Subject: [ipwave] comments on the TLS certs draft

From: Alexandre Petrescu <[email-masked]>
Date: Fri, 29 Mar 2019 13:36:57 +0100

draft-tls-certieee1609-02

draft-msahli-ipwave-ieee1609-00.txt

The certificates are highly necessary for securing IP based 
communications in vehicle networks.

But the conditions of their use may prevent deployment.

- can I use an open source package to generate now a certificate with 
features of these drafts?

- is there a Certificate Authority that I can ask now to sign them?

- can I do these two things for free now?

Because in absence of these conditions, I am highly tempted to use 
openvpn and its associated free tools to generate my own CA and my own 
certificates to put in the cars I deal with.

I think in practice several people do just that.

I think it is a situation that needs to be prevented, because it means 
the drafts are not used.

Alex

---

From: William Whyte <[email-masked]>
Date: Fri, 29 Mar 2019 08:38:29 -0400

Alex, these certs are going to be widely deployed, and there is good
commercial support for them. We have standards organizations and deployment
sites asking for this draft.

Cheers,

William

On Fri, Mar 29, 2019 at 8:37 AM Alexandre Petrescu <
[email-masked]> wrote:

> The certificates are highly necessary for securing IP based communications
> in vehicle networks.
>
> Because in absence of these conditions, I am highly tempted to use openvpn
> and its associated free tools to generate my own CA and my own certificates
> to put in the cars I deal with.
>
> I think it is a situation that needs to be prevented, because it means the
> drafts are not used.
>
> Alex
> _______________________________________________
> its mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/its
>

-- 

---

I may have sent this email out of office hours. I never expect a response
outside yours.

---

From: Alexandre Petrescu <[email-masked]>
Date: Fri, 29 Mar 2019 16:17:31 +0100

I agree with the statements about deployment expectation and available 
commercial support, and with the existing sdos and sites asking for this 
draft.

On my side, I work for a few small deployments as well.

I need certificates now.

Allow me to be specific about my case.

I am in France: in order to obtain ITS-specific certificates I got 
redirected to a French enterprise named IDnomic.  It is a great company 
(presumably part of what you refer to as 'commercial support'). That has 
a website with ITS described as Object-ID https://www.idnomic.com/object-id/

However, on that web page, there is no button to press to ask a 
certificate.  IDnomic is not like, let's say, I asked a certificate to 
Let's Encrypt.   Let's Encrypt can offer me certificates in an automated 
manner; and not least important - for free.

On the downside, Let's Encrypt certificates are not specific for 
Vehicular networks.  (I suppose Let's Encrypt never heard about ITS 
extensions to certificates).

In this situation, what I do in my deployments, is to generate our own 
certificates, and sign them by our own CAs created locally.  The cars 
and traffic lights connect to our own openvpn server; they understand 
each other, because under same authority.

Yet, this situation is not something that can scale: I dont want more 
and more vehicles to connect to my server.  It risks becoming a single 
point of failure.

As a side note, I take advantage of this discussion to ask whether there 
is software implementation, or howto, that allows me to generate easily 
certificates with ITS extensions described in this draft.

I need these now (well, during the following months).

Alex

Le 29/03/2019 à 13:38, William Whyte a écrit :
> commercial support for them. We have standards organizations and 
> deployment sites asking for this draft.
> 
> Cheers,
> 
> William
> 
> 
> On Fri, Mar 29, 2019 at 8:37 AM Alexandre Petrescu 
> <[email-masked] <mailto:[email-masked]>> wrote:
> 
>     - can I use an open source package to generate now a certificate
>     with features of these drafts?
> 
>     openvpn and its associated free tools to generate my own CA and my
>     own certificates to put in the cars I deal with.
> 
>     I think it is a situation that needs to be prevented, because it
>     means the drafts are not used.
> 
>     Alex
> 
>     [email-masked] <mailto:[email-masked]>
> I may have sent this email out of office hours. I never expect a 
> response outside yours.

---

From: William Whyte <[email-masked]>
Date: Fri, 29 Mar 2019 13:37:09 -0400

Hi Alex -- you can get certificates from
https://www.ghsiss.com/v2x-certificates/, if you have a 1609.2/103 097
implementation. There's a java implementation of 1609.2/103 097 here:
https://github.com/pvendil/c2c-common. I can't vouch for its quality. A
number of companies (including mine) will license a C/C++ implementation to
you.

Note that C-ITS certificates aren't X.509 certificates with ITS extensions,
they're a completely different and incompatible format. Your X.509
libraries won't be any use for this.

Cheers,

William

-- 

---