< draft-belyavskiy-certificate-limitation-policy-03.txt   draft-belyavskiy-certificate-limitation-policy-04.txt >
Network Working Group Network Working Group
Internet-Draft TCI Internet-Draft TCI
Intended status: Experimental July 23, 2017 Intended status: Experimental September 11, 2017
Expires: January 24, 2018 Expires: March 15, 2018
Certificate Limitation Policy Certificate Limitation Policy
draft-belyavskiy-certificate-limitation-policy-03 draft-belyavskiy-certificate-limitation-policy-04
Abstract Abstract
The document provides a specification of the application-level trust The document provides a specification of the application-level trust
model. Being provided at the application level, the limitations of model. Being provided at the application level, the limitations of
trust can be distributed separately using cryptographically protected trust can be distributed separately using cryptographically protected
format instead of hardcoding the checks into the application itself. format instead of hardcoding the checks into the application itself.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on January 24, 2018. This Internet-Draft will expire on March 15, 2018.
Copyright Notice Copyright Notice
Copyright (c) 2017 IETF Trust and the persons identified as the Copyright (c) 2017 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
1. Introduction 1. Introduction
Binary trust model standardized as a set of trusted anchors and CRLs/ Binary trust model standardized as a set of trusted anchors and CRLs/
skipping to change at page 4, line 20 skipping to change at page 4, line 20
validityPeriod, days - take minimal value from "native" validity validityPeriod, days - take minimal value from "native" validity
period and specified in the limitation file period and specified in the limitation file
ignoredX509Extensions - list of X.509 extensions of limited ignoredX509Extensions - list of X.509 extensions of limited
certificate that MUST be ignored for the specified certificate certificate that MUST be ignored for the specified certificate
(e.g. EV-indicating extensions) (e.g. EV-indicating extensions)
requiredX509extensions - list of X.509 extensions that MUST be requiredX509extensions - list of X.509 extensions that MUST be
present in the certificate to be trusted. present in the certificate to be trusted.
requiredNativeChecking - list of the CA-provided checks that MUST
be applied
applicationNameConstraints - list of domains allowed to be issued applicationNameConstraints - list of domains allowed to be issued
by this certificate by this certificate
excludedIssueIntermediatory - disallow issuing of the
Intermediatory certificates
The limitations are identified by OIDs The limitations are identified by OIDs
2.3.1. Limitations 2.3.1. Limitations
2.3.1.1. issuedNotAfter 2.3.1.1. issuedNotAfter
When this limitation is present, any certificate matching the entry When this limitation is present, any certificate matching the entry
and issued after the specified date MUST NOT be trusted and issued after the specified date MUST NOT be trusted
2.3.1.2. trustNotAfter 2.3.1.2. trustNotAfter
skipping to change at page 5, line 5 skipping to change at page 5, line 10
2.3.1.4. ignoredX509Extensions 2.3.1.4. ignoredX509Extensions
When this limitation is present, the extensions listed in this When this limitation is present, the extensions listed in this
element should be ignored for the matching certificate. element should be ignored for the matching certificate.
2.3.1.5. requiredX509extensions 2.3.1.5. requiredX509extensions
When this limitation is present, the extensions listed in this When this limitation is present, the extensions listed in this
element should be present for the matching certificate. element should be present for the matching certificate.
2.3.1.6. applicationNameConstraints 2.3.1.6. requiredNativeChecking
When this limitation is present, it specifies that the certificates
issued by this CA SHOULD be checked against CRL and/or OCSP,
depending on contents of the extension.
2.3.1.7. applicationNameConstraints
This limitation are applied like Name Constraints [3] limitation This limitation are applied like Name Constraints [3] limitation
specified in RFC 5280. specified in RFC 5280.
This section implies 2 variants of checks:
The list of names that are allowed for the CA to issue
certificates for
The list of names that are forbidden for the CA to issue
certificates for
2.3.1.7.1. excludedIssueIntermediatory
When this limitation is present, the intermediate certificates issued
by this CA MUST NOT be trusted.
3. Verification of CLP 3. Verification of CLP
The verification of CLP SHOULD be performed by the application. The The verification of CLP SHOULD be performed by the application. The
application should check whether the provided CLP matches the application should check whether the provided CLP matches the
internal requirements and is correclty signed by the specified key. internal requirements and is correclty signed by the specified key.
4. Verification with CLP 4. Verification with CLP
In case of using CLP the checks enforced by CLP should be applied In case of using CLP the checks enforced by CLP should be applied
after the other checks. after the other checks.
skipping to change at page 6, line 39 skipping to change at page 7, line 17
dev/eUAKwjihhBs/rpxMXjZHCQAJ dev/eUAKwjihhBs/rpxMXjZHCQAJ
[2] https://tools.ietf.org/html/rfc5280#section-5 [2] https://tools.ietf.org/html/rfc5280#section-5
[3] https://tools.ietf.org/html/rfc5280#section-4.2.1.10 [3] https://tools.ietf.org/html/rfc5280#section-4.2.1.10
Author's Address Author's Address
Dmitry Belyavskiy Dmitry Belyavskiy
Technical Centre of Internet Technical Centre of Internet
8 Marta str., 1 bld. 12
Moscow 127083
RU
Email: beldmit@gmail.com Email: beldmit@gmail.com
 End of changes. 10 change blocks. 
7 lines changed or deleted 35 lines changed or added

This html diff was produced by rfcdiff 1.45. The latest version is available from http://tools.ietf.org/tools/rfcdiff/