Subject: Last Call Issue: CRL Check on DCA Certs

From: "James Kempf" <[email-masked]>
Date: Sat, 31 Jan 2004 02:40:18 -0800

The last paragraph in Section 6.1.1 says this about checking certificates
received in a DCA for validity:

    When processing the three certificates, the usual RFC 3280
    certificate path validation is performed, for instance by
    checking for revoked certificates.

As a practical matter, the node will typically be performing the certificate
check in response to a router advertisement containing a signature for which
the host does not have the certificate. So the host will not at that time
have a connection to the Internet by which it can perform a CRL check.
Therefore, the host will be unable to perform a CRL check, exposing it to
the possibility that the router may have been compromised and its
certificate revoked.

What to do?

I'd like to suggest the following text:

    When procesing the three certificates, the usual RFC 3280
    certificate path validation is performed. Note, however, that
    at the time a node is checking certificates received in a
    DCA from a router, it typically does not have a connection
    to the Internet yet, and so it is not possible to perform an
    on-line Certificate Revocation List (CRL) check if such a check
    is necessary. Until such a check is performed, acceptance
   of the certificate MUST be considered provisional, and the
    node MUST perform a check as soon as it has established
    a connection with the Internet through the router. If the router
    has been compromised, it could interfere with the CRL check.
    Should performance of the CRL check be disrupted or should
    the check fail, the node SHOULD immediately stop using the
    router as a default and use another router on the link instead.

Comments?

                jak

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

This communication is confidential and intended solely for the addressee(s). Any unauthorized review, use, disclosure or distribution is prohibited. If you believe this message has been sent to you in error, please notify the sender by replying to this transmission and delete the message without disclosing it. Thank you.

E-mail including attachments is susceptible to data corruption, interruption, unauthorized amendment, tampering and viruses, and we only send and receive e-mails on the basis that we are not liable for any such corruption, interception, amendment, tampering or viruses or any consequences thereof.

---

From: Pekka Nikander <[email-masked]>
Date: Thu, 5 Feb 2004 16:58:00 +0200

James,

>     router as a default and use another router on the link instead.

Looks good, other than I would write "the node SHOULD perform a check
as soon as it has established...".  In many cases hosts do not
perform CRL checks today at all, and if they wouldn't do that
anyway, the MUST will become empty.

--Pekka

---

From: "James Kempf" <[email-masked]>
Date: Thu, 5 Feb 2004 09:18:26 -0800

Sounds fine.

            jak

---

From: "James Kempf" <[email-masked]>
Date: Thu, 5 Feb 2004 09:18:26 -0800

Sounds fine.

            jak

---

From: "James Kempf" <[email-masked]>
Date: Thu, 5 Feb 2004 09:18:26 -0800

Sounds fine.

            jak