Certificate Profile and Certificate Management for SEcure Neighbor Discovery (SEND)
RFC 6494
| Document | Type |
RFC - Proposed Standard
(February 2012; Errata)
Updates RFC 3971
|
|
|---|---|---|---|
| Last updated | 2015-10-14 | ||
| Stream | IETF | ||
| Formats | plain text pdf html bibtex | ||
| Stream | WG state | WG Document | |
| Document shepherd | No shepherd assigned | ||
| IESG | IESG state | RFC 6494 (Proposed Standard) | |
| Consensus Boilerplate | Unknown | ||
| Telechat date | |||
| Responsible AD | Ralph Droms | ||
| IESG note | Marcelo Bagnulo (marcelo@it.uc3m.es) is the document shepherd. | ||
| Send notices to | (None) | ||
Internet Engineering Task Force (IETF) R. Gagliano
Request for Comments: 6494 Cisco Systems
Updates: 3971 S. Krishnan
Category: Standards Track Ericsson
ISSN: 2070-1721 A. Kukec
Enterprise Architects
February 2012
Certificate Profile and Certificate Management for
SEcure Neighbor Discovery (SEND)
Abstract
SEcure Neighbor Discovery (SEND) utilizes X.509v3 certificates for
performing router authorization. This document specifies a
certificate profile for SEND based on resource certificates along
with extended key usage values required for SEND.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc6494.
Copyright Notice
Copyright (c) 2012 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Gagliano, et al. Standards Track [Page 1]
RFC 6494 SEND Certificate Profile and Management February 2012
Table of Contents
1. Introduction ....................................................2
2. Requirements Notation ...........................................3
3. Terminology .....................................................3
4. SEND Certificate Profile ........................................4
4.1. Unconstrained Certified Subnet Prefixes ....................4
5. Deployment Models ...............................................5
6. Trust Anchor Material ...........................................5
7. Extended Key Usage Values .......................................6
8. CRL Profile and Revocation ......................................7
8.1. Online Certificate Status Protocol (OCSP) Considerations ...7
9. Certificate Validation ..........................................8
10. IANA Considerations ............................................8
11. Security Considerations ........................................8
12. Acknowledgements ...............................................8
13. References .....................................................9
13.1. Normative References ......................................9
13.2. Informative References ....................................9
Appendix A. Router Authorization Certificate Example ..............10
Appendix B. ASN.1 Module ..........................................11
1. Introduction
SEcure Neighbor Discovery (SEND) [RFC3971] utilizes X.509v3
certificates that include the [RFC3779] extension for IPv6 addresses
to certify a router's authorization to advertise the IPv6 prefix for
the Neighbor Discovery (ND) protocol. The SEND specification defines
a basic certificate profile for SEND. The certificate profile
defined in this document supersedes the profile for Router
Authorization Certificates specified in [RFC3971]. That is,
certificates used in SEND (by routers, proxies, or address owners)
MUST conform to this certificate profile and MAY conform to the
original profile in [RFC3971].
The Resource Public Key Infrastructure (RPKI) is the global PKI that
attests to the allocation of IP address space. The RPKI represents
the centralized model discussed in Section 6.2 of [RFC3971].
Consequently, SEND will use the RPKI Certificate Profile and
certificate validation detailed in [RFC6487]. Consequently, the
certificate validation method described in [RFC3971] is updated with
the certificate validation method in [RFC6487].
Show full document text