Subject: KMF Certificate Validation Enhancements [PSARC/2010/269 FastTrack timeout 07/21/2010] To: PSARC-ext@Sun.Com Cc: kmf-discuss@opensolaris.org Bcc: one-pager-list@sac.sfbay one-pager-log@sac.sfbay sac-bar@sac.sfbay Template Version: @(#)sac_nextcase 1.70 03/30/10 SMI This information is Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. 1. Introduction 1.1. Project/Component Working Name: KMF Certificate Validation Enhancements 1.2. Name of Document Author/Supplier: Author: Wyllys Ingersoll 1.3 Date of This Document: 14 July, 2010 4. Technical Description Project: KMF Certificate Validation Enhancements Submitter/Owner: Wyllys Ingersoll Release Binding: Micro/Patch Description: This project proposes some minor changes to the KMF policy engine when doing certificate validation. Currently, the KMF policy definition requires that a policy be configured which explicitly identifies a trust anchor(*) for doing certificate validation. The trust anchor certificate is uniquely identified by its Subject DN (distinguished name) and serial number. In practice, however, it is more correct (and easier to administer) to just have the KMF policy engine search for a certificate's parent by looking for a certificate with the SubjectName equal to the IssuerName of the certificate being validated. * The term "trust anchor" is not entirely accurate in this context. The KMF engine does not support following an entire chain of certificates to find the "root" (trust anchor), but rather just uses the direct parent of a certificate to perform the signature validation. Full PKIX (RFC 5280) path validation is a much more ambitious undertaking and is not in the budget at this time, nor have we had any customer requests for it. This project proposes allowing the "ta-name" value to be indicated as "SEARCH" to make the KMF policy engine search for a matching issuer certificate instead of explicitly naming one. This project also proposes modifying the default KMF policy defined in /etc/security/kmfpolicy.xml to use the new "SEARCH" value instead of ignoring the trust anchor check altogether. We are also removing the "ignore-date=TRUE" option from the default policy. NEW DEFAULT KMF POLICY: The only API affected by this change is the "kmf_validate_cert" function and currently there are no consumers of this API in the ON consolidation. There is a project in development (CR 6357779 SSHv2 x.509 support desired) that depends on this change in order for it to properly validate certificates. Documentation: The manpage for kmfcfg will be modified as follows: --- kmfcfg.1 Tue Jul 13 12:43:25 2010 +++ kmfcfg.1.new Tue Jul 13 12:56:30 2010 @@ -44,7 +44,7 @@ [ignore-unknown-eku=true|false] [ignore-trust-anchor=true|false] [validity-adjusttime=adjusttime] - [ta-name=trust anchor subject DN] + [ta-name=trust anchor subject DN | search] [ta-serial=trust anchor serial number] [ocsp-responder=URL] [ocsp-proxy=URL] @@ -333,8 +333,36 @@ User Commands kmfcfg(1) + ta-name= trust anchor subject DN | search + ta-name identifies the trust anchor to be used to + validate a certificate. The KMF policy engine does not + do full PKIX path validation, but rather just treats the + trust anchor as if it were the parent of the certificate + being validate. + If an explicit Subject DN is given, it must be combined + with a ta-serial value (see below) in order to uniquely + identify the certificate to use. Also, the certificate + identified must be available in the keystore that is selected. + + If the value "search" is used instead of an explicit + subject and serial number, then the KMF policy engine will + attempt to locate a certificate that matches the issuer name + of the certificate being validated and use that for the + validation. + + If "search" is used, the "ta-serial" value is ignored. + + ta-serial=trust anchor serial number + + If the "ta-name" is given as an explicit subject name, then + the serial number of that certificate must be indicated in + the "ta-serial" value. The serial number must be + represented in hexadecimal form. + Example: + ta-serial=0x01020a0b + validity-adjusttime=adjusttime Set the adjust time for both ends of validity period @@ -517,7 +545,7 @@ [ignore-unknown-eku=true|false] [ignore-trust-anchor=true|false] [validity-adjusttime=adjusttime] - [ta-name=trust anchor subject DN] + [ta-name=trust anchor subject DN | search] [ta-serial=trust anchor serial number] 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: ON 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open