Subject: [sidr] RPKI: Are relying parties really supposed to validate DER encoding?

From: Alberto Leiva <[email-masked]>
Date: Thu, 10 Jan 2019 16:26:37 -0600

Hello.

I have a question:

RFC 6488 section 3.1.l (https://tools.ietf.org/html/rfc6488#section-3)
wants relying parties (RPs) to validate that all RPKI signed objects
are DER-encoded, which (I think) means that they must be BER-encoded
with minimal and unique representations.

But I have found at least one other requirement that seems to
contradict this: RFC 6482 section 3.3, fourth paragraph, second half,
claims that a ROA (which is a signed object) is allowed to contain
redundant ROAIPAddress elements.

Furthermore, RFC 3779 (which is meaningfully referenced by the ROA and
RPKI certificate (6487) RFCs) states the following:

   relying parties do
   not need to sort the information, or to implement extra code in the
   subset checking algorithms to handle several boundary cases
   (adjacent, overlapping, or subsumed ranges).

Which seems to be paraphraseable as "RPs can parse signed objects as
if they were BER-encoded, without worrying about DER."

In fact, my reading of it is that the entirety of RFC 3779 seems to be
of the mind that IP and AS extension writers are intended to strictly
adhere to DER specifically for the sake of simplifying the task of
RPs. RFC 6488, on the other hand, wants both to be strict.

So what's the consensus?

---

From: Russ Housley <[email-masked]>
Date: Thu, 10 Jan 2019 17:39:00 -0500

See the Section on DER encoding at https://en.wikipedia.org/wiki/X.690.

> On Jan 10, 2019, at 5:26 PM, Alberto Leiva <[email-masked]> wrote:
> 
> Hello.
> 
> I have a question:
> 
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: Alberto Leiva <[email-masked]>
Date: Thu, 10 Jan 2019 17:00:04 -0600

Ok, thanks.

---

From: Martin Hoffmann <[email-masked]>
Date: Fri, 11 Jan 2019 11:24:13 +0100

> redundant ROAIPAddress elements.

DER is only concerned with encoding, not with the content. Mostly,
it forbids indefinite length constructed values and enforces string
types to be primitively encoded.

Unlike X.680, X.690 is actually quite readable. All of them are now
available for free from the ITU.

That all said, be warned that at least two RIRs currently produce RPKI
signed objects that are not validly DER encoded, but rather seem to be
using CER. So in practice, you will need to be able to parse the more
generic BER at least at this time or loose a significant part of the
RPKI repository.

For Routinator, we decided to have a relaxed validation mode and
documented all it does[0]. Currently, be default we run in relaxed mode
and have a command line option for strict mode.

Not sure if the working group needs to address this issue or how.

Kind regards,
Martin

[0] https://github.com/NLnetLabs/rpki-rs/blob/master/doc/relaxed-validation.md