Subject: [sidr] BGPSEC Algorithms document missing a clear reference?

From: Christopher Morrow <[email-masked]>
Date: Wed, 5 Mar 2014 10:49:59 -0500

It was pointed out in passing (hallway/table conversation) that in:
  draft-ietf-sidr-bgpsec-algs-05 (at least 05)

there's this text in section 2:

"NOTE: The exception to the above hashing algorithm is the use of

       SHA-1 [SHS] when CAs generate authority and subject key
       identifiers [ID.bgpsec-pki-profiles]."

The reference to bgpsec-pki-profiles, is PROBABLY really:
   draft-sidr-bgpsec-pki-profiles
   <http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-protocol>

There doesn't seem to be a reference to sha1 here for making an SKI.
It looks like you'd have to inherit and inherit from 3779 -> 5280 and
text in section 4.2.1.2:
  " For CA certificates, subject key identifiers SHOULD be derived from

   the public key or a method that generates unique values.  Two common
   methods for generating key identifiers from the public key are:

      (1) The keyIdentifier is composed of the 160-bit SHA-1 hash of the
           value of the BIT STRING subjectPublicKey (excluding the tag,
           length, and number of unused bits).

Cooper, et al.              Standards Track                    [Page 28]

RFC 5280            PKIX Certificate and CRL Profile            May 2008

      (2) The keyIdentifier is composed of a four-bit type field with
           the value 0100 followed by the least significant 60 bits of
           the SHA-1 hash of the value of the BIT STRING
           subjectPublicKey (excluding the tag, length, and number of
           unused bits).
"

Is this the intention? that spelunking in rfcs is required to figure
out that sha1 would be used? or could/should the reference be more
clear?

-chris
(care of mystery caller #7)

---

From: Stephen Kent <[email-masked]>
Date: Tue, 11 Mar 2014 10:34:55 -0400

Chris,

>     <http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-protocol>
not sure why the angle bracket reference to the bgpsec protocol appears 
above,
after the intended reference. But, as you note below, 
draft-sidr-bgpsec-pki-profiles
does not refer to SKI's.It says that it inherits all of the RPKI cert 
profile
(RFC 6487) except as noted in Section 3 of the I-D. RFC 6487 mandates 
inclusion
of the SKI and AKI extensions, and specifies use of SHA-1 to compute SKI 
and AKI values.
So, the text above should be changed to refer RFC 6487. (There is no 
need to go back to
5280, since 6487 cites it and narrows the SKI/AKI generation options 
from that RFC.)

Steve

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 11 Mar 2014 11:56:51 -0400

> not sure why the angle bracket reference to the bgpsec protocol appears

angle brackets because of old-skool email-client/URL interpolation habits :(
wrong reference because ... #fail. The right one:
  <http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-pki-profiles>

apologies for the confusion.

> of the SKI and AKI extensions, and specifies use of SHA-1 to compute SKI and
> AKI values.
> So, the text above should be changed to refer RFC 6487. (There is no need to
> go back to
> 5280, since 6487 cites it and narrows the SKI/AKI generation options from
> that RFC.)

awesome! the OP was correct in pointing out the missing linkages, sweet :)

> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: Sean Turner <[email-masked]>
Date: Thu, 27 Mar 2014 10:23:39 -0400

New version should be posted soon addressing this and some other reference updaets.

spt