]>]

Thanks claudio

(forwarding this back to the list, seems claudio's mail for some reason
didn't show up in the archives)

On Mon, Feb 24, 2020 at 04:44:49PM +0100, Claudio Jeker wrote:
> On Mon, Feb 24, 2020 at 03:15:32PM +0000, Job Snijders wrote:
> > Hi group,
> > 
> > It seems we need guidance and consensus on what to do when the CRL is
> > hosed in some way or shape. We have two implementation discrepancies pop
> > up recently:
> > 
> > https://github.com/NLnetLabs/routinator/issues/274
> > RIPE NCC's top level CRL expired this weekend
> > (https://www.ripe.net/support/service-announcements/rpki-infrastructure-issues) 
> > 
> > https://lists.nlnetlabs.nl/pipermail/rpki/2019-December/000109.html
> > 
> > OpenBSD's rpki-client uses the x509 certificate validation functions
> > that come from libressl, which doesn't have a button to turn off only CRL
> > timestamp verification. I was told that some nasty code would be
> > required to work around that, so one can argue that rolling things by
> > hand in X509 handling rarely is a great idea.
> > 
> > One could also argue that a softer landing is needed, unavailability of
> > the CRL should mean that only the CRL itself is not available and
> > proceed to validate the tree without the revocation list. I can see how
> > that is helpful in some circumstances.
> > 
> > So, what to do? Whatever it is, ideally all validators follow a similar
> > process.
> 
> The process at the moment is clear: the embedded X509 certificates
> reference a CRL and so the validator has to check if that certificate was
> revoked via the CRL. This verification needs to follow the procedure of
> X509 certificate validation (which includes timestamp verification).
> If you want a soft landing then please just remove the CRL from the
> system.
> 
> In general it is important that the timestamps in the various RPKI objects
> are checked during verification. Not doing so will put you at risk for
> replay attacks.
> 
> -- 
> :wq Claudio