Subject: [IPsec] Verification check for ID_DER_ASN1_DN IDs

From: David Wierbowski <[email-masked]>
Date: Fri, 9 Jan 2009 17:53:39 -0500

Sections 3.1.1 through 3.1.3 of RFC 4945 state that "Implementations MAY
provide a configuration option to (i.e., local policy configuration can
enable) skip that verification step, but that option MUST be off by
default."  This statement is made with regard to the requirement of
verifying that the ID provided in an ID payload matches the contents of the
subjectAlt name in the certificate presented,

Section 3.1.5 of RFC 4945 states that. "implementations MUST populate the
contents of ID with the Subject field from the end-entity certificate, and
MUST do so such that a binary comparison of the two will succeed.  If there
is not a match, this MUST be treated as an error, and security association
setup MUST be aborted."  This statement is made with regard to the
requirement of verifying that the ID provided in a ID payload matches the
Subject field of the certificate presented,   There is no text indicating
that implementations MAY provide a configuration option to skip that
verification step.  Was this an oversight or was there a reason to disallow
such a configuration option when the ID payload is of type ID_DER_ASN1_DN?

It seems as if the check for ID_IPV4_ADDR, ID_IPV6_ADDR, ID_FQDN, and ID
USER_FQDN is optional that the check for ID_DER_ASN1_DN should also be
optional.

Dave Wierbowski

z/OS Comm Server Developer

 Phone:
    Tie line:   620-4055
    External:  607-429-4055

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 12 Jan 2009 14:33:18 +0200

> USER_FQDN is optional that the check for ID_DER_ASN1_DN should also be

If you read the rationale for making the check optional ("We include
the "option-to-skip- validation" in order to permit better
interoperability, as current implementations vary greatly in how they
behave on this topic.") that indicates that those ID_IPV4_ADDR,
ID_IPV6_ADDR, ID_FQDN and ID_USER_FQDN do have that problem, but I do
not think ID_DER_ASN1_DN has that problem.

For ID_DER_ASN1_DN it has been very clear from the beginning how to
match that against certificate, so there has not been reason to make
check optional. For other types different implementations have done
things differently (for example some implementations searched ID_FQDN
from CN field of the Subject, not from the dNSName field of the
SubjectAltName etc), and because of this it was seen necessary to make
it possible to make those those checks optional for such
implementations who want to keep backward compatibility for their own
old versions.

So I do not see reason for making ID_DER_ASN1_DN check optional.
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec