[db-wg] X.509 authentication in the RIPE Database

Dear Colleagues,

[Apologies for duplicate e-mails]

As previously discussed in RIPE 44 and 45, please find below the 
proposal to add X.509 authentication to the RIPE Database.





********************************************************************
X.509 Certificate Authentication in the RIPE Database


0. Objective

To make a new method of authentication available using X.509 certificates.

1. Motivation

The RIPE Database currently has 5 methods of authentication, none of 
these are completely satisfactory with regard to security, standards 
support (de facto and de jure), pervasiveness and integration.

The X.509 authentication mechanism would satisfy all of these factors:

1. Security: X.509 allows for the use of digital signatures, making it 
unnecessary to send clear passwords via e-mail. The current PGP 
authentication also provides this feature.
2. Standards support: X.509 is an ISO standard and is the only mechanism 
supported by mailers and clients used in more than 90% of communications 
with the RIPE NCC.
3. Pervasiveness: X.509 can be utilised with several communication 
mechanisms, not only mail. A common example is SSL/HTTPS. No other 
authentication mechanism is as strong and easily available with the web.
4. Integration: This authentication method will integrate seamlessly 
with the general framework of security in use at the RIPE NCC.

It is also important to note that, the general trend among the other 
Regional Internet Registries (RIRs) is the use of X.509 as a main 
authentication method.


2. User visible changes

a. Requirements

To be able to the X.509 authentication method the user requires a 
certificate issued through the RIPE NCC LIR portal. Information on how 
to obtain a certificate can be found at:
http://lirportal.ripe.net/lirportal/faq/pki.html

Therefore the X.509 method would only be available to LIRs. This can be 
changed if the community so desires.

b. Maintainers

The auth: attribute of the mntner object will have a new authentication 
scheme, X509.
The parameter will be a Distinguished Name (DN) according to RFC 2253.
There is an important fundamental difference between PGP authentication 
and X.509; the database does not need a key-cert object for X.509 
certificates, the DN has to be trusted. This means the certificate must 
be signed by a trusted authority and that self-signed certificates will 
not be accepted. The trusted authority will be the RIPE NCC Certificate
Authority that is currently only available to LIRs.

Following is an example of a maintainer with X.509 authentication:

mntner:       RIPE-DBM-MNT
descr:        Mntner for RIPE DBM objects.
admin-c:      AMR68-RIPE
tech-c:       RD132-RIPE
upd-to:       ripe-dbm at ripe.net
mnt-nfy:      ripe-dbm at ripe.net
auth:         X509 C=NL, O=RIPE NCC, OU=Members, CN=eu.ripe.dbm
notify:       ripe-dbm at ripe.net
mnt-by:       RIPE-DBM-MNT
referral-by:  RIPE-DBM-MNT
changed:      ripe-dbm at ripe.net 20030617
source:        RIPE

For users the only variable part within the new auth: attribute is the 
CN (Common Name).

c. Submitting updates via e-mail

Updates for objects maintained by a maintainer with X509 authentication 
must be sent in S/MIME format and signed (not encrypted) using the 
private key associated with the issued certificate. This key must also 
be made available to the mailer. Users that have a mail user agent that 
does not support S/MIME might consider using OpenSSL S/MIME facilities 
to prepare their mails.

d. Submitting updates via webupdates

Webupdates will accept client-side certificates. This means that the 
strongest type of authentication possible will be easily available for 
users using the web. For this to be possible the certificate and private 
key have to be loaded in the user browser.