Subject: Re: [Sidrops] trying to limit RP processing variability

From: Job Snijders <[email-masked]>
Date: Tue, 5 May 2020 11:36:47 +0000

On Wed, Apr 15, 2020 at 11:49:55AM -0400, Jay Borkenhagen wrote:
> Job Snijders writes:
>  > On Wed, Apr 15, 2020, at 12:46, Martin Hoffmann wrote:
>  > > An attacker who can delete files can as easily replace them with
>  > > something else with the same result. So I am not sure the added code
>  > > complexity is worth it.
>  > 
>  > Agreed. 
>  > 
>  > fwiw: rpki-client runs as "openrsync -rlt --delete rsync://xxx/repository xxx/repository"
>  > 
> 
> I agree with this behavior as well.

I think I was wrong to agree here. I had discussions with some people
about 'where does the publication point exist?' - is it a remote entity?
or is a local construction of pulled data? I'm now leaning more towards
an interpretation that the publication point only exists in the mind of
the RP.

Phrased differently: It seems somewhat strange to let unauthenticated
untrusted network data (aka 'rsync --delete') destroy an otherwise
perfectly healthy and valid CA.

What perhaps should be done:

- rsync pulls data in (without '--delete')
- the validation process deletes files that are not listed on the valid
  manifest (iff a valid contemporaneous CRL exists)
- Additionally, implementers will need to pull the untrusted RPKI data
  into a staging area, to guard against letting the rsync overwrite
  otherwise healthy .roa files with garbage.

Kind regards,

Job

---

From: Stephen Kent <[email-masked]>
Date: Tue, 5 May 2020 11:49:08 -0400

Job,
> ...

4.2 of RFC 6480 says:

    For every certificate in the PKI, there will be a corresponding file
    system directory in the repository that is the authoritative
    publication point for all objects (certificates, CRLs, ROAs, and
    manifests) verifiable via this certificate.

It goes on to note that the publication point is identified by the SIA 
(URI) in a CA cert.

4.8.8 of RFC 6487  reiterates this characterization of a pub point being 
identified by the SIA in a CA cert.

So, I believe that a pub point is a location in the repository system 
where a CA publishes signed objects.

I'm not commenting on the rest of your analysis, just this definition.

Steve