Subject: [Ipsec] certificate encoding type in IKEv2

From: Jyothi <[email-masked]>
Date: Wed, 07 Jul 2004 11:32:01 +0530

Hi all,

In draft-ietf-ipsec-ikev2-14.txt, section 3.6 following certificate 
encoding types are defined:

            PKCS #7 wrapped X.509 certificate    1
            PGP Certificate                      2
            DNS Signed Key                       3
            X.509 Certificate - Signature        4
            Kerberos Token                       6
            Certificate Revocation List (CRL)    7
            Authority Revocation List (ARL)      8
            SPKI Certificate                     9
            X.509 Certificate - Attribute       10
            Raw RSA Key                         11
            Hash and URL of X.509 certificate   12
            Hash and URL of X.509 bundle        13

I would like to what is MUST in above defined types.
In IKEv2, it is X.509 certificate-signature.

I would also like to know what is cert bundle which is defined in page 58.
Is it related to certificate chain??

How can we use certificate chains in IKEv2??

Many thanks in advance,
Jyothi
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: [email-masked]
Date: Thu, 8 Jul 2004 15:26:34 +0300

Hi,

IKEv2 Section 3.6 says that 

   "Implementations MUST be capable of being configured to send
   and accept up to four X.509 certificates in support of
   authentication.  Implementations SHOULD be capable of being
   configured to send and accept Raw RSA keys and the first two
   Hash and URL formats."

This MUST requirement seems to refer to the "X.509 Certificate - 
Signature" type; so you answered your own question :-).

The possible ambiguity concerning "PKCS #7 wrapped X.509
certificate" type is resolved by draft-ietf-pki4ipsec-ikecert-
profile-00: it says that "Implementations SHOULD NOT generate 
CERTs that contain this type".

If you have a certificate chain, then you use several
CERT payloads (note that they do not have to be in order,
except the first one must correspond to the key used
to sign the AUTH payload). Certificate bundle is just a set 
of certificates, not necessarily in any special order. I guess
usually a bundle will contain at least one chain.

Best regards,
Pasi

-----Original Message-----
From: [email-masked] On Behalf Of [email-masked]
Sent: Wednesday, July 07, 2004 9:02 AM
To: [email-masked]
Subject: [Ipsec] certificate encoding type in IKEv2

Hi all,

I would also like to know what is cert bundle which is defined in 
page 58. Is it related to certificate chain??

Many thanks in advance,
Jyothi

---

From: [email-masked]
Date: Fri, 9 Jul 2004 08:28:00 +0300

Hi,

The typical purpose would be to provide a chain from the 
recipient's trust anchor (root CA) to the end entity 
certificate (corresponding to the key that was used to 
generate the AUTH payload).

So in this case, the other certificates would be 
intermediate CA certificates. Other, less common,
purposes could include e.g. using X.509 attribute
certificates to provide some kind of authorization
information.

Best regards,
Pasi

> From: [email-masked] n Behalf Of [email-masked]
> Sent: Friday, July 09, 2004 5:48 AM
> To: Eronen Pasi; [email-masked]; [email-masked]
> Subject: RE: [Ipsec] certificate encoding type in IKEv2
> 
> Hi
> I agree with you.  I have some doubts regarding the use of 
> multiple certificate payloads.  On one hand, it is clear that 
> the first certificate must correspond to the key used to sign 
> the Auth payload.
> 
> In this case, what would be the purpose of the other 
> certificates?  Is there any scenario where multiple certificates 
> are used to verify the authentication?
> 
> Regards
> Suram