From 7d9bb8b750256aa3fb42330980e34fd7c44078de Mon Sep 17 00:00:00 2001 From: Q Misell Date: Tue, 27 Aug 2024 09:31:19 +0200 Subject: [PATCH] address nits raised during early review --- draft-ietf-acme-onion.xml | 70 ++++++++++++++++++++++++++++----------- 1 file changed, 51 insertions(+), 19 deletions(-) diff --git a/draft-ietf-acme-onion.xml b/draft-ietf-acme-onion.xml index 55bb494..0f0639b 100644 --- a/draft-ietf-acme-onion.xml +++ b/draft-ietf-acme-onion.xml @@ -76,18 +76,21 @@ when requesting a certificate for a ".onion" Special-Use Domain Name. The value of identifier MUST be the textual representation as defined in . The value MAY include - subdomain labels. Version 2 addresses MUST NOT be used as these are now considered insecure. - Example identifiers: + subdomain labels. Version 2 addresses MUST NOT be used as these + are now considered insecure. + Example identifiers (linebreaks have been added for readability only): { "type": "dns", - "value": "bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6aucdccrad.onion" + "value": "bbcweb3hytmzhn5d532owbu6oqadra5z3ar726v + q5kgwwn6aucdccrad.onion" } { "type": "dns", - "value": "www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6aucdccrad.onion" + "value": "www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726v + q5kgwwn6aucdccrad.onion" } @@ -102,13 +105,13 @@
Existing "dns-01" Challenge The existing "dns-01" challenge MUST NOT be used to validate ".onion" Special-Use Domain - Names. + Names, as these domains are not part of the DNS.
Existing "http-01" Challenge The "http-01" challenge as defined in can be used to validate a ".onion" Special-Use Domain Names, with the modifications defined in this standard, namely - , and . + , and . The ACME server SHOULD follow redirects; note that these MAY be redirects to non ".onion" services, and the server SHOULD honour these.
@@ -116,7 +119,7 @@ Existing "tls-alpn-01" Challenge The "tls-alpn-01" challenge as defined in can be used to validate a ".onion" Special-Use Domain Names, with the modifications defined in this standard, namely - , and . + , and .
@@ -255,7 +258,7 @@ Content-Type: application/jose+json
ACME over hidden services - A CA offering certificates to ".onion" Special-Use Domain Names is RECOMMENDED to make their + A CA offering certificates to ".onion" Special-Use Domain Names SHOULD make their ACME server available as a Tor hidden services. ACME clients SHOULD also support connecting to ACME servers over Tor, regardless of their support of "onion-csr-01", as their existing "http-01" and "tls-alpn-01" implementations could be used to obtain certificates for ".onion" Special-Use Domain Names. @@ -267,7 +270,8 @@ Content-Type: application/jose+json is necessary to allow restrictions to be placed on certificate issuance. To this end a new field is added to the second layer hidden service descriptor - with the following format: + with the following format (defined using the notation from + ): "caa" SP flags SP tag SP value NL [Any number of times] @@ -275,13 +279,15 @@ Content-Type: application/jose+json The contents of "flag", "tag", and "value" are as per . Multiple CAA records MAY be present, as is the case in the DNS. CAA records in a hidden service descriptor are to be treated the same by CAs as if they had been in the DNS for the ".onion" Special-Use Domain Name. - A hidden service's second layer descriptor using CAA could look something like the following: + A hidden service's second layer descriptor using CAA could look something like the following + (linebreaks have been added for readability only): create2-formats 2 single-onion-service caa 128 issue "test.acmeforonions.org;validationmethods=onion-csr-01" caa 0 iodef "mailto:security@example.com" -introduction-point AwAGsAk5nSMpAhRqhMHbTFCTSlfhP8f5PqUhe6DatgMgk7kSL3KHCZUZ3C6tXDeRfM9SyNY0DlgbF8q+QSaGKCs= +introduction-point AwAGsAk5nSMpAhRqhMHbTFCTSlfhP8f5PqUhe6DatgMgk7kSL3 + KHCZUZ3C6tXDeRfM9SyNY0DlgbF8q+QSaGKCs= ...
@@ -321,7 +327,8 @@ introduction-point AwAGsAk5nSMpAhRqhMHbTFCTSlfhP8f5PqUhe6DatgMgk7kSL3KHCZUZ3C6tX - in certain circumstances - would disclose unwanted information about the hidden service operator). To this end a new field is added to the first layer hidden service descriptor - with the following format: + with the following format (defined using the notation from + ): "caa-critical" NL [At most once] @@ -410,12 +417,15 @@ Content-Type: application/json
Example in-band CAA - Given the following example CAA record set for 5anebu2glyc235wbbop3m2ukzlaptpkq333vdtdvcjpigyb7x2i2m2qd.onion: + Given the following example CAA record set for 5anebu2glyc235wbbop3m2ukzlaptpkq333vdtdvcjpigyb7x2i2m2qd.onion + (linebreaks have been added for readability only): -caa 128 issue "test.acmeforonions.org; validationmethods=onion-csr-01" +caa 128 issue "test.acmeforonions.org; + validationmethods=onion-csr-01" caa 0 iodef "mailto:example@example.com" - The following would be submitted to the ACME server's finalize endpoint + The following would be submitted to the ACME server's finalize endpoint + (linebreaks have been added for readability only): POST /acme/order/TOlocE8rfgo/finalize Host: example.com @@ -431,10 +441,14 @@ Content-Type: application/jose+json "payload": base64url({ "csr": "MIIBPTCBxAIBADBFMQ...FS6aKdZeGsysoCo4H9P", "onionCAA": { - "5anebu2glyc235wbbop3m2ukzlaptpkq333vdtdvcjpigyb7x2i2m2qd.onion": { - "caa": "caa 128 issue \"test.acmeforonions.org; validationmethods=onion-csr-01\"\ncaa 0 iodef \"mailto:example@example.com\"", + "5anebu2glyc235wbbop3m2ukzlaptpkq333vdtdvcjpi + gyb7x2i2m2qd.onion": { + "caa": "caa 128 issue \"test.acmeforonions.org; + validationmethods=onion-csr-01\"\n + caa 0 iodef \"mailto:example@example.com\"", "expiry": 1697210719, - "signature": "u_iP6JZ4JZBrzQUKH6lSrWejjRfeQmkTuehc0_FaaTNPAV0RVxpUz9r44DRdy6kgy0ofnx18KIhMrP7N1wpxAA==" + "signature": "u_iP6JZ4JZBrzQUKH6lSrWejjRfeQmkTuehc0_FaaTNP + AV0RVxpUz9r44DRdy6kgy0ofnx18KIhMrP7N1wpxAA==" } } }), @@ -647,6 +661,24 @@ Content-Type: application/jose+json + + + Tor Rendezvous Specification - Version 2 + + The Tor Project + + + + + + + Tor Directory Protocol - Version 3 + + The Tor Project + + + + Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates @@ -697,7 +729,7 @@ Content-Type: application/jose+json With thanks to the Open Technology Fund for funding the work that went into this document. The authors also wish to thank the following for their input on this document:
    -
  • Iain R. Learmonth
    • +
  • Iain Learmonth
  • Jan-Frederik Rieckers