Subject: Re: [Netconf] rfc5539bis > - NC over TLS with mutual X.509 authentication

From: t.petch <[email-masked]>
Date: Mon, 3 Nov 2014 11:32:14 +0000

----- Original Message -----
From: "Alan Luchuk" <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Friday, October 31, 2014 2:19 PM

<snip>

> Also, included below is the following new proposed text for Section
2.4.1,
> and a new section 2.4.2.  The new section 2.4.2 would displace the
existing
> section 2.4.2 to have 2.4.3, and so on.  Thoughts on this?

Alan

I am unclear on what you are proposing

For me, there is a clear split between the validation of  X.509
certificates and  the use then made of the contents thereof, something
which I do not see in the paragraphs you propose.

Thus the procedures of  RFC5280 section 6 apply to all X.509
certificates and require the client to be configured with suitable trust
anchors.   If the client is configured with the server certificate per
se, then that is a degenerate case thereof.  I think that RFC5539 s.3.1
paragraph 4 gets that about right and little if anything needs changing
with that (except putting it first!).

Once the certificate has been validated, then it is a question of
extracting the identifier of the server from it and comparing that to a
reference identifier configured in the client.  I think that RFC6125
does us no favours; it limits itself to
"service identities associated with fully-qualified DNS domain names"
preferably with SRV-IDs, which I think too restrictive - we have to
reference it, but need to qualify the use thereof.  So we cannot reuse
the other paragraphs of RFC5539 but need to say something like 'SHOULD
use RFC6125' but then go on to qualify it.

Tom Petch

> Regards,
> --Alan
>
> Section 2.4.1  Verifying the NETCONF Server Identity
> ----------------------------------------------------
>
> The NETCONF client MUST verify the identity of the NETCONF server.
> The NETCONF client MAY use the procedure documented in Section 2.4.2
> to verify the identify of the NETCONF server.  The NETCONF client MAY
> use an alternate procedure to verify the identity the NETCONF server.
>
> If the NETCONF client uses an alternate procedure to verify the
identity
> of the NETCONF server, then the alternate procedure must
> provide a level of verification comparable to the procedure documented
> in Section 2.4.2.  One example of an alternate procedure for verifying
> the NETCONF server's identity would be to compare the X.509
certificate
> presented by the NETCONF server against a local store of
> already-verified X.509 certificates and identity bindings.
>
> If the NETCONF client attempts to connect to a NETCONF server, and the
> NETCONF server fails the identity verification step, then the NETCONF
> client MUST notify the user that the NETCONF server identity
> verification failed, and  1) either terminate the connection, or
> 2) request user confirmation to proceed with the connection.
>
>
> Section 2.4.2  Standard Procedure for Verifying the NETCONF Server
Identity
> ----------------------------------------------------------------------
-----
>
> If the NETCONF client uses this documented procedure to verify the
> identify of the NETCONF server, then the NETCONF client MUST follow
> follow this procedure completely.
>
> The NETCONF client MUST verify the integrity of the X.509 certificate
> presented by the NETCONF server.  To do this, the NETCONF client MUST:
>
> -  Use the certificate path validation algorithm described in
>    Section 6 of [RFC 5280].
>
> -  Validate the X.509 certificate presented by the NETCONF server
>    to a trust anchor configured in the NETCONF client.
>
> To prevent man-in-the-middle attacks, after verifying the integrity of
> X.509 certificate presented by the NETCONF server, the NETCONF
> client MUST verify the identity of the NETCONF server.  To verify the
> identity of the NETCONF server:
>
> -  The NETCONF client MUST have information about the expected
identity
>    of the NETCONF server to which it connected, and from which it
received
>    a presented X.509 certificate.  This NETCONF server identity
information
>    MUST be pre-configured in the NETCONF client before it initiates
the
>    connection to the NETCONF server.
>
> -  The X.509 certificate presented by the NETCONF server must contain
>    information about the NETCONF server's identity.
>
> -  The NETCONF client MUST extract the NETCONF server identity
information
>    from the X.509 certificate presented by the server.   The NETCONF
client
>    MUST compare the extracted server identity to the pre-configured
server
>    identity information according to the rules and guidelines defined
in
>    [RFC 6125].  If the comparison succeeds, then the NETCONF server
>    identity is verified, and the connection can proceed.  If the
comparison
>    fails, then the NETCONF server identity verification has failed.
The
>    NETCONF client must handle the NETCONF server identity verification
>    failure as documented above.
>