Subject: [dtn] Important side issues from ACME Node ID Validation draft

From: Brian Sipos <[email-masked]>
Date: Tue, 27 Jul 2021 01:04:56 +0000

All,
The recent AD reviews of the ACME Node ID Validation draft [1] included two issues not with the mechanism itself but with how the document interacts with other RFCs and drafts.

The first issue is that the document [2] is Experimental status from the perspective of ACME (it's not intended to be implemented widely by ACME servers) but it currently updates the BPbis document which is in Standards Track status. The reason for this update is purely that the BPbis document doesn't refer to, or update applicability of, the IANA registry for Administrative Record Types [3]. The language of the change was agreed with the BPbis author already and it's more than just an erratum because it affects the IANA sub-registry. If it is acceptable to the WG and BPbis authors, this could be treated as a late AUTH48 change. Otherwise, this would need to be implemented as a separate very small BPbis-updating Standards Track document (a lot of WG and IESG overhead for this change).

The second issue is unfortunately more technical; the "dtn" URI scheme has been set in stone and is already in use, but the PKIX profile in [4] specifically requires that when any SAN URI which includes an authority part (the "dtn" scheme does, it is the node name) that authority is either a DNS name or IP address. And we know that a Node ID is _not_ going to contain a network-level name but some other name. This technically breaks the profile in [5] as well as [2], which both use SAN URI as Node ID authentication. Because neither RFC5280 nor RFC6125 require to dereference the SAN URI and the DTN PKIX profiles explicitly avoid the URI-ID definition of RFC6125, the only risk is really that some application may inadvertently try to DNS probe the node name (or something like that). I don't yet know how much of a blocking issue this will be, and it's unfortunate that it wasn't noticed earlier.

Thoughts on the first issue are appreciated.
Thanks,
Brian S.

[1] https://mailarchive.ietf.org/arch/msg/acme/7HaJSiLnZ21zppL8p6MMIr6JEaI/
[2] https://datatracker.ietf.org/doc/html/draft-ietf-acme-dtnnodeid-04
[3] https://www.iana.org/assignments/bundle/bundle.xhtml#admin-record-types
[4] https://datatracker.ietf.org/doc/html/rfc5280#page-37
[5] https://datatracker.ietf.org/doc/html/draft-ietf-dtn-tcpclv4-26#section-4.4.2