<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div><span>Hi Ed</span></div><div id="yui_3_16_0_ym19_1_1549742727973_68146"><span><br></span></div><div id="yui_3_16_0_ym19_1_1549742727973_68060"><span id="yui_3_16_0_ym19_1_1549742727973_68059">Thanks for following up on this. Just one question, have you taken into account time zones? If an update is signed now in Dubai it is 19:51. If the update is processed on Amsterdam time, it is 16:51. Will this update fail because it is 3 hours in the future?</span></div><div id="yui_3_16_0_ym19_1_1549742727973_68164"><span id="yui_3_16_0_ym19_1_1549742727973_68059"><br></span></div><div id="yui_3_16_0_ym19_1_1549742727973_68147"><span id="yui_3_16_0_ym19_1_1549742727973_68059">cheers</span></div><div id="yui_3_16_0_ym19_1_1549742727973_68163"><span id="yui_3_16_0_ym19_1_1549742727973_68059">denis</span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1549742727973_68148"><span id="yui_3_16_0_ym19_1_1549742727973_68059">co-chair DB-WG<br></span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1549742727973_68027"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1549742727973_68152" style="display: block;"> <div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1549742727973_68151"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1549742727973_68150"> <div dir="ltr" id="yui_3_16_0_ym19_1_1549742727973_68149"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Edward Shryane via db-wg <db-wg@ripe.net><br> <b><span style="font-weight: bold;">To:</span></b> db-wg <db-wg@ripe.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, 11 February 2019, 15:55<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [db-wg] Proposal for restricting authentication concerning use of revoked and expired GPG ID's in key-cert objects<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1549742727973_68165"><br><div dir="ltr" id="yui_3_16_0_ym19_1_1549742727973_68166">Dear Working Group,<br clear="none"><br clear="none">to follow up on this discussion, the upcoming Whois 1.93 release will implement the following changes:<br clear="none"><br clear="none">- Updates signed with an expired PGP key or X509 certificate will now FAIL (currently a warning is generated).<br clear="none">- Updates will FAIL one hour after they are signed, and also updates signed more than one hour in the future.<br clear="none">- Updates to key-cert objects with an Expired or Revoked public key (or certificate) will FAIL. <br clear="none"><br clear="none">To measure the potential impact of these changes, I reviewed all Whois updates between October - December 2018.<br clear="none"><br clear="none">- Approximately 4% of all updates are signed with a PGP key or X509 certificate.<br clear="none">- 99% of X509 key-cert certificates are expired. I found 5 X509 signed updates with an expired key.<br clear="none">- 16% of PGP key-cert keys are expired. I found 63 PGP signed updates with an expired key. <br clear="none">- I found 24 PGP signed updates more than one hour in the past, and none signed in the future. <br clear="none"><br clear="none">We will notify maintainers of expired key-cert objects separately (by email) of this upcoming change.<br clear="none"><br clear="none">Regards<br clear="none">Ed Shryane<br clear="none">RIPE NCC<br clear="none"><br clear="none"><div class="yqt2741792987" id="yqtfd80027"><br clear="none">> On 1 Nov 2018, at 15:35, Christoffer Hansen (Lists) via db-wg <<a shape="rect" ymailto="mailto:db-wg@ripe.net" href="mailto:db-wg@ripe.net">db-wg@ripe.net</a>> wrote:<br clear="none">> <br clear="none">> Dear DB WG,<br clear="none">> <br clear="none">> It came to my attention the RIPE NCC Database does not do validation of<br clear="none">> signed updates. (Other than checking the key is allowed to sign updates<br clear="none">> for object(s) in question)<br clear="none">> <br clear="none">> I got the understanding from writing to DB-WG-Chairs this was a decision<br clear="none">> made years back.<br clear="none">> <br clear="none">> I think is less than optimal from a security perspective an signed<br clear="none">> update (with GPG and/or X509 certs) is not validated against (1) when<br clear="none">> the update was signed (E.g. signing was done 10 minutes ago) and (2)<br clear="none">> that the expiration date for the keys are not validated.<br clear="none">> <br clear="none">> Usually I will expect if I revoke a GPG-key|X509-cert. It cannot be used<br clear="none">> any more. But the RIPE NCC Database does still allow this currently.<br clear="none">> This is relevant in the case I ever lose a private GPG-key|X509-cert to<br clear="none">> less than friendly 3rd-parties. And the lost private GPG-key|X509-cert<br clear="none">> is the one used for signing updates to the database.<br clear="none">> <br clear="none">> What I have in mind. Is the RIPE NCC Database begins verifying validity<br clear="none">> (not revoked and/or expired) of GPG-key|X509-cert used to sign updates with.<br clear="none">> <br clear="none">> Christoffer<br clear="none">> <br clear="none"><br clear="none"></div></div><br><br></div> </div> </div> </div></div></body></html>