Subject: [sidr] FW: New Version Notification for draft-newton-sidr-policy-qualifiers-00.txt

From: Andy Newton <[email-masked]>
Date: Wed, 5 Dec 2012 16:55:17 +0000

On 12/5/12 11:53 AM, "[email-masked]" <[email-masked]>
wrote:

>
>A new version of I-D, draft-newton-sidr-policy-qualifiers-00.txt
>has been successfully submitted by Andrew Lee Newton and posted to the
>IETF repository.
>
>Filename:	 draft-newton-sidr-policy-qualifiers
>Revision:	 00
>Title:		 Policy Qualifiers in RPKI Certificates
>Creation date:	 2012-12-05
>WG ID:		 Individual Submission
>Number of pages: 7
>URL:             
>http://www.ietf.org/internet-drafts/draft-newton-sidr-policy-qualifiers-00
>.txt
>Status:          
>http://datatracker.ietf.org/doc/draft-newton-sidr-policy-qualifiers
>Htmlized:        
>http://tools.ietf.org/html/draft-newton-sidr-policy-qualifiers-00
>
>
>Abstract:
>   This document updates RFC 6487 by clarifying the inclusion of policy
>   qualifiers in the certificate policies extension of RPKI resource
>   certificates.
>
>                  
>        
>
>
>The IETF Secretariat
>
>

---

From: Sean Turner <[email-masked]>
Date: Wed, 05 Dec 2012 16:30:17 -0500

Andy,

A couple of comments:

1) I'm hoping to constrain the type and number of qualifiers that can be 
included.

5280 defines two types: cps (for certificate practice statements) and 
unotice (to display info to relying parties when the certificate is 
used).  I'm hoping you just want the cps choice, which is just a URI. 
And, if it's just the CPS then there's only one CPS under which a 
certificate is issued - right?  How about:

OLD:

  This document updates [RFC6487], Section 4.8.9, to explicitly allow
  optional PolicyQualifierInfo objects in the PolicyInformation
  specified by [RFC6487].

NEW:

  This document updates [RFC6487], Section 4.8.9, as follows:

  OLD:

    This extension MUST be present and MUST be marked critical.  It
    MUST include exactly one policy, as specified in the RPKI CP
    [RFC6484].

   NEW:

    This extension MUST be present and MUST be marked critical.  It
    MUST include exactly one policy, as specified in the RPKI CP
    [RFC6484].  Exactly one policy qualifier MAY be included.  If a
    policy qualifier is included, the policyQualifierId MUST be the
    CPS pointer qualifier type (id-qt-cps).

I think it's clear the value is the cPSuri choice, do you think anybody 
else would pick userNotice?

3) Two process points:

3.1) Need an IANA considerations section:

IANA Considerations

None.

3.2) Need a security considerations section.  It would also be good to 
say why it's not a security issue to add the URI, but you'll need to 
confirm my assumption that relying parties aren't actually going to 
chase the URI.  Alternatively, text could be added to s7.1.1 of RFC 6487 
to say "don't process the URI", but I think putting it in the security 
considerations is probably less painful.  Suggested text:

Security Considerations

The Security Considerations of [RFC6487] apply to this document.

This document updates the RPKI certificate profile to specify that the 
certificate policies extension can include a policy qualifier, which is 
a URI.  Checking of the URI might allow denial-of-service (DoS) attacks, 
where the target host may be subjected to bogus work resolving the URI. 
  However, this specification, like [RFC5280], places no processing 
requirements on the URI included in the qualifier.

4) I hope you'll ask the WG to adopt this draft ;)

spt

---

From: Andy Newton <[email-masked]>
Date: Thu, 6 Dec 2012 18:39:39 +0000

Sean,

Thanks for the quick review. Replies inline...

>else would pick userNotice?

It is possible that somebody somewhere might find them useful. But I'm not
gonna fall on my sword over the inclusion of user notices. A CPS pointer
is what we need.

I'll incorporate your text. Thanks.

>3.1) Need an IANA considerations section:

Noted.

>requirements on the URI included in the qualifier.

This is a very good point. And I think addressing it in security
considerations, as you have suggested, is the appropriate thing to do.

>4) I hope you'll ask the WG to adopt this draft ;)

Yes, I was planning to do so after a re-spin of this document.

Thanks for your review and text.

-andy