Re: [Sidr] V3 draft of SIDR Charter

On Mon, 28 Nov 2005, Geoff Huston wrote:

> At 07:41 PM 28/11/2005, william(at)elan.net wrote:
>
>> I still think you need to specify that work will include information
>> on how to publish certification objects. Either have this as separate
>> point below or addition to existing one.
>> 
>>>  The SIDR working group is charged with the following tasks:
>>> 
>>>  - Document an extensible interdomain routing security architecture
>>> 
>>>  - Document the use of certification objects within this secure
>>>    routing architecture
>> 
>> Possibly change to:
>> 
>>   - Document use and publication of certification objects within
>>     secure interdomain routing architecture
>
> Now one way or another we are talking about certificate repositories. What 
> did you have in mind to specify here above and beyond normal repository 
> operation?

That is pretty much it. I do not see it clearly spelled out in the
charter that we would work on specifying access to (or at least linking 
rules for specifying PKI repository) PKI repositories and format of the 
data that is to be retrieved. There are actually quite a number of ways
to run a repository or certificate verification service that have been 
developed (plus add related issues and formats for publication of CRL
data as well), these are just a few these:
  SCVP (draft-ietf-pkix-scvp-21.txt)
  DVCS (RFC3029)
  OSCP (RFC2560)
  PKIXREP locator (draft-ietf-pkix-pkixrep-04.txt)
  HTTP Certificate Store (draft-ietf-pkix-certstore-http-09.txt)
  LDAP Certificate server
  PGP (HTTP based) key & certificate server
  etc.
And it may well be that none of the above will work because one of the key
issues is that BGP (like DNS) is a base protocol so one can not fully rely 
on some "higher" application protocol as part of BGP route establishment
(see also SBGP & soBGP and compare how they propose to store cert data).

I think info on considerations and issues involved in setting up and
running repositories that would be used for BGP security should be
considered and documented as well at least in some way.

Also the format for certificates and any necessary extensions are all 
in scope (i.e. if we decide we need extension of RFC3779) and this
I also see as publication-related issue.

-- 
William Leibzon
Elan Networks
william@elan.net

_______________________________________________
Sidr mailing list
Sidr@ietf.org
https://www1.ietf.org/mailman/listinfo/sidr