PKIの標準化動向とリソースPKI

Size: px

Start display at page:

Download "PKIの標準化動向とリソースPKI"

なつきうすい
5 years ago
Views:

1 PKI Day PKI PKI JPNIC

2 RFC5280 PKI RFC5280 PKI RPKI IP RPKI

3 RFC5280 RFC5280 RFC3280 PKI

4 RFC5280

5 RFC5280 1/4 RFC5280 X.509-based PKI X.509CRL published

6 RFC5280 2/ ITU-T IETF (PKIX WG) X X.509v1 X (v2 format) PKIX WG X X.509v3 CRLv RFC2459 X deltacrl, AC RFC3280 X ? OCSP RFC ANSI RFC PEM X X RFC3279 RFC4630 Directory String RFC4325 AIA CRL extn IDN

7 RFC5280 3/4 -PKIX WG RFC 3279 Algorithm ID 3281 Attribute Certificate 3874 SHA Additional ID for RSA 4158 Path building 4476 AC Policy Extension 4491 GOST 5280 Certificate and CRL Profile 3161 Time-Stamp Protocol 3628 Time-Stamping Authority 3709 Logotypes 3739 Qualified Certificate 3779 IP Address and ASN 3820 Proxy Certificate 4334 WLAN 4043 Permanent ID 4059 Warranty Certificate 4683 SIM 4985 Service Name 2585 Operational Protocols 2560 OCSP 5019 Lightweight OCSP 3029 DVCS 3379 DPV/DPD 3494 LDAPv Repository Locator Service 4387 Cert store via http 5055 SCVP 2528 Representation of KEA 2875 DH Proof-of-Possession 3647 CP and CPS 4210 CMP 4211 CRMF 4523 LDAP Schema 5272 CMC 5274 CMC: Compliance Requirement 5273 CMC: Transport Protocol

8 RFC52804/4 1 Introduction 2 RFC Requirements and Assumptions 2 3 Overview of Approach 8 CA 4 Certificate and Certificate Extensions Profile 38 5 CRL and CRL Extensions Profile 17 6 Certification Path Validation 24 7 Processing Rules for Internationalized Names [New] 5 8 Security Considerations 1 PKI 9 IANA Considerations 1 OID

9 RFC3280

10 RFC3280 IDN 7 RFC3490 Internationalizing Domain Names in Applications (IDNA) RFC3987 Internationalized Resource Identifiers (IRIs) RFC4518 Lightweight Directory Access Protocol (LDAP): Internationalized String Preparation Issuer/Subject , UTF8String name rollover privatekeyusageperiod critical critical CRL authority Info. access5.2.7 RFC4325 CRL 5.2, 5.3 holdinstructioncode CRL CP criticality RP6 security consideration8 LDAP string preparation RFC4518

11 IDN 1/2 7 Processing Rules for Internationalized Names

12 IDN 2/2 RFC DN(Distinguished Name) teletexstring, printablestring, universalstring, BMPString, UTF8String UTF8String 2 subjectaltname issueraltname 3 issuer subject IDN 4 IRI Internationalized Resource Identifiers Unicode URI IA5String (ASCII) RFC5280 UTF8String, printablestring teletexstring, BMPString, universalstring CA RFC4518 IA5String RFC3490 ASCII RFC3490 ToASCII RFC3987 ASCII subjectaltname IA5String %XX

13 UTF8 PKI UTF8String IPA JNSA Part 1 UTF8String Part 2 PKI UTF8String Part 3 Part 4 IETF Part 5 UTF8String Part 6 I-D International Strings in Certificate Paul HoffmanIETF-61, 2004/11

14 critical X criticalCA Mapping critical non-critical CP Mapping CPcritical CP

15 (Certificate Policies) CA,EE critical / non-critical OID (Policy Mappings) - CA critical issuerdomainpolicy / subjectdomainpolicy (Policy Constraints) - CA ID requireexplicitpolicy inhibitpolicymapping

16 RFC5280 X.509

17 X.509

18 X.509 RFC Rivest-Shamir-Adelman (RSA) Digital Signature Algorithm (DSA) Elliptic Curve Digital Signature Algorithm (ECDSA) rfc rfc (PKCS#1 Version 1.5) rfc rfc md2withrsaencryption md5withrsaencryption sha-1withrsaencryption sha224withrsaencryption sha256withrsaencryption sha384withrsaencryption sha512withrsaencryption id-dsa-with-sha1 ecdsa-with-sha1 SHA-2 draft RSA Probabilistic Signature Scheme (RSASSA-PSS) rfc RSASSA-PSS-params (SHA-1) GOST R rfc id-gostr with-gostr GOST R rfc id-gostr with-gostr

19 X.509 Subject RFC keyusage Rivest-Shamir- Adelman (RSA) rfc EE: digitalsignature nonrepudiation keyencipherment dataencipherment CA or CRL issuer: digitalsignature nonrepudiation keyencipherment dataencipherment keycertsign crlsign Elliptic Curve Digital Signature Algorithm (ECDSA) Elliptic Curve Diffie-Hellman (ECDH) rfc EE: digitalsignature nonrepudiation keyagreement encipheronly or deciphyeronly CA or CRL Issuer: digitalsignature nonrepudiation keyagreement or keycertsign crlsign

20 X.509 Subject Diffie-Hellman (DH) Key Encryption Algorithm (KEA) RFC rfc rfc keyusage keyagreement encipheronly or decipheronly keyagreement encipheronly or decipheronly

21 X.509 Subject RFC RSA Encryption Scheme - Optimal Asymmetric Encryption Padding (RSAES-OAEP) [PKCS#1 v2.1] rfc SHA-1 (default) (MUST) SHA-224 (MAY) SHA-256 (MAY) SHA-384 (MAY) SHA-512 (MAY) GOST R rfc GOST R GOST R rfc GOST R Elliptic Curve Diffie-Hellman (ECDH) Elliptic Curve Menezes-Qu- Vanstone (ECMQV) rfc rfc rfc SHA-1 SHA-1(?)

22 X.509 RFC MD2 [rfc1319] MD5 [rfc1321] rfc rfc SHA-1 [FIPS180-1] [rfc3174] SHA-224 [PKCS#1 ver1.5] SHA-256 [PKCS#1 ver1.5] SHA-384 [PKCS#1 ver1.5] SHA-512 [PKCS#1 ver1.5] GOST R [GOSTR341194] rfc rfc rfc rfc rfc rfc

23 PKI

24 PKI OID OCSP, DVCS, DPV/DPD, SCVP PKI EV SSL / / CRL?

25 RFC5280 RFC3280

26 PKI

27 PKI PKI IETF SIDR WG RIR

28 PKI

29 PKI BGPIP AS AS AS /24 AS /25

30 PKI IPv4 IP AS LIR LIR IP whois IP IP

31 IP AS

32 IP IP

33 (APNIC) (JPNIC) /8 (JPNIC) (ISP ) /16 ROA Route Origination Authorization ISP AS /24 Authorization AS65535 ((ISP ) ( ) /22

34 (RIPE NCC) (JPNIC) /21 Version: 3 Serial: 3fc2 Issuer: CN=0NzrOpdx0k5_wB44AhMeNzEc0Mk Not Before: :52:32 Bot After: :00:00 Subject: CN=0a8f65ba-d8e b73c-8913ffc731f2 Subject Key Identifier: 22d85f282bdf913326cf29d2149a26d82ac37fe4 Authority Key Identifier: d0dceb3a9771d24e7fc01e e37311cd0c9 Authority Info Access: CA Issuers: URI: rsync://certtest.ripe.net/certrepo/4e/2df8f5-18be b991-d2dde6d19ebb/1/0nzropdx0k5_wb44ahmenzec0mk.cer Subject Info Access: carepository - URI: URI:rsync://certtest.ripe.net/certrepo/16/135b01-8cde aa68-5d517f5e2c1b/1/ithfkcvfktmmzynsfjom2crdf-q.roa CRL Distribution Points: URI:rsync://certtest.ripe.net/certrepo/16/135b01-8cde-4286-aa68-5d517f5e2c1b/1/0NzrOpdx0k5_wB44AhMeNzEc0Mk.crl Certificate Policies: critical sbgp-ipaddrblock: IPv4: /21

35 Origin AS: AS65532 Prefix: /24 ROA Secure BGP ROA Origination

36 LIR IP LIR IP

37 RPKI PKIX Public-Key Infrastructure X.509 WG RFC3779 X.509 Extensions for IP Addresses and AS Identifiers Jun 2004, C. Lynn, S. Kent, K. Seo SIDR Secure Inter-Domain Routing WG An Infrastructure to Support Secure Internet Routing draft-ietf-sidr-arch-06 A Profile for X.509 PKIX Resource Certificates draft-ietf-sidr-res-certs-16 Certificate Policy (CP) for the Resource PKI (RPKI) draft-ietf-sidr-cp-05 A Protocol for Provisioning Resource Certificates draft-ietf-sidr-rescerts-provisioning-04

38 RPKI 1/2 RIR RFC3779 sidr-res-cert-16 sidr-rescertsprovisioning-04 Issue RIR Issue Prototype/beta system in APINC, RIPE NCC, ARIN Protocols: RIR-LIR, RIR-RIR LIR 2008XML repository

39 RPKI 2/2 ROA BOA repository RIPE sidr-rpsl-sig-00 (Kisteleki-sidr-rpsl-sig-00) IRR ROA/BOA IRR

40 BOGON prefix RIR-RIRRIR-NIR

41 RIR

42 RIRCA APNIC ARIN RIPE NCC JPNIC CA (MyAPNIC APNIC (ISC) (2009 LIRPortal ) ( ) crypto-pw mail-from X.509

43 IETF APNIC 2005th 2006th 2007th 2008th 2004 th Jun RFC3779 PKI Mar 1 st SIDR BoF Apr SIDR WG Mar I-D ROA Apr I-D profile I/F Sep/Oct MyAPNIC ARIN RIPE NCC JPNIC Oct CATF CertPROTO RIR Oct Oct

44 APNIC RIPE NCC APNIC MyAPNIC v2.0 RIPE NCC Certtest

45 PKI IP IETF SIDR WG RIR -APNIC RIPE NCC ARIN

46 RFC5280 PKI PKI

/07/ /10/12 I

/07/ /10/12 I Certificate Policy Version 1.10 2018 10 12 1.00 2018/07/24 1.10 2018/10/12 I 1.... 1 1.1... 1 1.2... 1 1.3 PKI... 2 1.3.1 CA... 2 1.3.2 RA... 2 1.3.3... 2 1.3.3.1... 2 1.3.3.2... 3 1.3.4... 3 1.3.5...

PKIの標準化動向と リソースPKI

PKIの標準化動向とリソースPKI