International Civil Aviation Organization working paper



Download 59.64 Kb.
Date16.01.2018
Size59.64 Kb.
#36869



ACP-WGM17/WP-yy





International Civil Aviation Organization


WORKING PAPER

ACP-WGM17/WP-23

31 January 2011










AERONAUTICAL COMMUNICATIONS PANEL (ACP)


16th MEETING OF WORKING GROUP M (Maintenance)
Bangkok, Thailand 31 Jan – 1 Feb 2011



Agenda Item xx:

ATN/OSI Document 9880 Update Status – Security Updates



Amendment Proposal

to

Refer to RFC 5280, 5480 and ATA Spec 42 for Certificate/CRL Profiles

Prepared by: FAA


Presented by: Vic Patel



SUMMARY

This working paper includes draft updates to ICAO Doc 9880 to refer to RFC 5280, 5480 and ATA Spec 42 profiles for Certificates/CRL Profiles. This working paper is an update to (and replaces) WP 12 from Meeting 16.

ACTION

The working group is invited to review Amendment Proposal and consider approving the change to Doc 9880.



  1. INTRODUCTION

    1. One of recommendations of the Honeywell Validation Report (Meeting 16 Working Paper 8) was to follow the Certificate and CRL profiles in ATA Spec 42 and remove the formats specified in Doc 9880.

    2. An initial set of recommended changes were developed; however, it was also recommended that a field-by-field review of Spec 42 and relevant Internet RFCs be conducted. This review is reported in the Honeywell ATN Certificate and CRL Analysis Report.

  2. discussion

    1. This AP proposes using references to Internet RFC 5280, 5480 and ATA Spec 42 Certificate and CRL profiles.

    2. RFC 5280 is a general Certificate and CRL profile of X.509 version 3 Certificates and version 2 CRLs. RFC 5480 specifies the syntax and semantics for certain X.509 certificate fields that support Elliptic Curve Cryptography

    3. Section 4.3 of Doc 9880 specifies the format and allowed content in each field of an ATN Uncompressed Certificate.

    4. Section 4.4 of Doc 9880 specifies the format and allowed content of ATN CRLs.

Amendment Proposal #17-yy

Title:

Refer to RFC 5280, 5480 and ATA Spec 42 for Certificate/CRL Profiles

AP working paper number and date

Original: M16/WP12 17 May 2010

Update: M17/WPyy 31 Jan 2011



Document(s) Affected:

ICAO Dc 9880 Part IV-B

Document Version:

Revised Draft Jan 2011

Sections of Documents Affected:

4.3 4.4

Coordinator:

Vic Patel

Coordinator's Address:

ATO-P, AJP-1740

William J. Hughes Technical Center

Atlantic City Airport, NJ, 08405

USA


Coordinator's Phone:

+1 609 485 5046

Coordinator's Fax:

+1 609 485 5630

Coordinator's E-mail Address:

vidyut.patel@faa.gov

Category:




Problem description:

RFC 5280 is a general Certificate and CRL profile of X.509 version 3 Certificates and version 2 CRLs. RFC 5480 specifies the syntax and semantics for certain X.509 certificate fields that support Elliptic Curve Cryptography.

Background:

Honeywell’s ATN Certificate and CRL Analysis Report contains a field-by-field analysis of DOC 9880 versus RFC 5280 and 5480 profiles.

Backwards compatibility:




Amendment Proposal:

See below.

WG-M Status:

SUBMITTED 1/31/2011


Replace sections 4.3 and 4.4 with the following:




4.3 ATN PKI Certificate Profile

This certificate profile used for ATN PKI certificates is a profile of RFC 5280, Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280 is in turn a profile of the X.509 v3 certificate. This certificate profile places constraints on certain X.509 fields when used in the ATN to enable the effective operation of the ATN, and these are identified below.


The ATN PKI certificate profile specified in this section is mandatory only for end entity certificates, i.e., certificates issued by one entity to another different entity.

4.3.1 Uncompressed Certificates




4.3.1.1 Certificate and Certificate Extensions Profile of Uncompressed Certificates




4.3.1.1.1 Uncompressed ATN certificates shall be in accordance with the Certificate and Certificate Extensions Profile specified in RFC 5280

4.3.1.1.2 The Air Transport Association (ATA) Digital Security Working Group (DSWG) has developed a Certificate Policy (ATA Specification 42) for use in the aviation community. ATA Specification 42 provides additional implementation guidance on the use of PKI in civil aviation to include guidance on trust anchor management and the use of an Aviation Bridge CA.



4.3.1.2 ATN Signatures on Uncompressed Certificates




4.3.1.2.1 ATN CAs sign certificates using the ATN Signature Primitive (see 5.5.2.1) which shall be indicated using the syntax and object identifiers specified in RFC 5480 for the algorithm ecdsa-with-SHA256.
4.3.1.2.1.1 The applicable RFC 5480 ASN.1 Syntax elements are:

ECDSA-Sig-Value

ECParameters

ECPoint


4.3.1.2.1.2 The applicable RFC 5480 object identifiers are::

ecdsa-with-SHA256 {1 2 840 10045 4 3 2 }

id-ecPublicKey {1 2 840 10045 2 1}

sect233r1 {1 3 132 0 27}




4.3.1.3 To Be Signed Uncompressed Certificates




4.3.1.3.1 subject field
4.3.1.3.1.1 If the subject is a CA or an AMHS entity with a distinguished name (rather than an X.400 name), the subject field shall contain the distinguished name of the subject in accordance with the directory schema specified in Part IV-A.
4.3.1.3.1.2 If the subject is not a CA or an AMHS entity with a distinguished name, the subject field shall be an empty sequence.
4.3.1.3.2 subjectPublicKeyInfo field

The syntax for the subjectPublicKeyInfo field shall be as specified in RFC 5480.,



4.3.1.3.3 The Extensions field in all ATN certificates shall contain the authority key identifier extension, the key usage extension, the subject alternative name extension, and the issuer alternative name extension.
4.3.1.3.3.1 When the subject of the certificate is a CA, the Extensions field shall in addition contain the basic constraints extension and the subject key identifier extension.



4.3.1.3.3.2 Authority key identifier extension

4.3.1.3.3.2.1 The value of keyIdentifier shall be composed of a four bit type field with the value 0100 followed by the least significant 60 bits of the SHA-256 hash of the value of the subjectPublicKey of the certificate issuer.

4.3.1.3.3.3 Key usage extension

4.3.1.3.3.3.1 KeyUsage in ATN certificates shall be asserted in accordance with RFC 5480.

4.3.1.3.3.4 Subject alternative name extension

4.3.1.3.3.4.1 If the subject is an ATN ATS end system other than an AMHS end system, the subject alternative name extension shall contain the entity's AP-title.

4.3.1.3.3.4.2 If the subject is an AMHS entity, the subject alternative name extension shall contain the AMHS entity's distinguished name or X.400 address.


AMHS entities are identified by X.400 addresses and optionally in addition distinguished names. X.400 names are placed in the subject alternative name extension, and, if present, distinguished names are placed in the subject field. If an AMHS entity has both a distinguished name and an X.400 address, both the subject field and the subject alternative name extension are populated.
4.3.1.3.3.4.3 If the subject is an intermediate system, the subject alternative name extension shall contain the entity's Network Entity Title (NET) defined as follows:
NET ::= OCTET STRING (SIZE (20))

4.3.1.3.3.4.4 When the subject alternative name extension contains an entity's AP-title, this shall be placed in the extension as the value encoded as a registeredID.


4.3.1.3.3.4.5 When the subject alternative name extension contains an AMHS X.400 distinguished name, this shall be encoded as the value of directoryName.
4.3.1.3.3.4.6 When the subject alternative name extension contains an AMHS X.400 address, this shall be encoded as the value of x400Address.
4.3.1.3.3.4.7 When the subject alternative name extension contains an entity's NET, this shall be encoded as the value of ipAddress.


4.3.1.3.3.5 Issuer alternative name extension

4.3.1.3.3.5.1 The issuer alternative name extension in ATN certificates shall contain a single alternative name (which will be issuer's AP-title).

4.3.1.3.3.5.2 The issuing entity's AP-title shall be placed in the extension as the value encoded as a registeredID.




4.3.1.3.3.6 Subject key identifier extension

4.3.1.3.3.6.1 When it is present, the value of SubjectKeyIdentifier shall be composed of a four bit type field with the value 0100 followed by the least significant 60 bits of the SHA-256 hash of the value of the subjectPublicKey of the certificate subject.

4.3.2 Encoding of Compressed Certificates

ATN Air/Ground certificates are sent in a compressed form using PER encoding The receiving entity recovers the original (CA generated) certificate by re-encoding the certificate using DER encoding. After recovering the original certificate from the compressed certificate, the receiving entity validates the original certificate.



4.3.2.1 ATN certificates transmitted over air/ground subnetworks shall be encoded using the basic aligned variant of the Packed Encoding Rules (PER) as specified in ISO/IEC 8825-2.




4.4 ATN PKI CRL Profile

This CRL profile used for ATN PKI CRLs is a profile of RFC 5280, Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280 is in turn a profile of the X.509 v2 CRL. This certificate profile places constraints on certain X.509 fields when used in the ATN to enable the effective operation of the ATN, and these are identified below.



4.4.1 CRL and CRL Extensions Profile




4.4.1.1 All CRLs in the ATN shall be in accordance with the CRL and CRL Extensions Profile specified in RFC 5280.




4.4.1.2 Signatures for ATN CRLs shall be as specified for ATN certificates in 4.3.1.2.




  1. ACTION BY the meeting

    1. The ACP WG-M is invited to:

  1. Review the revisions to Doc 9880 identified by the AP in this Working Paper and provide comments and feedback regarding the proposed changes as described.

    1. Based on the field-by-field analysis conducted by Honeywell, the FAA recommends acceptance of the changes in the attached file and requests endorsement by the Working Group to update Doc 9880 as described in the AP.





Download 59.64 Kb.

Share with your friends:




The database is protected by copyright ©ininet.org 2024
send message

    Main page