security: Add NDN Certificate 2.0
Change-Id: I7d779554f53a613e67f283ca44718e57f2f1c771
Refs: #3103
diff --git a/docs/specs/certificate-format.rst b/docs/specs/certificate-format.rst
index 5873a10..9db67b3 100644
--- a/docs/specs/certificate-format.rst
+++ b/docs/specs/certificate-format.rst
@@ -11,7 +11,7 @@
a common certificate format, as it requires additional components. For example,
a certificate may follow a specific naming convention and may need to include
validity period, revocation information, etc. This specification defines
-naming and components of the NDN certificates and is complementary to NDN packet
+naming and structure of the NDN certificates and is complementary to NDN packet
specification.
::
@@ -24,6 +24,9 @@
|+------------------------+|
|| ContentType: KEY(2) ||
|+------------------------+|
+ |+------------------------+|
+ || FreshnessPeriod: >~ 1h ||
+ |+------------------------+|
+--------------------------+
| Content |
|+------------------------+|
@@ -42,6 +45,24 @@
+--------------------------+
+ CertificateV2 ::= DATA-TLV TLV-LENGTH
+ Name (= /<NameSpace>/KEY/[KeyId]/[IssuerId]/[Version])
+ MetaInfo (.ContentType = KEY,
+ .FreshnessPeriod >~ 1h))
+ Content (= X509PublicKeyContent)
+ SignatureInfo (= CertificateV2SignatureInfo)
+ SignatureValue
+
+ X509PublicKeyContent ::= CONTENT-TLV TLV-LENGTH
+ BYTE+ (= public key bits in PKCS#8 format)
+
+ CertificateV2SignatureInfo ::= SIGNATURE-INFO-TYPE TLV-LENGTH
+ SignatureType
+ KeyLocator
+ ValidityPeriod
+ ... optional critical or non-critical extension blocks ...
+
+
Name
----
@@ -49,24 +70,29 @@
::
- /<SubjectName>/[KeyId]/KEY/[IssuerId]/[Version]
+ /<SubjectName>/KEY/[KeyId]/[IssuerId]/[Version]
-A certificate name starts with the subject to which a public key is bound. The
-second part is a single name component, called KeyId, which should uniquely
-identify the key under the subject namespace. The value of KeyId is up to
-the owner of the subject namespace (e.g., 8-byte random number, SHA-256 digest
-of the public key, timestamp, or numerical identifier). A special name
-component ``KEY`` is appended after KeyId, which indicates that the data is a
-certificate. After ``KEY``, there is an IssuerId name component that
-distinguishes different issuers for the same key. How to specify the IssuerId
-is up to the issuer and key owner. The last component is version number.
+A certificate name starts with the subject to which a public key is bound. The following parts
+include the keyword ``KEY`` component, KeyId, IssuerId, and version components.
+
+``KeyId`` is an opaque name component to identify an instance of the public key for the
+certificate namespace. The value of `Key ID` is controlled by the namespace owner and can be
+an 8-byte random number, SHA-256 digest of the public key, timestamp, or a simple numerical
+identifier.
+
+``Issuer Id`` is an opaque name component to identify issuer of the certificate. The value is
+controlled by the certificate issuer and, similar to KeyId, can be an 8-byte random number,
+SHA-256 digest of the issuer's public key, or a simple numerical identifier.
+
+
For example,
::
- /edu/ucla/cs/yingdi/%03%CD...%F1/KEY/%9F%D3...%B7/%FD%d2...%8E
- \_________________/\___________/ \___________/\___________/
- Subject Name Key ID Issuer Id Version
+ /edu/ucla/cs/yingdi/KEY/%03%CD...%F1/%9F%D3...%B7/%FD%d2...%8E
+ \_________________/ \___________/ \___________/\___________/
+ Certificate Namespace Key Id Issuer Id Version
+ (Identity)
MetaInfo
@@ -86,27 +112,15 @@
SignatureInfo
-------------
-Besides, ``SignatureType`` and ``KeyLocator``, the ``SignatureInfo`` field of a
-certificate include more optional fields.
-
-::
-
- SignatureInfo ::= SIGNATURE-INFO-TYPE TLV-LENGTH
- SignatureType
- KeyLocator
- ValidityPeriod?
- ... (SignatureInfo Extension TLVs)
-
-One optional field is ``ValidityPeriod``, which contains two sub TLV fields:
-``NotBefore`` and ``NotAfter``, which are two UTC timestamps in ISO 8601 compact
-format (``yyyymmddTHHMMSS``, e.g., "20020131T235959"). NotBefore indicates
-when the certificate takes effect while NotAfter indicates when the certificate
-expires.
+The SignatureInfo block of a certificate is required to include the ``ValidityPeriod`` field.
+``ValidityPeriod`` includes two sub TLV fields: ``NotBefore`` and ``NotAfter``, which carry two
+UTC timestamps in ISO 8601 compact format (``yyyymmddTHHMMSS``, e.g., "20020131T235959").
+``NotBefore`` indicates when the certificate takes effect while ``NotAfter`` indicates when the
+certificate expires.
.. note::
- Using ISO style string is the convention of specifying validity period of
- certificate, which has been adopted by many certificate systems, such as
- X.509, PGP, and DNSSEC.
+ Using ISO style string is the convention of specifying the validity period of certificate,
+ which has been adopted by many certificate systems, such as X.509, PGP, and DNSSEC.
::
@@ -133,17 +147,13 @@
| NotAfter | 255 | 0xFF |
+---------------------------------------------+-------------------+----------------+
-.. note::
- TLV-TYPE code that falls into [253, 65536) is encoded in
- `3-byte <http://named-data.net/doc/ndn-tlv/tlv.html#variable-size-encoding-for-type-t-and-length-l>`__
-
Extensions
~~~~~~~~~~
A certificate may optionally carry some extensions in SignatureInfo. An extension
-could be either critical or non-critical depends on the TLV-TYPE code convention. An
-critical extension implies that if a validator cannot recognize or cannot parse the
-extension, the validator must reject the certificate. An non-critical extension
+could be either critical or non-critical depends on the TLV-TYPE code convention. A
+critical extension implies that if a validator cannot recognize or parse the
+extension, the validator must reject the certificate. A non-critical extension
implies that if a validator cannot recognize or cannot parse the extension, the
validator may ignore the extension.
@@ -151,42 +161,19 @@
TLV-TYPE code indicates whether the extension is critical or not: ``1`` for critical
while ``0`` for non-critical. If an extension could be either critical or
non-critical, the extension should be allocated with two TLV-TYPE codes which only
-differ at the last bit. For example, TLV-TYPE codes 256 and 257 are allocated to the
-``StatusChecking`` extension, 256 for critical StatusChecking while 257 for
-non-critical StatusChecking.
+differ at the last bit.
+Extensions
+----------
-Proposed Extensions
--------------------
-
-We list the proposed extensions here:
+We list currently defined extensions:
+---------------------------------------------+-------------------+----------------+
| TLV-TYPE | Assigned code | Assigned code |
| | (decimal) | (hexadecimal) |
+=============================================+===================+================+
-| StatusChecking (Non-critical) | 256 | 0x0100 |
+| AdditionalDescription (non-critical) | 258 | 0x0102 |
+---------------------------------------------+-------------------+----------------+
-| StatusChecking (Critical) | 257 | 0x0101 |
-+---------------------------------------------+-------------------+----------------+
-| AdditionalDescription (Non-critical) | 258 | 0x0102 |
-+---------------------------------------------+-------------------+----------------+
-| MultipleSignature (Critical) | 259 | 0x0103 |
-+---------------------------------------------+-------------------+----------------+
-
-.. note::
- TLV-TYPE code that falls into [253, 65536) is encoded in
- `3-byte <http://named-data.net/doc/ndn-tlv/tlv.html#variable-size-encoding-for-type-t-and-length-l>`__
-
-Status Checking
-~~~~~~~~~~~~~~~
-
-TBD
-
-Multiple Signature
-~~~~~~~~~~~~~~~~~~
-
-TBD
AdditionalDescription
~~~~~~~~~~~~~~~~~~~~~