Subject: Re: [Geopriv] LIS discovery: certificate fingerprints

From: "Brian Rosen" <[email-masked]>
Date: Mon, 2 Mar 2009 18:10:13 -0500

I've been noodling this over for a couple of days.

My initial reaction is: you copied the mechanism from somewhere else; don't
they have the same problem, and if so, what did they do about it?

I'm not unhappy with the solution, it's just it seems to be reinventing a
wheel that must have already been invented.

I don't think the algorithm is too complex.

I do think there are problems with the size of the packet, but I'm not sure
what the biggest problem is.

So far, in my experience, when you use public key crypto with a cluster, you
share the private key within the cluster, but YMMV.  

Brian

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Thomson, Martin
Sent: Thursday, February 26, 2009 6:32 PM
To: GEOPRIV
Subject: [Geopriv] LIS discovery: certificate fingerprints

As far as I am aware, this is the last remaining issue with LIS discovery.
I'd like to get this addressed at, or at least soon after, this upcoming
meeting.

The current draft uses two alternative forms of LIS authentication:

 (A) domain name based, using RFC2818, just like the web

 (B) certificate fingerprint based, matching a hash of the LIS certificate,
provided by the DHCP server

This is relatively simple, and thanks to feedback from the DHC WG, the
encoding in DHCP is quite simple and straightforward.

Based on SECDIR feedback (thanks to Joe Salowey), there is an additional
dimension to the problem that might be necessary for successful deployment
of the fingerprint method.

Two cases result in problems with the method as currently proposed, which
only allows for a single certificate.

 (A) server load balancing could have multiple LIS servers with different
certificates

 (B) certificate expiry causes a synchronization issue - the DHCP option and
the LIS certificate would need to be updated simultaneously

To address these problems, I propose a simple change to the algorithm and a
less simple change to the DHCP fingerprint option.

The fingerprint contains multiple sets of fingerprints, each set containing
a certificate serial number and one or more hashes for that serial number.

  <serial> : <hash> : <value>
           : <hash> : <value>
  <serial> : <hash> : <value>
           : <hash> : <value>

(Actual format to be worked out - DHC favour very simple encodings that
might be hard to accommodate with this scheme.)

This allows the client to identify which set of hashes apply to a given
server.  Hash values for older or newer versions of the LIS certificate are
ignored based on the serial number of the cert; similarly, hash values for
alternative LIS servers are ignored.

  Discover LIS, get fingerprints option
  Establish TLS connection, get the LIS certificate
  If no fingerprint is provided by DHCP
     Check using the domain name following RFC2818
  else
     If a fingerprint exists for the cert serial number,
        Check the fingerprint taking the first supported hash alg.
     else
        LIS is unauthenticated

Of course, a better uniqueness test would include the certificate issuer.
I'm willing to risk there being two certificates from different issuers with
the same serial number and fingerprint.

Thoughts? issues? (complexity? deployment? DHCP packet size?)

Cheers,
Martin
----------------------------------------------------------------------------
--------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
----------------------------------------------------------------------------
--------------------
[mf2]
_______________________________________________
Geopriv mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/geopriv

---

From: "Thomson, Martin" <[email-masked]>
Date: Sun, 8 Mar 2009 18:55:17 -0500

Thanks for the thoughts Brian,

I've gone through all the same thoughts.

Actually, only aspects are copied.  I looked but didn't find anything other than a few uses of fingerprints.  In particular, none seemed to deal with the deployment issues.

On size, I expect that one certificate will be enough in most cases.  That should run to about 80-90 bytes in the changeover period when a certificate is expiring.  That's only if the serial numbers are as large as some of the ones I'm seeing.

As you said, clusters might share a private key, but I wouldn't want to bank on that.  In any case, the problem can be solved along with the other, so...

Cheers,
Martin

> From: Brian Rosen [mailto:[email-masked]]
> Sent: Tuesday, 3 March 2009 10:10 AM
> To: Thomson, Martin; 'GEOPRIV'
> Subject: RE: [Geopriv] LIS discovery: certificate fingerprints
> 

------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------
[mf2]