< draft-ietf-sidrops-aspa-profile-04.txt		draft-ietf-sidrops-aspa-profile-05.txt >
	Network Working Group A. Azimov		Network Working Group A. Azimov
	Internet-Draft Yandex		Internet-Draft Yandex
	Intended status: Standards Track E. Uskov		Intended status: Standards Track E. Uskov
	Expires: May 6, 2021 JetLend		Expires: August 26, 2021 JetLend
	R. Bush		R. Bush
	Internet Initiative Japan		Internet Initiative Japan
	K. Patel		K. Patel
	Arrcus		Arrcus
	J. Snijders		J. Snijders
	NTT		NTT
	R. Housley		R. Housley
	Vigil Security		Vigil Security
	November 2, 2020		February 22, 2021
	A Profile for Autonomous System Provider Authorization		A Profile for Autonomous System Provider Authorization
	draft-ietf-sidrops-aspa-profile-04		draft-ietf-sidrops-aspa-profile-05
	Abstract		Abstract
	This document defines a standard profile for Autonomous System		This document defines a standard profile for Autonomous System
	Provider Authorization in the Resource Public Key Infrastructure. An		Provider Authorization in the Resource Public Key Infrastructure. An
	Autonomous System Provider Authorization is a digitally signed object		Autonomous System Provider Authorization is a digitally signed object
	that provides a means of verifying that a Customer Autonomous System		that provides a means of verifying that a Customer Autonomous System
	holder has authorized members of Provider set to be its upstream		holder has authorized members of Provider set to be its upstream
	providers and for the Providers to send prefixes received from the		providers and for the Providers to send prefixes received from the
	Customer Autonomous System in all directions including providers and		Customer Autonomous System in all directions including providers and
	skipping to change at page 2, line 10 ¶		skipping to change at page 2, line 10 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.		Drafts is at https://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on May 6, 2021.		This Internet-Draft will expire on August 26, 2021.
	Copyright Notice		Copyright Notice
	Copyright (c) 2020 IETF Trust and the persons identified as the		Copyright (c) 2021 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(https://trustee.ietf.org/license-info) in effect on the date of		(https://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	carefully, as they describe your rights and restrictions with respect		carefully, as they describe your rights and restrictions with respect
	to this document. Code Components extracted from this document must		to this document. Code Components extracted from this document must
	include Simplified BSD License text as described in Section 4.e of		include Simplified BSD License text as described in Section 4.e of
	the Trust Legal Provisions and are provided without warranty as		the Trust Legal Provisions and are provided without warranty as
	skipping to change at page 4, line 12 ¶		skipping to change at page 4, line 12 ¶
	This rule is important to avoid possible race conditions during		This rule is important to avoid possible race conditions during
	updates. An ASPA is formally defined as:		updates. An ASPA is formally defined as:
	ct-ASPA CONTENT-TYPE ::=		ct-ASPA CONTENT-TYPE ::=
	{ ASProviderAttestation IDENTIFIED BY id-ct-ASPA }		{ ASProviderAttestation IDENTIFIED BY id-ct-ASPA }
	id-ct-ASPA OBJECT IDENTIFIER ::= { id-ct TBD }		id-ct-ASPA OBJECT IDENTIFIER ::= { id-ct TBD }
	ASProviderAttestation ::= SEQUENCE {		ASProviderAttestation ::= SEQUENCE {
	version [0] ASPAVersion DEFAULT v0,		version [0] ASPAVersion DEFAULT v0,
	AFI AddressFamilyIdentifier,		aFI AddressFamilyIdentifier,
	customerASID ASID,		customerASID ASID,
	providerASSET SEQUENCE (SIZE(1..MAX)) OF ASID }		providerASSET SEQUENCE (SIZE(1..MAX)) OF ASID }
	ASPAVersion ::= INTEGER { v0(0) }		ASPAVersion ::= INTEGER { v0(0) }
	AddressFamilyIdentifier ::= OCTET STRING (SIZE (2..3))		AddressFamilyIdentifier ::= OCTET STRING (SIZE (2))
	ASID ::= INTEGER		ASID ::= INTEGER
	Note that this content appears as the eContent within the		Note that this content appears as the eContent within the
	encapContentInfo as specified in [RFC6488].		encapContentInfo as specified in [RFC6488].
	3.1. version		3.1. version
	The version number of the ASProviderAttestation MUST be v0.		The version number of the ASProviderAttestation MUST be v0.
	skipping to change at page 6, line 4 ¶		skipping to change at page 6, line 4 ¶
	validation checks specified in [RFC6488] as well as the following		validation checks specified in [RFC6488] as well as the following
	additional ASPA-specific validation step.		additional ASPA-specific validation step.
	o The autonomous system identifier delegation extension [RFC3779] is		o The autonomous system identifier delegation extension [RFC3779] is
	present in the end-entity (EE) certificate (contained within the		present in the end-entity (EE) certificate (contained within the
	ASPA), and the customer AS number in the ASPA is contained within		ASPA), and the customer AS number in the ASPA is contained within
	the set of AS numbers specified by the EE certificate's autonomous		the set of AS numbers specified by the EE certificate's autonomous
	system identifier delegation extension.		system identifier delegation extension.
	5. ASN.1 Module for the ASPA Content Type		5. ASN.1 Module for the ASPA Content Type
	RPKI-ASPA-2018		RPKI-ASPA-2020
	{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)		{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
	pkcs-9(9) smime(16) modules(0) id-mod-rpki-aspa-2018(TBD2) }		pkcs-9(9) smime(16) modules(0) id-mod-rpki-aspa-2020(TBD2) }
	DEFINITIONS IMPLICIT TAGS ::=		DEFINITIONS IMPLICIT TAGS ::=
	BEGIN		BEGIN
	IMPORTS		IMPORTS
	CONTENT-TYPE		CONTENT-TYPE
	FROM CryptographicMessageSyntax-2010 -- RFC 6268		FROM CryptographicMessageSyntax-2010 -- RFC 6268
	{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)		{ iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
	pkcs-9(9) smime(16) modules(0) id-mod-cms-2009(58) } ;		pkcs-9(9) smime(16) modules(0) id-mod-cms-2009(58) } ;
	ContentSet CONTENT-TYPE ::= { ct-ASPA, ... }		ContentSet CONTENT-TYPE ::= { ct-ASPA, ... }
	--		--
	-- ASPA Content Type		-- ASPA Content Type
	--		--
	id-smime OBJECT IDENTIFIER ::= { iso(1) member-body(2)		id-smime OBJECT IDENTIFIER ::= { iso(1) member-body(2)
	us(840) rsadsi(113549) pkcs(1) pkcs-9(9) 16 }		us(840) rsadsi(113549) pkcs(1) pkcs-9(9) 16 }
	id-ct OBJECT IDENTIFIER ::= { id-smime 1 }		id-ct OBJECT IDENTIFIER ::= { id-smime 1 }
	id-ct-ASPA OBJECT IDENTIFIER ::= { id-ct TBD }		id-ct-ASPA OBJECT IDENTIFIER ::= { id-ct TBD }
	ct-ASPA CONTENT-TYPE ::=		ct-ASPA CONTENT-TYPE ::=
	{ TYPE ASProviderAttestation IDENTIFIED BY id-ct-ASPA }		{ TYPE ASProviderAttestation IDENTIFIED BY id-ct-ASPA }
	ASProviderAttestation ::= SEQUENCE {		ASProviderAttestation ::= SEQUENCE {
	version [0] ASPAVersion DEFAULT v0,		version [0] ASPAVersion DEFAULT v0,
	AFI AddressFamilyIdentifier,		aFI AddressFamilyIdentifier,
	customerASID ASID,		customerASID ASID,
	providerASSET SEQUENCE (SIZE(1..MAX)) OF ASID }		providerASSET SEQUENCE (SIZE(1..MAX)) OF ASID OPTIONAL }
	ASPAVersion ::= INTEGER { v0(0) }		ASPAVersion ::= INTEGER { v0(0) }
	AddressFamilyIdentifier ::= INTEGER		AddressFamilyIdentifier ::= OCTET STRING (SIZE (2))
	ASID ::= INTEGER		ASID ::= INTEGER
	END		END
	6. IANA Considerations		6. IANA Considerations
	Please add the id-mod-rpki-aspa-2018 to the SMI Security for S/MIME		Please add the id-mod-rpki-aspa-2018 to the SMI Security for S/MIME
	Module Identifier (1.2.840.113549.1.9.16.0) registry		Module Identifier (1.2.840.113549.1.9.16.0) registry
	(https://www.iana.org/assignments/smi-numbers/smi-		(https://www.iana.org/assignments/smi-numbers/smi-
	numbers.xml#security-smime-0) as follows:		numbers.xml#security-smime-0) as follows:
	Decimal | Description | Specification		Decimal | Description | Specification
	-----------------------------------------------------------		-----------------------------------------------------------
	TBD2 | id-mod-rpki-aspa-2018 | [ThisRFC]		TBD2 | id-mod-rpki-aspa-2020 | [ThisRFC]
	Please add the ASPA to the SMI Security for S/MIME CMS Content Type		Please add the ASPA to the SMI Security for S/MIME CMS Content Type
	(1.2.840.113549.1.9.16.1) registry (https://www.iana.org/assignments/		(1.2.840.113549.1.9.16.1) registry (https://www.iana.org/assignments/
	smi-numbers/smi-numbers.xml#security-smime-1) as follows:		smi-numbers/smi-numbers.xml#security-smime-1) as follows:
	Decimal | Description | Specification		Decimal | Description | Specification
	-----------------------------------------------------------		-----------------------------------------------------------
	TBD | id-ct-ASPA | [ThisRFC]		TBD | id-ct-ASPA | [ThisRFC]
	Please add the ASPA to the RPKI Signed Object registry		Please add the ASPA to the RPKI Signed Object registry
	skipping to change at page 7, line 43 ¶		skipping to change at page 7, line 43 ¶
	registries, the ASPA records SHOULD be kept identical in all		registries, the ASPA records SHOULD be kept identical in all
	registries.		registries.
	8. Acknowledgments		8. Acknowledgments
	9. References		9. References
	9.1. Normative References		9.1. Normative References
	[IANA-AF] IANA, "Address Family Numbers",		[IANA-AF] IANA, "Address Family Numbers",
	<http://www.iana.org/numbers.html>.		<https://www.iana.org/assignments/address-family-numbers/
			address-family-numbers.xhtml>.
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119,		Requirement Levels", BCP 14, RFC 2119,
	DOI 10.17487/RFC2119, March 1997,		DOI 10.17487/RFC2119, March 1997,
	<https://www.rfc-editor.org/info/rfc2119>.		<https://www.rfc-editor.org/info/rfc2119>.
	[RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP		[RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP
	Addresses and AS Identifiers", RFC 3779,		Addresses and AS Identifiers", RFC 3779,
	DOI 10.17487/RFC3779, June 2004,		DOI 10.17487/RFC3779, June 2004,
	<https://www.rfc-editor.org/info/rfc3779>.		<https://www.rfc-editor.org/info/rfc3779>.
End of changes. 25 change blocks.
	35 lines changed or deleted		36 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/