International Civil Aviation Organization working paper

International Civil Aviation Organization WORKING PAPER

ACP-WGM17/WP-23 31 January 2011

Agenda Item xx:

ATN/OSI Document 9880 Update Status – Security Updates

Amendment Proposal

to

Refer to RFC 5280, 5480 and ATA Spec 42 for Certificate/CRL Profiles

Prepared by: FAA

1. 
   INTRODUCTION
   
   1. 
      One of recommendations of the Honeywell Validation Report (Meeting 16 Working Paper 8) was to follow the Certificate and CRL profiles in ATA Spec 42 and remove the formats specified in Doc 9880.
      
   2. 
      An initial set of recommended changes were developed; however, it was also recommended that a field-by-field review of Spec 42 and relevant Internet RFCs be conducted. This review is reported in the Honeywell ATN Certificate and CRL Analysis Report.
      
2. 
   discussion
   
   1. 
      This AP proposes using references to Internet RFC 5280, 5480 and ATA Spec 42 Certificate and CRL profiles.
      
   2. 
      RFC 5280 is a general Certificate and CRL profile of X.509 version 3 Certificates and version 2 CRLs. RFC 5480 specifies the syntax and semantics for certain X.509 certificate fields that support Elliptic Curve Cryptography
      
   3. 
      Section 4.3 of Doc 9880 specifies the format and allowed content in each field of an ATN Uncompressed Certificate.
      
   4. 
      Section 4.4 of Doc 9880 specifies the format and allowed content of ATN CRLs.
      

Replace sections 4.3 and 4.4 with the following:

4.3 ATN PKI Certificate Profile

This certificate profile used for ATN PKI certificates is a profile of RFC 5280, Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280 is in turn a profile of the X.509 v3 certificate. This certificate profile places constraints on certain X.509 fields when used in the ATN to enable the effective operation of the ATN, and these are identified below.

The ATN PKI certificate profile specified in this section is mandatory only for end entity certificates, i.e., certificates issued by one entity to another different entity.

4.3.1 Uncompressed Certificates

4.3.1.1 Certificate and Certificate Extensions Profile of Uncompressed Certificates

4.3.1.1.1 Uncompressed ATN certificates shall be in accordance with the Certificate and Certificate Extensions Profile specified in RFC 5280

4.3.1.1.2 The Air Transport Association (ATA) Digital Security Working Group (DSWG) has developed a Certificate Policy (ATA Specification 42) for use in the aviation community. ATA Specification 42 provides additional implementation guidance on the use of PKI in civil aviation to include guidance on trust anchor management and the use of an Aviation Bridge CA.

4.3.1.2 ATN Signatures on Uncompressed Certificates

4.3.1.2.1 ATN CAs sign certificates using the ATN Signature Primitive (see 5.5.2.1) which shall be indicated using the syntax and object identifiers specified in RFC 5480 for the algorithm ecdsa-with-SHA256.

4.3.1.2.1.1 The applicable RFC 5480 ASN.1 Syntax elements are:

ECDSA-Sig-Value

ECParameters

ECPoint

4.3.1.2.1.2 The applicable RFC 5480 object identifiers are::

ecdsa-with-SHA256 {1 2 840 10045 4 3 2 }

id-ecPublicKey {1 2 840 10045 2 1}

sect233r1 {1 3 132 0 27}

4.3.1.3 To Be Signed Uncompressed Certificates

4.3.1.3.1 subject field

4.3.1.3.1.1 If the subject is a CA or an AMHS entity with a distinguished name (rather than an X.400 name), the subject field shall contain the distinguished name of the subject in accordance with the directory schema specified in Part IV-A.

4.3.1.3.1.2 If the subject is not a CA or an AMHS entity with a distinguished name, the subject field shall be an empty sequence.

4.3.1.3.2 subjectPublicKeyInfo field

The syntax for the subjectPublicKeyInfo field shall be as specified in RFC 5480.,

4.3.1.3.3 The Extensions field in all ATN certificates shall contain the authority key identifier extension, the key usage extension, the subject alternative name extension, and the issuer alternative name extension.

4.3.1.3.3.1 When the subject of the certificate is a CA, the Extensions field shall in addition contain the basic constraints extension and the subject key identifier extension.

4.3.1.3.3.2 Authority key identifier extension

4.3.1.3.3.2.1 The value of keyIdentifier shall be composed of a four bit type field with the value 0100 followed by the least significant 60 bits of the SHA-256 hash of the value of the subjectPublicKey of the certificate issuer.

4.3.1.3.3.3 Key usage extension

4.3.1.3.3.3.1 KeyUsage in ATN certificates shall be asserted in accordance with RFC 5480.

4.3.1.3.3.4 Subject alternative name extension

4.3.1.3.3.4.1 If the subject is an ATN ATS end system other than an AMHS end system, the subject alternative name extension shall contain the entity's AP-title.

4.3.1.3.3.4.2 If the subject is an AMHS entity, the subject alternative name extension shall contain the AMHS entity's distinguished name or X.400 address.

AMHS entities are identified by X.400 addresses and optionally in addition distinguished names. X.400 names are placed in the subject alternative name extension, and, if present, distinguished names are placed in the subject field. If an AMHS entity has both a distinguished name and an X.400 address, both the subject field and the subject alternative name extension are populated.
4.3.1.3.3.4.3 If the subject is an intermediate system, the subject alternative name extension shall contain the entity's Network Entity Title (NET) defined as follows:
NET ::= OCTET STRING (SIZE (20))

4.3.1.3.3.4.4 When the subject alternative name extension contains an entity's AP-title, this shall be placed in the extension as the value encoded as a registeredID.

4.3.1.3.3.4.5 When the subject alternative name extension contains an AMHS X.400 distinguished name, this shall be encoded as the value of directoryName.
4.3.1.3.3.4.6 When the subject alternative name extension contains an AMHS X.400 address, this shall be encoded as the value of x400Address.
4.3.1.3.3.4.7 When the subject alternative name extension contains an entity's NET, this shall be encoded as the value of ipAddress.

4.3.1.3.3.5 Issuer alternative name extension

4.3.1.3.3.5.1 The issuer alternative name extension in ATN certificates shall contain a single alternative name (which will be issuer's AP-title).

4.3.1.3.3.5.2 The issuing entity's AP-title shall be placed in the extension as the value encoded as a registeredID.

4.3.1.3.3.6 Subject key identifier extension

4.3.1.3.3.6.1 When it is present, the value of SubjectKeyIdentifier shall be composed of a four bit type field with the value 0100 followed by the least significant 60 bits of the SHA-256 hash of the value of the subjectPublicKey of the certificate subject.

4.3.2 Encoding of Compressed Certificates

ATN Air/Ground certificates are sent in a compressed form using PER encoding The receiving entity recovers the original (CA generated) certificate by re-encoding the certificate using DER encoding. After recovering the original certificate from the compressed certificate, the receiving entity validates the original certificate.

4.3.2.1 ATN certificates transmitted over air/ground subnetworks shall be encoded using the basic aligned variant of the Packed Encoding Rules (PER) as specified in ISO/IEC 8825-2.

4.4 ATN PKI CRL Profile

This CRL profile used for ATN PKI CRLs is a profile of RFC 5280, Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280 is in turn a profile of the X.509 v2 CRL. This certificate profile places constraints on certain X.509 fields when used in the ATN to enable the effective operation of the ATN, and these are identified below.

4.4.1 CRL and CRL Extensions Profile

4.4.1.1 All CRLs in the ATN shall be in accordance with the CRL and CRL Extensions Profile specified in RFC 5280.

4.4.1.2 Signatures for ATN CRLs shall be as specified for ATN certificates in 4.3.1.2.

3. 
   ACTION BY the meeting
   
   1. 
      The ACP WG-M is invited to:
      

1. 
   Review the revisions to Doc 9880 identified by the AP in this Working Paper and provide comments and feedback regarding the proposed changes as described.
   

2. 
   Based on the field-by-field analysis conducted by Honeywell, the FAA recommends acceptance of the changes in the attached file and requests endorsement by the Working Group to update Doc 9880 as described in the AP.
   

Directory: safety -> acp -> ACPWGF
ACPWGF -> Information paper
ACPWGF -> Joint meeting of the
ACPWGF -> Working paper
ACPWGF -> Amcp wgm/WP19 19 August 2002 Aeronautical Mobile Communication Panel (amcp) Working Group-m meeting Fifth Meeting Saint Petersburg, Russia, 19 to 23 August 2002 Agenda Item 4: satcom
ACPWGF -> Acp wgf/16 wp 27 Rev. 1 International Civil Aviation Organization
ACPWGF -> Working paper
ACPWGF -> Working paper
ACPWGF -> Airborne collision avoidance systems working group-a
ACPWGF -> Working paper

Download 59.64 Kb.

Share with your friends: