On 03/31/2016 11:30 AM, Ben Laurie wrote:

On 31 March 2016 at 16:15, David A. Cooper <[email protected]> wrote:

 I also disagree that you've pointed out "at least one other solution to the problem." The only things I've seen you suggest is that "the vulnerability is also mitigated by requiring AIA in the EE certificate." I can only guess what that means. Do you mean require an AIA extension with the id-ad-ocsp access method in the EE certificate?

Yes.

The id-ad-ocsp access method in AIA just contains an HTTP URI that provides information about where an OCSP responder can be found. It does nothing to help ensure that the response it authoritative for the certificate. That is addressed by other means. Perhaps if PKIX were changed to only allow the use of OCSP to distribute status information and it imposed (as SHALLs) certain restrictions on the validation of OCSP responses, this would avoid the problems that name collisions might cause with respect to determining the revocation status of a certificate. But, there's a lot more to a PKI than just determining whether certificates are revoked.

 
Would you simultaneously be forbidding the use of CRLs?

Specifying the CRL endpoint would also fix the problem.

I can again only guess what you mean. As with OCSP, including a URL in the cRLDistributionPoints extension just provides an (insecure) pointer to where a CRL can be found. It doesn't provide any security. In order for the URL to provide any additional assurance, that same URL would need to appear in a critical issuingDistributionPoint extension in the CRL. If it appeared in the CRL's IDP extension, then the CRL could only be used if the same name (e.g., HTTP URI) appeared in both the CRL's IDP and the certificate's CRLDP. But this again relies on names being unambiguous, because it wouldn't solve the problem if unrelated issuers could use the same names for distribution points.

 
What about CA certificates?

What about them?

There needs to be a reliable revocation mechanism for all certificates, not just EE certificates, and the mechanisms that PKIX describes (CRLs and OCSP) are the same for both. So, if something needs to be done in EE certificates to make revocation reliable, then something needs to be done in CA certificates as well.

 
How would the AIA extension fix the problem with attribute certificates (RFC 5755) that I highlighted?

I don't know. Are you saying it wouldn't? I don't really know anything about 5755.

Yes. The problem with attribute certificates has nothing to do with revocation. RFC 5755 allows attribute certificates to be issued to entities (humans, devices, etc.). How does a relying party know to whom (or what) the attribute certificate was issued? The entity to which the attribute certificate was issued is identified by providing the issuer name and serial number of the entity's public key certificate. So, if issuer names are ambiguous, then relying parties cannot reliably determine to whom (or to what) an attribute certificate has been issued.

 
Need further evidence of the RFC 5280 requirement? RFC 5280 says:
Section 4.1.2.4: The issuer field identifies the entity that has signed and issued the certificate.  The issuer field MUST contain a non-empty distinguished name (DN).  The issuer field is defined as the X.501 type Name [X.501].

Section 4.1.2.6: The subject field is defined as the X.501 type Name.  Implementation requirements for this field are those defined for the issuer field (Section 4.1.2.4).

How does X.509 define the Name type:
A (directory) name is a construct that identifies a particular object from among the set of all objects. A name shall be unambiguous, that is, denotes just one object. However, a name need not be unique, that is, be the only name that unambiguously denotes the object.

So, RFC 5280 says that the issuer and subject fields in certificates as defined as the X.501 type Name, and point to X.501 for the definition of Name, which defines Name to be something that is unambiguous.

I'm sure some will argue that RFC 5280 only intended to adopt some aspects of the definition of Name from X.501, and not this part of the definition. However, there is nothing in RFC 5280 to support that. And, you still can't get around the problem that if RFC 5280 didn't require names to be unambiguous, then as it is currently written, it and other PKIX documents would be flawed by design.

Interesting.

OK, for the sake of argument, let's assume that RFC 5280 does require names to be unambiguous. Now what? There is no mechanism in place to prevent (or even detect) ambiguity - that seems like a problem. Furthermore, what happens when it turns out a name is ambiguous? Presumably that makes all certs containing that name not 5280 compliant?

In practice, this just isn't a problem. CAs aren't just arbitrary system components. They are trusted entities that operate under well-defined policies and practices, and they don't just assign simple names for their CAs like "cn=Joe's CA". Just look, for example, at the name of the CA that issued the certificate for the IETF web site:
CN = Starfield Secure Certificate Authority - G2, OU = http://certs.starfieldtech.com/repository/, O = "Starfield Technologies, Inc.", L = Scottsdale, ST = Arizona, C = US
Is some unrelated entity going to issue certificates under that same name by accident?

Given the way names are formed, if two entities were found to be using the same name, it is far more likely that is was a result of one of these entities deliberately trying to impersonate the other. That's not a case of names being ambiguous, that's an attack. The solution to that (if name constraints don't prevent the impersonator's certificate from being validated) is revocation. PKIX doesn't deal with the issue of how to detect that there is a certificate that should be revoked. But this has nothing to do with names. If you have an undetected attacker in your PKI that is trusted as a CA, then you have problems regardless of whether the PKI standard was developed to mitigate problems associated with ambiguous CA names.

_______________________________________________
Trans mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/trans

Reply via email to