Re: [lamps] Including 3GPP NF Type in HTTPS certificates

A few of us got together and put together a draft related to John's request:

	https://datatracker.ietf.org/doc/draft-housley-lamps-3g-nftypes/ <https://datatracker.ietf.org/doc/draft-housley-lamps-3g-nftypes/>

It is very straightforward.

I hope the LAMPS WG will consider adoption.  Of course, Tim will handle any consensus calls related to it.

Russ

> On Apr 27, 2022, at 10:20 AM, John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org> wrote:
> 
> Hi,
>  
> The signaling in 5G (Service Based Architecture) uses HTTP/2 over mutually authenticated TLS 1.3. 3GPP has specified a X.509 certificate profile in section 6.1.3c of TS 33.310. The profile states that the NF Type (e.g., "NRF", "5G_EIR", "UDM", etc.) should be included as a DNS-ID in client certificates. I don't think this is appropriate in general. It also violates RFC 5280 as several of the NF Types contain an underscore "_" character.
>  
> https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=2293 <https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=2293>
>  
> I think 3GPP needs to update their specification. What would be a recommended way to include the 3GPP NF Type strings in X.509 certificates?
>  
> - Should 3GPP/ETSI register a NF type type-id OID for use with otherName that takes a utf8String as value?
> - Should 3GPP/ETSI register a registeredID OID for each NF Type?
> - Any other recommended way to include the NF type in the 3GPP certificates?
>  
> Feedback would be very welcome.
>  
> Cheers,
> John
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org <mailto:Spasm@ietf.org>
> https://www.ietf.org/mailman/listinfo/spasm <https://www.ietf.org/mailman/listinfo/spasm>