1 APNIC Resource Certification Service Project Routing SIG 7 Sep 2005 APNIC20, Hanoi, Vietnam George Michaelson.

Slides:

Advertisements

Similar presentations

DIGITAL CERTIFICATES Prof. Ravi Sandhu. 2 © Ravi Sandhu PUBLIC-KEY CERTIFICATES reliable distribution of public-keys public-key encryption sender needs.

Advertisements

LACNIC Policy Update Roque Gagliano LACNIC. Current Policies Proposals - LACNIC As a result of the Open Policy Forum at LACNIC XI four policy proposals.

RPKI Standards Activity Geoff Huston APNIC February 2010.

1 IPv6 Allocation Status Report IPv6 Technical SIG 7 Sep 2005 APNIC20, Hanoi, Vietnam Srinivas (Sunny) Chendi.

1 RIR Policy Development Update Policy SIG 8 Sep 2005 APNIC20, Hanoi, Vietnam Save Vocea.

Introduction to IP Addressing & IPv6 Deployment Status.

Local TA Management A TA is a public key and associated data used as the starting point for certificate path validation It need not be a self-signed certificate.

Internet Number Resources 1. Internet IPv4 addresses IPv6 addresses Autonomous System number Fully Qualified Domain Name Key Internet resources.

1 News from APNIC AfriNIC 9 27 November Coming up Some numbers Some service updates Some policy news 2.

Chapter 14 – Authentication Applications

Kerberos and X.509 Fourth Edition by William Stallings

CSCE 815 Network Security Lecture 10 KerberosX.509 February 13, 2003.

Authentication Applications. will consider authentication functions will consider authentication functions developed to support application-level authentication.

Nigel Titley. RIPE 54, 9 May 2007, Tallinn, Estonia. 1 RIPE NCC Certification Task Force Update Presented by Nigel Titley RIPE NCC.

A S I A P A C I F I C N E T W O R K I N F O R M A T I O N C E N T R E IEPG March 2000 APNIC Certificate Authority Status Report.

A S I A P A C I F I C N E T W O R K I N F O R M A T I O N C E N T R E APNIC Open Policy Meeting SIG: Whois Database October 2000 APNIC Certificate Authority.

Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.

CS5204 – Operating Systems 1 Authentication. CS 5204 – Operating Systems2 Authentication Digital signature validation proves:  message was not altered.

1 Change in the Minimum Allocation Criteria Policy Proposal Proposed by Rajesh Chharia, President – ISPAI Presented by Kusumba S Vice President - ISPAI.

RPKI Certificate Policy Stephen Kent, Derrick Kong, Ronald Watro, Karen Seo July 21, 2010.

RPKI and Routing Security ICANN 44 June Today’s Routing Environment is Insecure Routing is built on mutual trust models Routing auditing requires.

An Introduction to Routing Security (and RPKI Tools) Geoff Huston May 2013.

Resource Certificate Profile Geoff Huston, George Michaelson, Rob Loomans APNIC IETF 67.

Validation Algorithms for a Secure Internet Routing PKI David Montana Mark Reynolds BBN Technologies.

Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

Resource PKI: Certificate Policy & Certification Practice Statement Dr. Stephen Kent Chief Scientist - Information Security.

Securing the Border Gateway Protocol (S-BGP) Dr. Stephen Kent Chief Scientist - Information Security.

Some Lessons Learned from Designing the Resource PKI Geoff Huston Chief Scientist, APNIC May 2007.

APNIC Trial of Certification of IP Addresses and ASes RIPE 52 Plenary George Michaelson Geoff Huston.

Resource Certificate Profile SIDR WG Meeting IETF 66, July 2006 draft-ietf-sidr-res-certs-01 Geoff Huston Rob Loomans George Michaelson.

A S I A P A C I F I C N E T W O R K I N F O R M A T I O N C E N T R E 36th RIPE Meeting Budapest 2000 APNIC Certificate Authority Status Report.

A PKI For IDR Public Key Infrastructure and Number Resource Certification AUSCERT 2006 Geoff Huston Research Scientist APNIC.

Progress Report on resource certification February 2007 Geoff Huston Chief Scientist APNIC.

Progress Report on APNIC Trial of Certification of IP Addresses and ASes APNIC 22 September 2006 Geoff Huston.

The Resource Public Key Infrastructure Geoff Huston APNIC.

14 May 2002© TrueTrust Ltd1 Privilege Management in X.509(2000) David W Chadwick BSc PhD.

A PKI for IP Address Space and AS Numbers Stephen Kent.

APNIC eLearning: Intro to RPKI 10 December :30 PM AEST Brisbane (UTC+10)

1 San Diego, California 25 February Securing Routing: RPKI Overview Mark Kosters Chief Technology Officer.

RPKI Tutorial Andy Newton Chief Engineer, ARIN. Agenda Resource Public Key Infrastructure(RPKI) Route Origin Authorizations (ROAs) Certificate Authorities.

1 IPv6 Address Space Management Report of IPv6 Registry Simulation Policy SIG 1 Sept 2004 APNIC18, Nadi, Fiji Geoff Huston.

APNIC Policy Update 1 st TWNIC Open Policy Meeting 3 December, 2003 Taipei, Taiwan.

Using Resource Certificates Progress Report on the Trial of Resource Certification October 2006 Geoff Huston Chief Scientist APNIC.

Using Resource Certificates Progress Report on the Trial of Resource Certification October 2006 Geoff Huston APNIC.

A Brief Overview of draft-ietf-sidr-cp-01.txt draft-ietf-sidr-cps-rirs-01.txt draft-ietf-sidr-cps-isp-00.txt Steve Kent BBN Technologies.

IST E-infrastructure shared between Europe and Latin America ULAGrid Certification Authority Vanessa Hamar Universidad de Los.

Using Resource Certificates Progress Report on the Trial of Resource Certification November 2006 Geoff Huston APNIC.

1 Madison, Wisconsin 9 September14. 2 Security Overlays on Core Internet Protocols – DNSSEC and RPKI Mark Kosters ARIN Engineering.

Updates to the RPKI Certificate Policy I-D Steve Kent BBN Technologies.

Cryptography and Network Security Chapter 14 Fourth Edition by William Stallings Lecture slides by Lawrie Brown.

1 IP Address Space Transfer between Existing Taiwan LIRs Dr. Ching-Heng Ku, TWNIC Policy SIG, APNIC 20, Hanoi, Vietnam September 8, 2005.

APNIC Security Update APSIRCC 2002 Tokyo, 25 March 2002.

IP Addressing and ICT Development in the Pacific Islands Anne Lord and Save Vocea, APNIC ICT Workshop, Fiji, November, 2002.

1 APNIC Trial of Certification of IP Addresses and ASes RIPE October 2005 Geoff Huston.

Status Report SIDR and Origination Validation Geoff Huston SIDR WG, IETF 71 March 2008.

News from APNIC German Valdez Communications Area Manager RIPE October 2008.

CSCE 715: Network Systems Security Chin-Tser Huang University of South Carolina.

November 2006 Geoff Huston APNIC

Cryptography and Network Security

APNIC Trial of Certification of IP Addresses and ASes

APNIC Trial of Certification of IP Addresses and ASes

IPv6 Address Space Management Report of IPv6 Registry Simulation

Resource Certificate Profile

IPv6 Address Space Management Report of IPv6 Registry Simulation

Progress Report on Resource Certification

Resource Certificate Profile SIDR WG Meeting IETF 66, July 2006

News from APNIC ARIN XXII 16 October 2008.

Policy SIG 8 Sep 2005 APNIC20, Hanoi, Vietnam Save Vocea

Presentation transcript:

1 APNIC Resource Certification Service Project Routing SIG 7 Sep 2005 APNIC20, Hanoi, Vietnam George Michaelson

2 Overview Motivation Objectives RFC3779 summary Certificate format Project phases Deliverables Q & A

3 Motivation Routing security has become critical in the operation of the Internet Vital need for (automatic) AS/route validity checks RFC3779 has been created to address this problem Defines extension to the X.509 certificate format for IP addresses & AS number The RFC specifies that the certification authority hierarchy should follow the IP address and AS delegation hierarchy Follows IANA -> RIR ->LIR And all their downstream delegations

4 Objectives This project establishes a new APNIC service to provide Issuance of RFC3779 compliant certificates to APNIC members Policy and technical infrastructure necessary to deploy and use the certificates by the routing community and general public CPS (Certification practice statement) Certificate repository CRL (Certificate revocation list) Tools and examples (open source) for downstream certification by NIR, LIR and ISP

5 RFC3779 summary Abstract This document defines two X.509 v3 certificate extensions The first binds a list of IP address blocks, or prefixes, to the subject of a certificate The second binds a list of autonomous system identifiers to the subject of a certificate These extensions may be used to convey the authorization of the subject to use the IP addresses and autonomous system identifiers contained in the extensions

6 RFC3779 summary The certificate chain will reflect the delegation hierarchy, from IANA down to the end users IANA RIR NIR ISP End user RIR ISP LIR ISP End user ISP End user

7 Certificate format SERIAL NUMBER v3 C=AU, O=APNIC VERSION SIGNATURE ALGORITHM RSA with SHA-1 ISSUER VALIDITY 1/1/05 - 1/1/06 SUBJECT C=AU, O=EXAMPLE-AU CN=Examplenet Pty Ltd SUBJECT PUBLIC KEY INFO RSA, ISSUER UNIQUE ID ACBDEFGH SUBJECT UNIQUE ID RSTUVWXY EXTENSIONS SIGNATURE KeyUsage (critical if CA) digitalSignature, keyCertSign, and cRLSign IP address / / :14C0::/32 AS identifier AS123 – AS124 Cert Policies OIDs Basic constraints CA bit ON – Allocations CA bit OFF – Assignments

8 Project phases Trial – 4Q 2005 Early adopters, s/w developers, router designers Major requirement changes allowed Certificate formats may change Pilot – 1Q 2006 Input from trial used to test service Wider deployment Minor requirement changes allowed Certificate format should be stable Full service – 2Q 2006 General service availability Full policy and procedures in place

9 Deliverables Phase 1 – trial RFC3779 compliant certificates issued to selected members Tools and utilities (open source) Requesting certificates Issuing downstream certificates Certificate validation tools –Both online and offline Experiences/Outcomes to be presented at next AMM in Routing SIG May lead to policy proposals

10 Q & A FAQ Router community participation? Discussed with Cisco, Juniper, actively seeking participation of other BGP coders in tests Certificate lifetimes? Have to be tied to membership/relationship. Considering options for longer lifetimes subject to suitable agreements APNIC certify LIR sub-delegations? NO. Only warrant relationship with LIR, existance of resource allocation to that LIR from APNIC

11 Questions? Thank you!