Subject Key Identifier (SKI) SEcure Neighbor Discovery (SEND) Name Type Fields
updates
- rfc-3971 — SEcure Neighbor Discovery (SEND)
Extracted elements (13)
A certificate subject name is only unique within each Certification Authority, so a new identifier was needed to identify Trust Anchors across CAs; SKI provides this cross-CA uniqueness.
Per RFC 6494 and RFC 6487, the Subject field in SEND certificates is declared meaningless and subjectAltName is not allowed, making the SKI extension (mandatory and non-critical) the only viable cross-CA identifier for Trust Anchors.
This document updates RFC 3971 by changing the registration procedures for the 'Trust Anchor option (Type 15) Name Type field' registry from Standards Action to Standards Action or IESG Approval.
If the router is unable to find a path to the requested anchor, it SHOULD send an advertisement without any certificate, and SHOULD include the TA options that were solicited.
If the Trust Anchor option is represented as a SKI, then the SKI MUST be equal to the X.509 SKI extension in the trust anchor's certificate.
Implementations MAY support SHA-224, SHA-256, SHA-384, and SHA-512 SKI Name Types (Name Type field values 4, 5, 6, and 7 respectively).
Implementations MAY support the SHA-1 SKI Name Type (Name Type field value 3).
The router SHOULD include the TA option(s) in the advertisement for which the certification path was found.
The ICMPv6 Trust Anchor (TA) option Name Type field is extended with SKI-based values: 0 (Reserved), 3 (SHA-1 SKI), 4 (SHA-224 SKI), 5 (SHA-256 SKI), 6 (SHA-384 SKI), 7 (SHA-512 SKI), 253-254 (Experimental), 255 (Reserved).
IANA updated the 'Trust Anchor option (Type 15) Name Type field' registry to include SHA-1/224/256/384/512 SKI values (3-7), reserved values (0, 255), and experimental values (253-254). Registration procedure changed to Standards Action or IESG Approval.
Two identical SKI identifiers in the same validation path cause the router to stop fetching certificates after the first, potentially delivering an incomplete certificate chain to the host and causing SEND validation to fail.
When Name Type is 4, 5, 6, or 7, the SKI is computed using SHA-224, SHA-256, SHA-384, or SHA-512 respectively, applied to the DER-encoded ASN.1 bit string of the subject public key.
When the Name Type field is set to 3 (SHA-1 SKI), the field contains a 160-bit SHA-1 hash of the DER-encoded ASN.1 bit string of the subject public key as described in RFC 6487 Section 4.8.2.