From wyllys@sac.sfbay.sun.com Tue May 18 13:17:15 2010 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o4IKHFxY024329 for ; Tue, 18 May 2010 13:17:15 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail2sca.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o4IKHFrh000394; Tue, 18 May 2010 13:17:15 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L2M00201TOQJI00@nwk-avmta-2.sfbay.sun.com>; Tue, 18 May 2010 13:17:14 -0700 (PDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L2M001FRTOQXZ00@nwk-avmta-2.sfbay.sun.com>; Tue, 18 May 2010 13:17:14 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.4) with ESMTP id o4IKHDx7027687; Tue, 18 May 2010 13:17:13 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o4IKHBsq024324; Tue, 18 May 2010 13:17:11 -0700 (PDT) Received: (from wyllys@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id o4IKHBVw024320; Tue, 18 May 2010 13:17:11 -0700 (PDT) Date: Tue, 18 May 2010 13:17:11 -0700 (PDT) From: Wyllys Ingersoll Subject: KMF Common Name Mapper [PSARC/2010/178 FastTrack timeout 05/25/2010] To: PSARC-ext@sun.com Cc: jan.pechanec@sun.com Message-id: <201005182017.o4IKHBVw024320@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 4656 Template Version: @(#)sac_nextcase 1.70 03/30/10 SMI This information is Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. 1. Introduction 1.1. Project/Component Working Name: KMF Common Name Mapper 1.2. Name of Document Author/Supplier: Author: Jan Pechanec 1.3 Date of This Document: 18 May, 2010 4. Technical Description KMF Common Name (CN) Mapper =========================== This case introduces the first KMF certificate to name mapper. The KMF certificate to name mapping framework is defined in the "Certificate to name mapping extension to the Key Management Framework" ARC case. Interface --------- The CN mapper is a very simple one and maps a certificate to its value from the Common Name attribute. All other certificate attributes are ignored. The mapper presumes that the Common Name values are unique in the given domain. The Common Attribute has OID 2.5.4.3 (joint-iso-ccitt(2) ds(5) id-at(4) id-at-commonName(3)) as defined in "RFC 2459: Internet X.509 Public Key Infrastructure Certificate and CRL Profile". The mapper accepts only one option, the "casesensitive" option which defaults to false. If set, the kmf_match_cert_to_name() function will honor the case sensitivity when comparing the mapped name with the name provided. The option has no effect on the kmf_map_cert_to_name() function. Example ------- The following certificate will be mapped to the string "janp". Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: sha1WithRSAEncryption Issuer: CN=authority Validity Not Before: Mar 26 16:57:00 2010 GMT Not After : Mar 26 16:57:00 2011 GMT Subject: CN=CZ, CN=janp Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:c5:fd:b7:97:f5:34:83:f8:39:c4:0f:b7:a0:9c: .. .. b8:32:99:5d:30:6d:08:5a:05 Exponent: 65537 (0x10001) Signature Algorithm: sha1WithRSAEncryption 4f:f3:28:0d:c3:7c:62:c7:44:71:a3:82:cf:db:07:22:f8:63: .. .. c7:ae:2b:06:92:fa:cc:ce:fc:67:df:0e:eb:58:b1:4d:c6:eb: 35:24 Relevant CRs ------------ 6949176 KMF cert-to-name mapping framework needs a CN mapper Documentation ------------- 6953338 libkmf(3lib) will need an update after the delivery of the CN mapper The suggested fix is the following one: --- libkmf.3lib Tue May 18 10:20:37 2010 +++ libkmf.3lib.new Tue May 18 21:51:56 2010 @@ -97,6 +97,45 @@ kmf_verify_csr kmf_verify_data kmf_verify_policy +NOTES + Certificate to name mapping + + KMF provides a means to map a certificate to a name + according to the configuration from the policy database + or through the mapping initialization function. The + functions that provide the mapping functionality are + kmf_cert_to_name_mapping_initialize, + kmf_cert_to_name_mapping_finalize, kmf_map_cert_to_name, + kmf_match_cert_to_name, and kmf_get_mapper_error_str. KMF + provides different types of mapping through shared + objects called mappers. Supported mappers are: + + cn The CN mapper maps a certificate to its value + from the Common Name attribute. All other + certificate attributes are ignored. The mapper + should be used in domains where the Common + Name values are unique within the particular + domain. + + The mapper accepts only one option, the + "casesensitive" option which defaults to + false. If set, the kmf_match_cert_to_name() + function will honor the case sensitivity when + comparing the mapped name with the name + provided. The option has no effect on the + kmf_map_cert_to_name() function. + +EXAMPLES + + Example 1 Configuring the certificate to name mapping. + + The following configures the default certificate to name + mapping to use the CN mapper while ignoring the case + sensitivity when matching the certificates. + + $ kmfcfg modify policy=default mapper-name=cn \ + mapper-options=casesensitive + FILES /lib/libkmf.so.1 shared object Interface stability ------------------- Volatile. 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Darren.Moffat@oracle.com Wed May 26 03:46:23 2010 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id o4QAkNOb026307 for ; Wed, 26 May 2010 03:46:23 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.4) with ESMTP id o4QAkH0m015091; Wed, 26 May 2010 04:46:22 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0L3000E0JWL9DE00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 26 May 2010 03:46:21 -0700 (PDT) Received: from sca-ea-mail-3.sun.com ([192.18.43.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0L300058YWL91VA0@nwk-avmta-1.sfbay.Sun.COM>; Wed, 26 May 2010 03:46:21 -0700 (PDT) Received: from acsinet15.oracle.com (acsinet15.oracle.com [141.146.126.227]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id o4QAkK1V005990; Wed, 26 May 2010 10:46:20 +0000 (GMT) Received: from acsmt355.oracle.com (acsmt355.oracle.com [141.146.40.155]) by acsinet15.oracle.com (Switch-3.4.2/Switch-3.4.1) with ESMTP id o4Q1Hl3S004346; Wed, 26 May 2010 10:46:17 +0000 (GMT) Received: from abhmt002.oracle.com by acsmt355.oracle.com with ESMTP id 299019271274870674; Wed, 26 May 2010 03:44:34 -0700 Received: from [10.7.251.221] (/10.7.251.221) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 26 May 2010 03:44:33 -0700 Date: Wed, 26 May 2010 11:44:31 +0100 From: Darren J Moffat Subject: PSARC 2010/178 KMF Common Name Mapper To: PSARC-ext@sun.com, Jan Pechanec Message-id: <4BFCFB8F.2060709@Oracle.COM> Organization: Oracle Solaris Security MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Source-IP: acsmt355.oracle.com [141.146.40.155] X-Auth-Type: Internal IP X-CT-RefId: str=0001.0A090201.4BFCFBFC.0054:SCFMA4539814,ss=1,fgs=0 User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9.1.8) Gecko/20100412 Lightning/1.0b1 OracleBeehiveExtension/1.0.0.0pre3 Thunderbird/3.0.3 Status: RO Content-Length: 198 I'm happy with the technical content of this case so it gets my +1 on the understanding that the project team will be delivering this with PSARC/2010/177 on which it depends. -- Darren J Moffat