Certificate Profile and Certificate Management for SEcure Neighbor Discovery (SEND)
RFC 6494
Document | Type |
RFC - Proposed Standard
(February 2012; Errata)
Updates RFC 3971
|
|
---|---|---|---|
Authors | Roque Gagliano , Ana Kukec , Suresh Krishnan | ||
Last updated | 2020-01-21 | ||
Stream | IETF | ||
Formats | plain text html pdf htmlized with errata bibtex | ||
Reviews | |||
Stream | WG state | WG Document | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 6494 (Proposed Standard) | |
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | Ralph Droms | ||
IESG note | Marcelo Bagnulo (marcelo@it.uc3m.es) is the document shepherd. | ||
Send notices to | (None) |
Internet Engineering Task Force (IETF) R. Gagliano Request for Comments: 6494 Cisco Systems Updates: 3971 S. Krishnan Category: Standards Track Ericsson ISSN: 2070-1721 A. Kukec Enterprise Architects February 2012 Certificate Profile and Certificate Management for SEcure Neighbor Discovery (SEND) Abstract SEcure Neighbor Discovery (SEND) utilizes X.509v3 certificates for performing router authorization. This document specifies a certificate profile for SEND based on resource certificates along with extended key usage values required for SEND. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6494. Copyright Notice Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Gagliano, et al. Standards Track [Page 1] RFC 6494 SEND Certificate Profile and Management February 2012 Table of Contents 1. Introduction ....................................................2 2. Requirements Notation ...........................................3 3. Terminology .....................................................3 4. SEND Certificate Profile ........................................4 4.1. Unconstrained Certified Subnet Prefixes ....................4 5. Deployment Models ...............................................5 6. Trust Anchor Material ...........................................5 7. Extended Key Usage Values .......................................6 8. CRL Profile and Revocation ......................................7 8.1. Online Certificate Status Protocol (OCSP) Considerations ...7 9. Certificate Validation ..........................................8 10. IANA Considerations ............................................8 11. Security Considerations ........................................8 12. Acknowledgements ...............................................8 13. References .....................................................9 13.1. Normative References ......................................9 13.2. Informative References ....................................9 Appendix A. Router Authorization Certificate Example ..............10 Appendix B. ASN.1 Module ..........................................11 1. Introduction SEcure Neighbor Discovery (SEND) [RFC3971] utilizes X.509v3 certificates that include the [RFC3779] extension for IPv6 addresses to certify a router's authorization to advertise the IPv6 prefix for the Neighbor Discovery (ND) protocol. The SEND specification defines a basic certificate profile for SEND. The certificate profile defined in this document supersedes the profile for Router Authorization Certificates specified in [RFC3971]. That is, certificates used in SEND (by routers, proxies, or address owners) MUST conform to this certificate profile and MAY conform to the original profile in [RFC3971]. The Resource Public Key Infrastructure (RPKI) is the global PKI that attests to the allocation of IP address space. The RPKI represents the centralized model discussed in Section 6.2 of [RFC3971]. Consequently, SEND will use the RPKI Certificate Profile and certificate validation detailed in [RFC6487]. Consequently, the certificate validation method described in [RFC3971] is updated with the certificate validation method in [RFC6487]. Since the [RFC3779] IPv6 address extension does not mention what functions the node can perform for the certified IPv6 space, it becomes impossible to know the reason for which the certificate wasShow full document text