IETF Logo Mail Archive

[lamps] Including 3GPP NF Type in HTTPS certificates

John Mattsson <john.mattsson@ericsson.com> Wed, 27 April 2022 14:20 UTC

Return-Path: <john.mattsson@ericsson.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53ECFC2AC83B for <spasm@ietfa.amsl.com>; Wed, 27 Apr 2022 07:20:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.674
X-Spam-Level:
X-Spam-Status: No, score=-7.674 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.575, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FqQlhc22zk_o for <spasm@ietfa.amsl.com>; Wed, 27 Apr 2022 07:20:45 -0700 (PDT)
Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-vi1eur04on0620.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe0e::620]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13A7EC2AC833 for <spasm@ietf.org>; Wed, 27 Apr 2022 07:20:44 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=lIx3pK1fUx9yxelilrLSrhlIW1Rn+ySp7OLIZqjVZcXzWUBeUip9I9orpb9SYqGjPmt9YVH8lgN/c2+Bc4/RyBjv928aOiH5PtBPKpxiDY2ChaYiHYsuYDgX5LY+z5oUrD9+DhEVXwUP41VmbsbU9R7pDulmlqdSGuNEp/Q+1L8o70FCmxS5xUIha8TojDJqlhtpExCslmCzDK7POAwYsvgKjZItmMgD/kBNOchO4PuTT5nZMenV2fGFL/2/KlmjLTwiSxNnTXSk4+I8R5+YxFOzPwSHhHmbbbKQVw1KVUpUFcyiJxh1Lp7ccC5FC+DHaXS6djmjHDRnxaqVnGRK3Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=U1Vy4vpCeTuuORZ5Px7tcn6a0xUzR33B5WjVUureHko=; b=ROv/72AJWAxCbdPVpsfJVj1R57HKffptxaj8ZzS+XjuXwSFA/I8ZMOg0RVeGqJB61glDRaQurkLHhIMMsfFqP384RlGG94OAj5+zbPWqjRgb5TAsEzfg5mE0t3gEbobM5GsqHch2OaHViso/vWE9F7brCUUdUYpsXALMeLrrESNCC46mY7ZJzz5AxIPiaAGDxuEwErrd1Euh08DwSVPYayjzYhcxUcsLlEbAH76tmO8NKcCp20AUCe5be4iTWyyEkxGbK1BnUqlIarEX+wXqW2n70DOUxlgLBIL5A9RLTHiAy5wtB8326nRjLzY5ejbIphE/hu3QRojm0fjEPyDIww==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=U1Vy4vpCeTuuORZ5Px7tcn6a0xUzR33B5WjVUureHko=; b=dmKjK3k0ybbJ2d++gUPBPygLoCZTK2QAIuz7Mx3kfbcNJ3jx5JP4D10TRNN4eoI7iuujjjMl9M+aleEP0sxPYhVPFCbjkia9bjf3NQx0jLZf8oos7RXOnTAnW4c05+qZbrYgfL16Uti3lVSelOBBDlJ8N/o3/QsMvOl4UC3A2wU=
Received: from HE1PR0701MB3050.eurprd07.prod.outlook.com (2603:10a6:3:4b::8) by AM0PR07MB6323.eurprd07.prod.outlook.com (2603:10a6:20b:156::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5206.6; Wed, 27 Apr 2022 14:20:38 +0000
Received: from HE1PR0701MB3050.eurprd07.prod.outlook.com ([fe80::4497:cc6f:ea36:f029]) by HE1PR0701MB3050.eurprd07.prod.outlook.com ([fe80::4497:cc6f:ea36:f029%12]) with mapi id 15.20.5206.013; Wed, 27 Apr 2022 14:20:38 +0000
From: John Mattsson <john.mattsson@ericsson.com>
To: IETF LAMPS WG <spasm@ietf.org>
Thread-Topic: Including 3GPP NF Type in HTTPS certificates
Thread-Index: AQHYWkD6uYle3rpdB0KY7JUJy0KxLA==
Date: Wed, 27 Apr 2022 14:20:38 +0000
Message-ID: <HE1PR0701MB30509AD4C4E6A9130FF18B6689FA9@HE1PR0701MB3050.eurprd07.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=ericsson.com;
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 032b77a8-4314-4a35-47d9-08da28591a1f
x-ms-traffictypediagnostic: AM0PR07MB6323:EE_
x-microsoft-antispam-prvs: <AM0PR07MB6323705CF590399F840CBF2B89FA9@AM0PR07MB6323.eurprd07.prod.outlook.com>
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: TRa+9x8WRGeVMAYTBi212gz/zVkiB8Qwz6JJQL4c2JqoU0PzG/zjUHyHJyfR7kQa5zGCyxIHPQS8itRw8lc8BJuqWDz1xkfgjkJJeRZxdiWXg2ONJCwGfnpJjcqcUgAYKnFtWPAG4+LRxWz0WF7q7+dgrtUMp0h0xqPc/i7cbqj9Bk8YpE6uOnlJyb616mCUU5XiCry4+QRwkAD+26jGMpD1RauR9esGJ0cGpVwGiX1S7xZfyJy7kl29cmtdArnzqfdaD/4UcVILPTC5HbuWbAI9P5b0ceKp+1XzyA++JkSWrMjaJ8SM7gVNs6jFMxSAOyZYpH0EqxKO4xB7PdWNSRyoy8mtgJFF9R0/JaRlUTDZojuilZ3aa9jgKYKBA8Y/Fu6KYoiE/mPNamU8OyqI6itfjfwTT5x0qYV86m4Cz+hL/M9owR8weoqUZlIQralS06c4GOvddy4+oA1hCAIIz8oIwcHI+iQi2b8xccyOj1QiCchRBoqpWpD/nN18FylIOCzhM7ftcNSmfPwnwszaDAVq9mMLuCQFeEZZr/AaLUeW4QR8mYpU4DVr/dsTZl5uM8kyNg0A8YQlDPopg9tR24/cp3zhtuo+2R84iUQ+5d+p5K6afwMYvPgH5lT6mmNE7Vx1f+UEKKndxcxjuYHEYuwa/xnuZxIUYdT/a1azfN18muvjwz7cQ7pOMJ3MCU6m0mfgDCUKloyXkcA9sEpLqQw1F3XvbHExqWlxvSBtHUJ9wp4J1kv9kQCxCDxLc2DHijczyOn6PRK9skwFiniBTRGgjaVvKc6RunQFlL4IgLE=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:HE1PR0701MB3050.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230001)(4636009)(366004)(38070700005)(38100700002)(6916009)(8676002)(316002)(508600001)(44832011)(5660300002)(4744005)(55016003)(33656002)(82960400001)(2906002)(76116006)(26005)(86362001)(66556008)(66946007)(91956017)(186003)(8936002)(966005)(9686003)(66476007)(83380400001)(64756008)(66446008)(71200400001)(122000001)(7696005)(6506007)(52536014); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: lWhGbdG1gIjDu/cq9abt2WozOr6LERFuFkexR/BxovcaD03Zc5C55+b34JMwkYK6GPGvG+uUw/gzLaOz6aJ3Ktg69D/OxVEgUm1MeiFAghZwreC++rm39c5e10Dm/CVrqmCFQpYDD4Pk5PMZxmb5EWQnN11AyIgZXPJ8VWGrqw7zynRE0zkaCtw5yUoyKBdjlWheaSOB8HkByBOsigpkrSqTCJOyx0T69DLW1v1VA7WHX9KFqVIvhU4dWi5tB3VqQLHtBu4+s7LUHcHu8EZRzfEO6IpHOiLY3EN03mkuNIsbLd/PS/SAh0AXcwgRXebvVFJksf/BnxvuGyFtpRLWpEErSxZvlq9A2TXXCFp9CE4Rkq1MGmTtNqopydlX77iLGg0zLEQ5spJCdloWhWmlQpTIgW3/qaZyNlmz+2tKLkMmrjvTpxYZFBZFyY8lE20w2V28Lmx6aM6wN3577phFfdvhBsJYcKhM4xIVvBEdR+iPRRWnV+f/EgegwFCfbuFPQJi3FL5hE4JSNS8LTHrPrRr+ALHQIJu+roZq/zVp8xfvn2IF7VifPL9IqUcsAPrSI3wmteGYZEUwwrHDBAoshEKyQ5tZz3/BQpOjbz3JP+yn4hq3VUgPCr7+j22C86YZqb5mUM+ofG+7e22a2xYK+afkqbJg8Sv843DwKyjsJXaL3HBgV6MN6SdxEundA02HLjoT/Gti5rOTwDxU1D/pGPOfy1FVklzYsiIWFgJeMAP6kn1YWpg7MfCOtWLJjrLNUSw2v3++7XJjM4Jzw87nHCOBEJkqsLofxHijMVLDA2VLMI8NTDf8eAyR7laMlwJ8lCU1qmi/XSb8jfT2UpOO6vICBh5n6iCMRfdqFUFRlRvS0WXz5PezePZ8Cn4IB9elQEMZAmDnLv13hzPYcl1lJUfgCCEfIXj68KFihsNafZ38WxzuvlMzqy74QNABSXrnmVqiC5qsgkSQE/gT78YrjrDhNKzPzJWMbzvgWHNtnGhQWBSZO90HLd/DmbqA+IMemvYVxQD1t1JwWPm9cfFYXhgMFUj6/1Ieh3bziuhD1OyOy+cnoez/fwpc8smuiD8jcVryhca2oedOX+vfImR/1cFJha38/TAOuFNGau1zlLgN8J1xPq7oYnJHEgXHA3EfRyHrUvFzaDXeYzRV+XqGZfu1AhPGjZkxBcbRXoS+F7XUZ0OSYh3aHhwMhDzOiL0x2V62aYSj4HzdR9X+Lu2aLTTu7/3mqM+HpevLL1dgJXv/BdmQVoqUaTaSTW3yhsXs27pR7Fn45Cgel2Ptc9N0Y2jnzM8pHxO549u++gHuyhl8cRRWb4AdEOCCrjlvAG9QDgKHSPULbv6LDVra8LaL/Ru/3BoyKwnilxZxyGl9ZLwEE7oXBQnN/QPPHescBPh/prd/0Q426EFwNFYlUasjXy0DEhXe9lSRg0rz3dOvQ3xeDdw53U9Xybg8Ccs9+Fgt5w//ANBaLluSJl0t2r3Xt4pjx1SiTxYpUFVJ22CmrOoNR4mA/cW5zMNpywadJ63PeP0P9rvK2Y5e6G3q1LD6f3LeMKVDg/YW0DGTzjfRGFH23pIcTq+Cdh+ViFriNPlvdKq534Lwzz/LOkXXpL+x75TZ6pBVvcksT6CWx/3dbU/oN70HoJ6vH/JxrHVjjkd5WWZj8qRJdg7slw4nUW10FRo2dRkudHYgosvSPmx/cqX6AVcC0ZSYJJV1crFK9DelmQAGzGKWnzobxvIxKJDEmsg9Khu+i4y8IeGUoZgU4ukdJuX7ttGPoAblmUvWxUUU
Content-Type: multipart/alternative; boundary="_000_HE1PR0701MB30509AD4C4E6A9130FF18B6689FA9HE1PR0701MB3050_"
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: HE1PR0701MB3050.eurprd07.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 032b77a8-4314-4a35-47d9-08da28591a1f
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Apr 2022 14:20:38.1179 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: aGOEHtdKKc0uVKhS0KaxDnIAXZ/Y6QAYl2pj6ZAIJyV7dEshtjVF0HLlyaii9AVtXbmPeXf/C4ObL+xVqP49snmqKAdRpPSsBFgpeAcl/+o=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR07MB6323
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/VGJovvuha2lgggmFVIdh_-ImJNE>
Subject: [lamps] Including 3GPP NF Type in HTTPS certificates
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Apr 2022 14:20:49 -0000

Hi,

The signaling in 5G (Service Based Architecture) uses HTTP/2 over mutually authenticated TLS 1.3. 3GPP has specified a X.509 certificate profile in section 6.1.3c of TS 33.310. The profile states that the NF Type (e.g., "NRF", "5G_EIR", "UDM", etc.) should be included as a DNS-ID in client certificates. I don't think this is appropriate in general. It also violates RFC 5280 as several of the NF Types contain an underscore "_" character.

https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=2293

I think 3GPP needs to update their specification. What would be a recommended way to include the 3GPP NF Type strings in X.509 certificates?

- Should 3GPP/ETSI register a NF type type-id OID for use with otherName that takes a utf8String as value?
- Should 3GPP/ETSI register a registeredID OID for each NF Type?
- Any other recommended way to include the NF type in the 3GPP certificates?

Feedback would be very welcome.

Cheers,
John

v2.23.0 | Report a Bug | By Email