CDNI Metadata for Delegated Credentials

Introduction Content delivery over HTTPS utilizing one or more Content Delivery Networks (CDNs) along the delivery path necessitates the management of credentials. This requirement is particularly pertinent when an entity delegates the delivery of content via HTTPS to another trusted entity. This document specifies the CDNI Metadata interface for establishing HTTPS delegation through the use of delegated credentials, as defined in ) between an upstream CDN (uCDN) and a downstream CDN (dCDN).

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. This document uses terminology from CDNI framework documents: CDNI framework document , CDNI requirements and CDNI interface specifications documents: CDNI Metadata interface .

CDNI Footprint and Capabilities Advertisement interface (FCI) capabilities object for delegated credentials A dCDN should advertise its supported delegation methods using the Footprint and Capabilities Advertisement interface (FCI) as defined in . The FCI.Metadata object enables a dCDN to communicate its capabilities and the Metadata Interface (MI) objects it supports. To indicate support for delegated credentials, the dCDN should announce the support for MI.DelegatedCredentials, as illustrated in the example below. This document also defines an object that informs the uCDN of the number of delegated credentials supported by the dCDN, enabling the uCDN to supply the appropriate number of delegated credentials. To this end, the FCI object, FCI.DelegationCredentials, is introduced.

FCI.DelegatedCredentials The FCI.DelegationCredentials object enables advertising the maximum number of delegated credentials supported by the dCDN. This number typically (but not necessarily) corresponds to the number of servers designated by the dCDN to support delegated credentials. The property PrivateKeyEncryptionKey contains a public key provided by the dCDN that MUST be used by the uCDN to encrypt private keys whenever such private keys are transmitted to the dCDN using MI.DelegatedCredentials (see ).

Property:

number-delegated-certs-supported

Description:: Number of delegated credentials supported by the dCDN.
Type:: integer
Mandatory-to-Specify:: Yes

Property:

PrivateKeyEncryptionKey

Description:: Public key in JWK format () of the dCDN to be used by the uCDN to encrypt private keys.
Type:: string
Mandatory-to-Specify:: No

The following is an example of the FCI.DelegatedCredentials. ] } ] } ]]>

Expected usage of the property number of supported delegated credentials The dCDN uses the FCI.DelegatedCredentials object to announce the number of servers that support delegated credentials When the uCDN receives the FCI.DelegatedCredentials object it can issue the supported number of delegated credentials to the dCDN. When configuring the dCDN, the uCDN MAY decide to provide less than the maximum supported delegated credentials to the dCDN. Note that, within a dCDN, different deployment possibilities of the delegated credentials on the endpoints exist. The dCDN MAY use one single delegated credential and deploy it on multiple endpoints. Alternatively, the dCDN MAY deploy a different delegated credential for each endpoint (provided that the uCDN delivers enough different delegated credentials). This choice is at the discretion of the dCDN and depends on the number of delegated credentials provided by the uCDN. The FCI.DelegationCredentials object does not address expiry and renewal of delegated credentials. Once the uCDN has provided delegated credentials via the MI, uCDN SHOULD monitor the provided credentials and their expiry times and timely refresh dCDN credentials via the MI. The uCDN may decide not to monitor the validity period of delegated credentials and not to refresh the credentials, for example in cases of short-term one shot deployments or once it decided to deprovision a dCDN. If the delegated credential is not renewed on time by the uCDN, the servers of the dCDN that only have expired delegated credentials MUST refuse any new TLS connection that requires an up-to-date delegated credential.

CDNI Metadata interface (MI) metadata object for delegated credentials As expressed in , when an uCDN has delegated to a dCDN, the dCDN presents the "delegated_credential" during the TLS handshake to the User Agent, instead of its own certificate. This implies that the dCDN is also in the possession of the private key corresponding to the public key in DelegatedCredential.cred . This allows the User Agent to verify the signature in CertificateVerify message ( Section 4.4.3.) sent and signed by the dCDN. This section defines the MI.DelegatedCredentials object containing an array of delegated credentials and optionally the corresponding private keys. The CDNI MI describes the CDNI metadata distribution mechanisms according to which a dCDN can retrieve the MI.DelegatedCredentials object from the uCDN. The properties of the MI.DelegatedCredentials object are as follows:

Property:

delegated-credentials

Description:: Array of delegated credentials
Type:: Array of DelegatedCredentialObject objects
Mandatory-to-Specify:: Yes

The DelegatedCredentialObject object is composed of the following properties:

Property:

delegated-credential

Description:: Base64-encoded (as defined in Section 4 of ) version of a CertificateEntry as defined in Section 4.4.2. The CertificateEntry MUST contain a DelegatedCredential structure (as defined in ) using the extension in the CertificateEntry of its end-entity certificate (see section 4.1.1)
Type:: string
Mandatory-to-Specify:: Yes

Property:

private-key

Description:: Encrypted private key corresponding to the public key contained in the DelegatedCredential. The envelope format for this property is JWE using the base64 compact serialization (Section 7.1 of ).
Type:: string
Mandatory-to-Specify:: No

The private-key property is not mandatory. If not specified, it is assumed that the dCDN generated the public-private key pair for the delegated credential itself and provided the public key information with an out-of-band mechanism to the uCDN. See for constraints regarding the usage of the private key. If the private-key property is used, the transported private key MUST be encrypted using the PrivateKeyEncryptionKey specified in FCI.DelegatedCredentials. The envelope format for this property MUST use JWE using the base64 compact serialization (Section 7.1 of ), whereas the private key is included as JWE Ciphertext in the JWE. The JWE content-type field MAY be used signal the media type of the encrypted key. Below, please see an example MI.DelegatedCredential Object.

Delegated credentials call flow An example call-flow using delegated credentials is depicted in Figure 1. 1. It is assumed that the uCDN has been provisioned and configured with a certificate. Note that it is out of scope of CDNI and the present document how and from where (e.g., CSP) the uCDN acquired its certificate. 2. The uCDN generates a set of delegated credentials (here it is assumed that public keys of the dCDN are known). Note that the uCDN may generate this material at different points in time, e.g., in advance to have a pool of delegated credentials or on-demand when the dCDN announces its maximum number of supported delegated credentials. 3. Using the CDNI FCI , the dCDN advertises MI.DelegatedCredentials capabilities to the uCDN. The dCDN further uses FCI.DelegatedCredentials to advertise the maximum number of supported delegated credentials. 4. Using the CDNI MI , the dCDN acquires the MI.DelegatedCredentials, retrieving an array of delegated credentials. 5. The client establishes a TLS connection with an endpoint of the dCDN according to using the delegated credentials retrieved in step 4. 6. When some delegated credentials are about to expire, the uCDN uses the CDNI MI to provide new, valid delegated credentials.

IANA Considerations This document requests IANA registration of the following entries under the "CDNI Payload Types" registry hosted by IANA regarding "CDNI delegation":

Payload Type	Specification
MI.DelegatedCredentials	RFCthis
FCI.DelegatedCredentials	RFCthis

[RFC Editor: Please replace RFCthis with the published RFC number for this document.] The and below provide additional necessary information for the IANA registration of CDNI payload-types parameters (see Section 2.2).

CDNI MI DelegatedCredentials Payload Type

Purpose:: The purpose of this Payload Type is to distinguish delegated credentials MI Objects
Interface:: MI/FCI
Encoding:: see

CDNI FCI DelegatedCredentials Payload Type

Purpose:: The purpose of this Payload Type is to advertise the number of delegated credentials needed (and any associated capability advertisement)
Interface:: FCI
Encoding:: see

Security Considerations The extensions defined enable providing delegated credentials to dCDNs. A delegated credential can only be used by a dCDN if it is in possession of the associated private key. Similarly, an attacker requires access to the private key in order to exploit delegated credential and impersonate dCDN nodes. Thus, leakage of only the delegated credential without the private key represents a limited security risk. Delegated credentials and associated private keys are short-lived (per default the maximum validity period set to 7 days in ) and as such a single leaked delegated credential with its private key represents a limited security risk. Still, it is NOT RECOMMENDED to send private keys through the MI. Omitting the private key further limits the possibility exploits by an attacker to exploit the delegated credential. If despite this recommendation, the private key is communicated via the MI, the transported private key MUST be encrypted within a JWE envelope using the encryption key (PrivateKeyEncryptionKey) provided within the FCI.DelegatedCredentials by the dCDN. The JWE encryption key (PrivateKeyEncryptionKey) MUST have a strength equal or larger than the private key it is encrypting for transport. Note that the specified encryption method does not offer forward secrecy. If the dCDN's encryption key becomes compromised in the future, then all encrypted JWEs will become compromised. Due to the short-lived nature of delegated credentials, the impact is limited. It is also important to ensure that an attacker is not able to systematically retrieve a consecutive or consistent set of delegated credentials and associated private keys. Such an attack would allow the attacker to systematically impersonate dCDN nodes. The MI objects defined in the present document are transferred via the interfaces defined in CDNI . describes how to secure these interfaces, protecting the integrity, confidentiality and ensuring the authenticity of the dCDN and uCDN, which should prevent an attacker to systematically retrieve delegated credential and associated private keys.

Privacy Considerations The information, FCI, and MI objects defined in the present document do not contain any personally identifiable information (PII). As such this document does not change or alter the Confidentiality and Privacy Consideration outlined in the CDNI Metadata and Footprint and Capabilities RFCs . A single or systematic retrieval of delegated credentials and associated private keys would allow the attacker to decrypt any data sent by the end user intended for the end service, which may include PII.