draft-ietf-sidr-ghostbusters-03.txt   draft-ietf-sidr-ghostbusters-04.txt 
Network Working Group R. Bush Network Working Group R. Bush
Internet-Draft Internet Initiative Japan Internet-Draft Internet Initiative Japan
Intended status: Standards Track March 11, 2011 Intended status: Standards Track June 25, 2011
Expires: September 12, 2011 Expires: December 27, 2011
The RPKI Ghostbusters Record The RPKI Ghostbusters Record
draft-ietf-sidr-ghostbusters-03 draft-ietf-sidr-ghostbusters-04
Abstract Abstract
In the Resource Public Key Infrastructure (RPKI), resource In the Resource Public Key Infrastructure (RPKI), resource
certificates completely obscure names or any other information which certificates completely obscure names or any other information which
might be useful for contacting responsible parties to deal with might be useful for contacting responsible parties to deal with
issues of certificate expiration, maintenance, roll-overs, issues of certificate expiration, maintenance, roll-overs,
compromises, etc. This draft describes the RPKI Ghostbusters Record compromises, etc. This draft describes the RPKI Ghostbusters Record
containing human contact information to be signed (indirectly) by a containing human contact information to be signed (indirectly) by a
resource-owning certificate. The data in the record are those of a resource-owning certificate. The data in the record are those of a
skipping to change at page 1, line 43 skipping to change at page 1, line 43
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on September 12, 2011. This Internet-Draft will expire on December 27, 2011.
Copyright Notice Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the Copyright (c) 2011 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 25 skipping to change at page 2, line 25
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Suggested Reading . . . . . . . . . . . . . . . . . . . . . . . 3 2. Suggested Reading . . . . . . . . . . . . . . . . . . . . . . . 3
3. RPKI Ghostbusters Record Payload Example . . . . . . . . . . . 4 3. RPKI Ghostbusters Record Payload Example . . . . . . . . . . . 4
4. vCARD Profile . . . . . . . . . . . . . . . . . . . . . . . . . 4 4. vCARD Profile . . . . . . . . . . . . . . . . . . . . . . . . . 4
5. CMS Packaging . . . . . . . . . . . . . . . . . . . . . . . . . 5 5. CMS Packaging . . . . . . . . . . . . . . . . . . . . . . . . . 5
6. Validation . . . . . . . . . . . . . . . . . . . . . . . . . . 5 6. Validation . . . . . . . . . . . . . . . . . . . . . . . . . . 5
7. Security Considerations . . . . . . . . . . . . . . . . . . . . 6 7. Security Considerations . . . . . . . . . . . . . . . . . . . . 6
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 6 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 6
9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . 6 8.1. OID . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 6 8.2. File Extension . . . . . . . . . . . . . . . . . . . . . . 6
10.1. Normative References . . . . . . . . . . . . . . . . . . . 6 8.3. Media Type . . . . . . . . . . . . . . . . . . . . . . . . 7
10.2. Informative References . . . . . . . . . . . . . . . . . . 7 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . 7
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 7 10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 7
10.1. Normative References . . . . . . . . . . . . . . . . . . . 7
10.2. Informative References . . . . . . . . . . . . . . . . . . 8
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 8
1. Introduction 1. Introduction
In the operational use of the RPKI it can become necessary to In the operational use of the RPKI it can become necessary to
contact, human to human, the party responsible for a resource-owning contact, human to human, the party responsible for a resource-owning
certificate. An important example is when the owner of a Route certificate. An important example is when the owner of a Route
Origin Authorization (ROA) sees a problem, or an impending problem, Origin Authorization (ROA) sees a problem, or an impending problem,
with a certificate or CRL in the path between the ROA and a trust with a certificate or CRL in the path between the ROA and a trust
anchor. E.g., a certificate along that path has expired, is soon to anchor. E.g., a certificate along that path has expired, is soon to
expire, or a CRL associated with a CA along the path is stale, thus expire, or a CRL associated with a CA along the path is stale, thus
skipping to change at page 3, line 50 skipping to change at page 3, line 50
vCARD. The second, Section 5, profiles the packaging of the payload vCARD. The second, Section 5, profiles the packaging of the payload
as a profile of the RPKI Signed Object Template specification as a profile of the RPKI Signed Object Template specification
[I-D.ietf-sidr-signed-object]. The third, Section 6, describes the [I-D.ietf-sidr-signed-object]. The third, Section 6, describes the
proper validation of the signed Ghostbusters Record. proper validation of the signed Ghostbusters Record.
2. Suggested Reading 2. Suggested Reading
It is assumed that the reader understands the RPKI, It is assumed that the reader understands the RPKI,
[I-D.ietf-sidr-arch], the RPKI Repository Structure, [I-D.ietf-sidr-arch], the RPKI Repository Structure,
[I-D.ietf-sidr-repos-struct], Signed RPKI Objects, [I-D.ietf-sidr-repos-struct], Signed RPKI Objects,
[I-D.ietf-sidr-signed-object], and vCARDs [RFC2426]. [I-D.ietf-sidr-signed-object], and vCARDs
[I-D.ietf-vcarddav-vcardrev].
3. RPKI Ghostbusters Record Payload Example 3. RPKI Ghostbusters Record Payload Example
An example of an RPKI Ghostbusters Record payload with all types An example of an RPKI Ghostbusters Record payload with all types
populated is as follows: populated is as follows:
BEGIN:vCard BEGIN:vCard
VERSION:3.0 VERSION:4.0
FN:Human's Name FN:Human's Name
N:Name;Human's;Ms.;Dr.;OCD;ADD N:Name;Human's;Ms.;Dr.;OCD;ADD
ORG:Organizational Entity ORG:Organizational Entity
ADR;TYPE=WORK:;;42 Twisty Passage;Deep Cavern; WA; 98666;U.S.A. ADR;TYPE=WORK:;;42 Twisty Passage;Deep Cavern; WA; 98666;U.S.A.
TEL;TYPE=VOICE,MSG,WORK:+1-666-555-1212 TEL;TYPE=VOICE,MSG,WORK:+1-666-555-1212
TEL;TYPE=FAX,WORK:+1-666-555-1213 TEL;TYPE=FAX,WORK:+1-666-555-1213
EMAIL;TYPE=INTERNET:human@example.com EMAIL;TYPE=INTERNET:human@example.com
END:vCard END:vCard
4. vCARD Profile 4. vCARD Profile
The goal in profiling the vCARD is not to include as much information The goal in profiling the vCARD is not to include as much information
as possible, but rather to include as few types as possible while as possible, but rather to include as few types as possible while
providing the minimal necessary data to enable one to contact the providing the minimal necessary data to enable one to contact the
maintainer of the RPKI data which threatens the ROA[s] of concern. maintainer of the RPKI data which threatens the ROA[s] of concern.
The Ghostbusters vCARD payload is a minimalist subset of the vCARD as The Ghostbusters vCARD payload is a minimalist subset of the vCARD as
described in [RFC2426]. described in [I-D.ietf-vcarddav-vcardrev].
BEGIN - pro forma packaging which MUST be the first line in the BEGIN - pro forma packaging which MUST be the first line in the
vCARD and MUST have the value "BEGIN:vCARD" as described in vCARD and MUST have the value "BEGIN:vCARD" as described in
[RFC2426]. [I-D.ietf-vcarddav-vcardrev].
VERSION - pro forma packaging which MUST be the second line in the VERSION - pro forma packaging which MUST be the second line in the
vCARD and MUST have the value "VERSION:3.0" as described in 3.6.9 vCARD and MUST have the value "VERSION:4.0" as described in 3.6.9
of [RFC2426]. of [I-D.ietf-vcarddav-vcardrev].
FN - the name, as described in 3.1.1 of [RFC2426], of a contactable FN - the name, as described in 6.2.1 of
person who responsible for the certificate. [I-D.ietf-vcarddav-vcardrev], of a contactable person who
responsible for the certificate.
N - the components of the name of the object the vCard represents, N - the components of the name of the object the vCard represents,
as described in 3.1.2 of [RFC2426]. as described in 6.2.2 of [I-D.ietf-vcarddav-vcardrev].
ORG - an organization as described in 3.5.5 of [RFC2426]. ORG - an organization as described in 6.6.4 of
[I-D.ietf-vcarddav-vcardrev].
ADR - a postal address as described in 3.2.1 of [RFC2426]. ADR - a postal address as described in 6.3 of
[I-D.ietf-vcarddav-vcardrev].
TEL - a voice and/or fax phone as described in 3.3.1 of [RFC2426]. TEL - a voice and/or fax phone as described in 6.4.1 of
[I-D.ietf-vcarddav-vcardrev].
EMAIL - an Email address as described in 3.3.2 of [RFC2426] EMAIL - an Email address as described in 6.4.2 of
[I-D.ietf-vcarddav-vcardrev]
END - pro forma packaging which MUST be the last line in the vCARD END - pro forma packaging which MUST be the last line in the vCARD
and MUST have the value "END:vCARD" as described in [RFC2426]. and MUST have the value "END:vCARD" as described in
[I-D.ietf-vcarddav-vcardrev].
Per [RFC2426], the BEGIN, VERSION, FN, N, and END types MUST be Per [I-D.ietf-vcarddav-vcardrev], the BEGIN, VERSION, FN, N, and END
included in a record. To be useful, one or more of ADR, TEL, and types MUST be included in a record. To be useful, one or more of
EMAIL MUST be included. Other types MAY NOT be included. ADR, TEL, and EMAIL MUST be included. Other types MUST NOT be
included.
5. CMS Packaging 5. CMS Packaging
The Ghostbusters Record is a CMS signed-data object conforming to the The Ghostbusters Record is a CMS signed-data object conforming to the
RPKI Signed Data Object Template, [I-D.ietf-sidr-signed-object]. Signed Object Template for the Resource Public Key Infrastructure,
[I-D.ietf-sidr-signed-object].
The ContentType of a Ghostbusters Record is defined as The ContentType of a Ghostbusters Record is defined as id-ct-
rpkiGhostbusters, and has the numerical value of [TO BE ASSIGNED]. rpkiGhostbusters, and has the numerical value of
This OID MUST appear both within the eContentType in the 1.2.840.113549.1.9.16.1.35. This OID MUST appear both within the
encapContentInfo object as well as the ContentType signed attribute eContentType in the encapContentInfo object as well as the
in the signerInfo object. See [I-D.ietf-sidr-signed-object]. ContentType signed attribute in the signerInfo object. See
[I-D.ietf-sidr-signed-object].
eContent: The content of a Ghostbusters Record is described above in eContent: The content of a Ghostbusters Record is described above in
Section 4 above. Section 4 above.
Similarly to a ROA, the Ghostbusters Record is verified using an EE Similarly to a ROA, the Ghostbusters Record is verified using an EE
certificate issued under the CA certificate associated with the certificate issued under the CA certificate associated with the
resource-holding certificate whose maintainer is described in the resource-holding certificate whose maintainer is described in the
vCARD. vCARD.
The EE certificate used to verify the Ghostbusters Record is the one The EE certificate used to verify the Ghostbusters Record is the one
skipping to change at page 6, line 24 skipping to change at page 6, line 32
Email Addresses: The vCARDs may contain Email addresses which could Email Addresses: The vCARDs may contain Email addresses which could
be abused for purposes of spam. be abused for purposes of spam.
Relying parties are warned that the data in a Ghostbusters Record are Relying parties are warned that the data in a Ghostbusters Record are
self-asserted. These data have not been verified by the CA that self-asserted. These data have not been verified by the CA that
issued a (CA) certificate to the entity that issued the EE issued a (CA) certificate to the entity that issued the EE
certificate used to validate the Ghostbusters Record. certificate used to validate the Ghostbusters Record.
8. IANA Considerations 8. IANA Considerations
This document has no IANA Considerations. 8.1. OID
The IANA is requested to register the OID for the Ghostbusters Record
in the registry created by [I-D.ietf-sidr-signed-object] as follows:
Name OID Specification
-----------------------------------------------------------
Ghostbusters 1.2.840.113549.1.9.16.1.35 [ This document ]
8.2. File Extension
The IANA is requested to add an item for the Ghostbusters Record file
extension to the RPKI Repository Name Scheme created by
[I-D.ietf-sidr-repos-struct] as follows:
Filename Extension RPKI Object Reference
-----------------------------------------------------------
.gbr Ghostbusters Record [ This document ]
8.3. Media Type
The IANA is requested to register the media type application/
rpki-ghostbusters as follows
MIME media type name: application
MIME subtype name: rpki-ghostbusters
Required parameters: None
Optional parameters: None
Encoding considerations: binary
Security considerations: Carries an RPKI Ghostbusters Record
[I-D.ietf-sidr-ghostbusters].
Interoperability considerations: None
Published specification: This document
Applications which use this media type: Any MIME-complaint transport
Additional information:
Magic number(s): None
File extension(s): .gbr
Macintosh File Type Code(s):
Person & email address to contact for further information:
Randy Bush <randy@psg.com>
Intended usage: COMMON
Author/Change controller: Randy Bush <randy@psg.com>
9. Acknowledgments 9. Acknowledgments
The author wishes to thank Russ Housley, the authors of The author wishes to thank Russ Housley, the authors of
[I-D.ietf-sidr-signed-object], Stephen Kent, and Michael Elkins for [I-D.ietf-sidr-repos-struct], Stephen Kent, Sandy Murphy, and Michael
their contributions. Elkins for their contributions.
10. References 10. References
10.1. Normative References 10.1. Normative References
[I-D.ietf-sidr-repos-struct]
Huston, G., Loomans, R., and G. Michaelson, "A Profile for
Resource Certificate Repository Structure",
draft-ietf-sidr-repos-struct-07 (work in progress),
February 2011.
[I-D.ietf-sidr-signed-object] [I-D.ietf-sidr-signed-object]
Lepinski, M., Chi, A., and S. Kent, "Signed Object Lepinski, M., Chi, A., and S. Kent, "Signed Object
Template for the Resource Public Key Infrastructure", Template for the Resource Public Key Infrastructure",
draft-ietf-sidr-signed-object-03 (work in progress), draft-ietf-sidr-signed-object-03 (work in progress),
February 2011. February 2011.
[I-D.ietf-vcarddav-vcardrev]
Perreault, S., "vCard Format Specification",
draft-ietf-vcarddav-vcardrev-19 (work in progress),
April 2011.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2426] Dawson, F. and T. Howes, "vCard MIME Directory Profile",
RFC 2426, September 1998.
10.2. Informative References 10.2. Informative References
[I-D.ietf-sidr-arch] [I-D.ietf-sidr-arch]
Lepinski, M. and S. Kent, "An Infrastructure to Support Lepinski, M. and S. Kent, "An Infrastructure to Support
Secure Internet Routing", draft-ietf-sidr-arch-12 (work in Secure Internet Routing", draft-ietf-sidr-arch-12 (work in
progress), February 2011. progress), February 2011.
[I-D.ietf-sidr-cp] [I-D.ietf-sidr-cp]
Kent, S., Kong, D., Seo, K., and R. Watro, "Certificate Kent, S., Kong, D., Seo, K., and R. Watro, "Certificate
Policy (CP) for the Resource PKI (RPKI", Policy (CP) for the Resource PKI (RPKI",
draft-ietf-sidr-cp-16 (work in progress), December 2010. draft-ietf-sidr-cp-17 (work in progress), April 2011.
[I-D.ietf-sidr-repos-struct]
Huston, G., Loomans, R., and G. Michaelson, "A Profile for
Resource Certificate Repository Structure",
draft-ietf-sidr-repos-struct-07 (work in progress),
February 2011.
Author's Address Author's Address
Randy Bush Randy Bush
Internet Initiative Japan Internet Initiative Japan
5147 Crystal Springs 5147 Crystal Springs
Bainbridge Island, Washington 98110 Bainbridge Island, Washington 98110
US US
Phone: +1 206 780 0431 x1 Phone: +1 206 780 0431 x1
 End of changes. 25 change blocks. 
45 lines changed or deleted 101 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/