Re: [CGA-EXT] [draft-ietf-csi-send-cert-01] Review

Jean Michel,

Thank you very much for your review. We need to update the draft after the comments received in Hiroshima and will include your suggestions.

Some comments inline.

Roque

On Dec 8, 2009, at 5:42 PM, Jean-Michel Combes wrote:

> Hi,
> 
> here are some comments/questions regarding the draft:
> 
> o Section 4, p7
> Typo:
> s/(i.e. and end user could deploy SEND without the need of RPKI
> deployment in its ISP)/(i.e. an end user could deploy SEND without the
> need of RPKI deployment in its ISP)
> 
Good.

> "This model MAY include ULA addresses."
> I would add a reference to the RFC 4193.
> 
Good.

> o Section 5.1, p8
> IMHO, it should be clearer:
> s/"This certificate will be obtained from the publication point of
> certificate defined as trust anchor."/"This certificate will be
> obtained from the publication point of the trust anchor certificate."
> BTW, as you used "EE" term at the beginning of the section, why not to
> use the rest of the terminology specified in [draft-ietf-sidr-ta-02]
> (i.e. ETA, RTA)?
> 
Good, I will. This section is the one that I was planning to revisit.

> "The identification for the Trust Anchor Material will be included in
> the Name Type Field of the ICMP Trust Anchor Option as decribed in RFC
> 3971 and MUST always to refer to a certificate that includes as RFC
> 3779 address extension."
> s/as decribed in RFC 3971/as described in RFC 3971

Good.

> What do you mean by "MUST always to refer to a certificate that
> includes as RFC 3779 address extension."?
> Because, as far as I understood the RPKI structure
> [draft-ietf-sidr-ta-02], normally, the device validating the router's
> EE cert has only an ETA cert which doesn't contain a RFC 3779 Address
> Extension (this last one refers to a RTA which contains a RFC 3779
> Address Extension). Am I correct?

Here is the thing. When you use a non RFC3779 Cert as a trust anchor, there is no IP resources in your TA certificate (the ETA). Someone needs to fetch the RTA cert (the one that has IP resources). 

We have two options, either the host does it or the router does it.

I believe that making the router to do it is problematic because the router is always expecting a TA that has IP resources and there is no way to reach the ETA from the RTA as the RTA is self-signed. So, my proposal is that in the SEND TA option the certificate that is referred always has to have IP resources in it and the host needs to make sure it can fetch it.

Regards,

Roque.

> 
> Thanks in advance for your reply.
> 
> Best regards.
> 
> JMC.
> _______________________________________________
> CGA-EXT mailing list
> CGA-EXT@ietf.org
> https://www.ietf.org/mailman/listinfo/cga-ext

-------------------------------------------------------------
Roque Gagliano
LACNIC
roque@lacnic.net
GPG Fingerprint: E929 06F4 D8CD 2AD8 9365  DB72 9E4F 964A 01E9 6CEE