Re: [lamps] Call for adoption of draft-becker-guthrie-cert-binding-for-multi-auth-01

[Tomas Gustavsson <[e-mail]>]

Cool, RFC5697 looks basically identical to the relatedCerts extension.

I have never seen any asks for this RFC5697 either. It might be because the example use case, web site certificates, does not look like an example where this is ever (==before I retire) will be used. I am not aware of any discussions about a need for such an extension in CA/B Forum. There might have been before and dismissed? RFC5697 leaves the validation topic completely to the reader and for publicly trusted website certificates, every field must be validated to some level. Building out a validation infrastructure for this extension, across independently operated CAs, including something that works automatically as part of the ACME protocol, seems to me as a hefty task. Definitely costly both in man hours and technical implementation. The benefits of RFC5697 must outweigh the cost in such a scenario, which may be one reason why I have never heard of it. For private PKIs where certificates are issued from the same CA validation sounds much easier, but there must still be a benefit that outweighs the added complexity.

I haven't heard browsers discussing this RFC, but I'm not involved in their PQC transition strategies so...looking at current Web experiments hybrid TLS seems the be the current route of research.

RFC5697 suffers from the same open-endedness as relatedCerts, how to validate the MUST requirement of same usage? The example given in RFC5697 section 3 seems particularly hard. Between a web site and VPN Gateway, KeyUsage and extendedKeyUsage are probably the same, and they may even be issued from the same publicly trusted TLS CA as far as I know, so using the same policy OID. Section 3 btw is a strange mix of MUST and SHOULD imho, not sure what is must and should in that example?

Was RFC5697 developed with a real use case in mind? (I don't remember taking part, so the website example may have been a real discussion back then?)

Cheers,
Tomas

________________________________
From: Spasm <[e-mail]> on behalf of Kampanakis, Panos <kpanos=[e-mail]>
Sent: Tuesday, October 25, 2022 4:47 AM
To: Russ Housley <[e-mail]>
Cc: LAMPS <[e-mail]>
Subject: Re: [lamps] Call for adoption of draft-becker-guthrie-cert-binding-for-multi-auth-01

CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email [e-mail] with any questions.


Hi Russ,



Hmm, I was not aware of RFC5697. It certainly adds complexity for CAs imo. I doubt any CA supports this. But ok, I am not sure if and why complexity for the issuer was not considered for this one. Btw, would RFC5697 suffice to link the classical and the PQ identity cert instead?



For now we have an outstanding question which I think is important. If the Related Cert extension does not mean the issuer does some extra checks before issuing the related cert, it is not clear what value the extension adds. A simple relation between certs already exists. It is the identity in them. And these certs are expected to make it to the verifier together so it can check the common identiy.





From: Russ Housley <[e-mail]>
Sent: Monday, October 24, 2022 8:13 PM
To: Kampanakis, Panos <[e-mail]>
Cc: LAMPS <[e-mail]>
Subject: RE: [EXTERNAL][lamps] Call for adoption of draft-becker-guthrie-cert-binding-for-multi-auth-01



CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



Panos:



https://datatracker.ietf.org/doc/rfc5697/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Frfc5697%2F&data=05%7C01%7Ctomas.gustavsson%40keyfactor.com%7Cbbad321757fe40d7f46a08dab6333e5b%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C638022628498911915%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Rc5r7qErhmNXojG9r4Hokay2Kq4vtMJKDt58df1Oizw%3D&reserved=0>



I am not sure that anyone implements RFC 5697, but I do not recall anyone suggesting that a new CA paradigm would be needed to do so.



Russ





On Oct 22, 2022, at 10:21 PM, Kampanakis, Panos <kpanos=[e-mail]<mailto:kpanos=[e-mail]>> wrote:



I understand the draft. I had shared some technical concerns for issuers that would need to add the Related Cert Extension which had not been addressed.



But let’s say that the extension does not mean that the issuer has to do any additional checks which some are suggesting has pitfalls. Let’s say that as you are suggesting, the issuer just needs to check two signatures to confirm the requester has the private keys for both related public keys. Why do we need the extension anyway? The relation of the two certificates comes from the identity (CommonName or maybe some SANs) which should be the same.



Why not avoid the hassle of standardizing the extension in LAMPS? Entity X can get two certs issued independently. Then it sends them both along with two chains and two signatures in the TLS handshake. The verifier needs to verify both signatures and chains independentlyand confirm the identity in both certs (e.g. CN, SAN) match. In that case you only need to update TLS  in the TLS WG and IKEv2 in the IPSECME WG and you don’t need to update X.509.





From: Spasm <[e-mail]<mailto:[e-mail]>> On Behalf Of Michael Jenkins
Sent: Saturday, October 22, 2022 11:33 AM
To: Kampanakis, Panos <kpanos=[e-mail]<mailto:kpanos=[e-mail]>>
Cc: Russ Housley <[e-mail]<mailto:[e-mail]>>; LAMPS <[e-mail]<mailto:[e-mail]>>
Subject: RE: [EXTERNAL][lamps] Call for adoption of draft-becker-guthrie-cert-binding-for-multi-auth-01



CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



If there are no technical showstoppers, I don't understand the objection.



Mike and John have a well defined scheme, for which they have prototypes and apparent customers. So that will exist.



On the other hand, singleton certificates will also exist. The US DoD will have oceans of them. So will companies with limited resources that will balk at the idea of being sold something they already have bolted to something there's apparently lack of confidence in. Singleton certificates will exist irrespective of our draft; we are not creating a necessary precondition.



All our draft does is provide an indication of assurance that one certificate is related to another. The specific relation is that the entity controlling the private key in one certificate also controls the private key in another. Those certificates exist separately. The relative context of those certificates (validity period, etc) would have to be part of a transition plan.



If you don't like the mechanism, if you don't understand it, if it doesn't fit with your transition scheme, you don't have to implement it, or buy it. If you encounter it, you can ignore it. On the other hand, if it fits with your transition scheme, it can add some assurance. This is explained in the overview of the draft.



Mike Jenkins

NSA-CCSS



On Wed, Oct 19, 2022 at 11:03 PM Kampanakis, Panos <kpanos=[e-mail]<mailto:[e-mail]>> wrote:

Hey Russ,
I have not been convinced either. My details for the operational challenges this draft would bring still remain. Willing to hear more counter-arguments from Rebecca and Mike to address the concerns or discuss it further.


-----Original Message-----
From: Spasm <[e-mail]<mailto:[e-mail]>> On Behalf Of Russ Housley
Sent: Wednesday, October 19, 2022 3:47 PM
To: LAMPS <[e-mail]<mailto:[e-mail]>>
Subject: RE: [EXTERNAL][lamps] Call for adoption of draft-becker-guthrie-cert-binding-for-multi-auth-01

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



Several people spoke for adoption, and several people spoke against adoption.  The I-D authors responded with a response to the concerns that were raise, and no one has responded to the authors.  I would like to hear from the people that spoke against adoption.  Are you swayed by the discussion that has taken place?

Russ


> On Sep 15, 2022, at 11:44 AM, Russ Housley <[e-mail]<mailto:[e-mail]>> wrote:
>
> There has been some discussion of https://datatracker.ietf.org/doc/draft-becker-guthrie-cert-binding-for-multi-auth/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-becker-guthrie-cert-binding-for-multi-auth%2F&data=05%7C01%7Ctomas.gustavsson%40keyfactor.com%7Cbbad321757fe40d7f46a08dab6333e5b%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C638022628498911915%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ivR8OgmC5PUQlzi7Os4bipoKMhvu%2FDFQ3mXJ3xCA7Qk%3D&reserved=0>.  During the discussion at IETF 114, we agree to have a call for adoption of this document.
>
> Should the LAMPS WG adopt “Related Certificates for Use in Multiple Authentications within a Protocol” indraft-becker-guthrie-cert-binding-for-multi-auth-01?
>
> Please reply to this message by Friday, 30 September 2022 to voice your support or opposition to adoption.
>
> On behalf of the LAMPS WG Chairs,
> Russ
>

_______________________________________________
Spasm mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/spasm<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fspasm&data=05%7C01%7Ctomas.gustavsson%40keyfactor.com%7Cbbad321757fe40d7f46a08dab6333e5b%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C638022628498911915%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=r5TEHStHBLO%2BENAX8Rg4Ys7SAckQKxYZmifRrTMQZlU%3D&reserved=0>
_______________________________________________
Spasm mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/spasm<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fspasm&data=05%7C01%7Ctomas.gustavsson%40keyfactor.com%7Cbbad321757fe40d7f46a08dab6333e5b%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C638022628498911915%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=r5TEHStHBLO%2BENAX8Rg4Ys7SAckQKxYZmifRrTMQZlU%3D&reserved=0>


--

Mike Jenkins

[e-mail]<mailto:[e-mail]>

443-598-7837

_______________________________________________
Spasm mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/spasm<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fspasm&data=05%7C01%7Ctomas.gustavsson%40keyfactor.com%7Cbbad321757fe40d7f46a08dab6333e5b%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C638022628498911915%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=r5TEHStHBLO%2BENAX8Rg4Ys7SAckQKxYZmifRrTMQZlU%3D&reserved=0>