WG Chair Hat OFF
Since Sandy's Last Call on this document there have been a few changes
to the document which I should note here.
The first set of changes concerns the revision from -13 to -14 (http://smakd.potaroo.net/cgi-bin/htmlwdiff?f1=..%2fall-ids%2fdraft-ietf-sidr-res-certs-14.txt&f2=..%2fall-ids%2fdraft-ietf-sidr-res-certs-13.txt
)
Following advice from Steve Kent, the section on Trust Anchors was
revised (section 6). The change has concerned the terminology used to
described the various structures proposed in the TA model.
Other changes include typography, and some clarification regarding the
treatment of signed objects and EE certificates with key rollover.
The -14 rev of the document was submitted to the drafts repository on
the 25th October.
I have prepared a -15 rev of the document to address a couple of other
concerns that appeared after the draft cut off date. This document is
at: http://www.potaroo.net/drafts/draft-ietf-sidr-res-certs-15.txt
until the draft submission process reopens in a couple of weeks.
The differences are:
a) consistent use of OID labels (GeneralNames, accessMethod,
accessLocation) throughout the document
b) typo referring to id-ad-rpkiManifest
c) redraft part of section 3.9.7
old:
When an EE certificate is intended for use in verifying multiple
objects, EE certificate MUST include in the SIA an access method OID
of id-ad-rpkiManifest, where the associated access location refers
to
the publication point of the objects that are verified using this EE
certificate.
new:
When an EE certificate is intended for use in verifying multiple
objects, EE certificate MUST include in the SIA an accessMethod OID
of id-ad-rpkiManifest, where the associated accessLocation refers
to the EE's published manifest object as an object URL.
d) provide a new example certificate in Appendix that conforms to the
spec!
new:
The following is an example Resource Certificate.
Certificate Name: 9JfgAEcq7Q-47IwMC5CJIJr6EJs.cer
Data:
Version: 3 (0x2(
Serial: 1500 (0x5dc)
Signature Algorithm: SHA256WithRSEEncryption
Issuer: CN=APNIC Production-CVPQSgUkLy7pOXdNeVWGvnFX_0s
Validity
Not Before: Oct 25 12:50:00 2008 GMT
Not After : Jan 31 00:00:00 2010 GMT
Subject: CN=A91872ED
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (2048 bit)
Modulus (2048 bit):
00:bb:fb:4a:af:a4:b9:dc:d0:fa:6f:67:cc:27:39:
34:d1:80:40:37:de:88:d1:64:a2:f1:b3:fa:c6:7f:
bb:51:df:e1:c7:13:92:c3:c8:a2:aa:8c:d1:11:b3:
aa:99:c0:ac:54:d3:65:83:c6:13:bf:0d:9f:33:2d:
39:9f:ab:5f:cd:a3:e9:a1:fb:80:7d:1d:d0:2b:48:
a5:55:e6:24:1f:06:41:35:1d:00:da:1f:99:85:13:
26:39:24:c5:9a:81:15:98:fb:5f:f9:84:38:e5:d6:
70:ce:5a:02:ca:dd:61:85:b3:43:2d:0b:35:d5:91:
98:9d:da:1e:0f:c2:f6:97:b7:97:3e:e6:fc:c1:c4:
3f:30:c4:81:03:25:99:09:4c:e2:4a:85:e7:46:4b:
60:63:02:43:46:51:4d:ed:fd:a1:06:84:f1:4e:98:
32:da:27:ee:80:82:d4:6b:cf:31:ea:21:af:6f:bd:
70:34:e9:3f:d7:e4:24:cd:b8:e0:0f:8e:80:eb:11:
1f:bc:c5:7e:05:8e:5c:7b:96:26:f8:2c:17:30:7d:
08:9e:a4:72:66:f5:ca:23:2b:f2:ce:54:ec:4d:d9:
d9:81:72:80:19:95:57:da:91:00:d9:b1:e8:8c:33:
4a:9d:3c:4a:94:bf:74:4c:30:72:9b:1e:f5:8b:00:
4d:e3
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
F4:97:E0:00:47:2A:ED:0F:B8:EC:8C:0C:0B:90:89:
20:9A:FA:10:9B
X509v3 Authority Key Identifier:
keyid:09:53:D0:4A:05:24:2F:2E:E9:39:77:4D:79:
55:86:BE:71:57:FF:4B
X509v3 Key Usage: critical
Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 CRL Distribution Points:
URI:rsync://rpki.apnic.net/repository/A3C38A24
D60311DCAB08F31979BDBE39/CVPQSgUkLy7pOXdNe
VWGvnFX_0s.crl
Authority Information Access:
CA Issuers - URI:rsync://rpki.apnic.net/repos
itory/8BDFC7DED5FD11DCB14CF4B1A703F9B7/CVP
QSgUkLy7pOXdNeVWGvnFX_0s.cer
X509v3 Certificate Policies: critical
Policy: 1.3.6.1.5.5.7.14.2
Subject Information Access:
CA Repository - URI:rsync://rpki.apnic.net/mem
ber_repository/A91872ED/06A83982887911DD81
3F432B2086D636/
Manifest - URI:rsync://rpki.apnic.net/member_r
epository/A91872ED/06A83982887911DD813F432
B2086D636/9JfgAEcq7Q-47IwMC5CJIJr6EJs.mft
sbgp-autonomousSysNum: critical
Autonomous System Numbers:
24021
38610
131072
131074
sbgp-ipAddrBlock: critical
IPv4:
203.133.248.0/22
203.147.108.0/23
Signature Algorithm: sha256WithRSAEncryption
51:4c:77:e4:21:64:80:e9:35:30:20:9f:d8:4b:88:60:b8:1f:
73:24:9d:b5:17:60:65:6a:28:cc:43:4b:68:97:ca:76:07:eb:
dc:bd:a2:08:3c:8c:56:38:c6:0a:1e:a8:af:f5:b9:42:02:6b:
77:e0:b1:1c:4a:88:e6:6f:b6:17:d3:59:41:d7:a0:62:86:59:
29:79:26:76:34:d1:16:2d:75:05:cb:b2:99:bf:ca:c6:68:1b:
b6:a9:b0:f4:43:2e:df:e3:7f:3c:b3:72:1a:99:fa:5d:94:a1:
eb:57:9c:9a:2c:87:d6:40:32:c9:ff:a6:54:b8:91:87:fd:90:
55:ef:12:3e:1e:2e:cf:c5:ea:c3:4c:09:62:4f:88:00:a0:7f:
cd:67:83:bc:27:e1:74:2c:18:4e:3f:12:1d:ef:29:0f:e3:27:
00:ce:14:eb:f0:01:f0:36:25:a2:33:a8:c6:2f:31:18:22:30:
cf:ca:97:43:ed:84:75:53:ab:b7:6c:75:f7:2f:55:5c:2e:82:
0a:be:91:59:bf:c9:06:ef:bb:b4:a2:71:9e:03:b1:25:8e:29:
7a:30:88:66:b4:f2:16:6e:df:ad:78:ff:d3:b2:9c:29:48:e3:
be:87:5c:fc:20:2b:df:da:ca:30:58:c3:04:c9:63:72:48:8c:
0a:5f:97:71
Geoff
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
