Re: [Sidr] V3 draft of SIDR Charter

At 11:08 PM 28/11/2005, william(at)elan.net wrote:

>On Mon, 28 Nov 2005, Geoff Huston wrote:
>
>>At 07:41 PM 28/11/2005, william(at)elan.net wrote:
>>
>>>I still think you need to specify that work will include information
>>>on how to publish certification objects. Either have this as separate
>>>point below or addition to existing one.
>>>
>>>>  The SIDR working group is charged with the following tasks:
>>>>  - Document an extensible interdomain routing security architecture
>>>>  - Document the use of certification objects within this secure
>>>>    routing architecture
>>>Possibly change to:
>>>   - Document use and publication of certification objects within
>>>     secure interdomain routing architecture
>>
>>Now one way or another we are talking about certificate repositories. 
>>What did you have in mind to specify here above and beyond normal 
>>repository operation?
>
>That is pretty much it. I do not see it clearly spelled out in the
>charter that we would work on specifying access to (or at least linking 
>rules for specifying PKI repository) PKI repositories and format of the 
>data that is to be retrieved. There are actually quite a number of ways
>to run a repository or certificate verification service that have been 
>developed (plus add related issues and formats for publication of CRL
>data as well), these are just a few these:
>  SCVP (draft-ietf-pkix-scvp-21.txt)
>  DVCS (RFC3029)
>  OSCP (RFC2560)
>  PKIXREP locator (draft-ietf-pkix-pkixrep-04.txt)
>  HTTP Certificate Store (draft-ietf-pkix-certstore-http-09.txt)
>  LDAP Certificate server
>  PGP (HTTP based) key & certificate server
>  etc.
>And it may well be that none of the above will work because one of the key
>issues is that BGP (like DNS) is a base protocol so one can not fully rely 
>on some "higher" application protocol as part of BGP route establishment
>(see also SBGP & soBGP and compare how they propose to store cert data).
>
>I think info on considerations and issues involved in setting up and
>running repositories that would be used for BGP security should be
>considered and documented as well at least in some way.
>
>Also the format for certificates and any necessary extensions are all in 
>scope (i.e. if we decide we need extension of RFC3779) and this
>I also see as publication-related issue.

I am unsure how nmuch of this belongs in a SIDR charter and how much 
belongs in a security area as a work item and how much is beyond the scope 
of standards-related activities. For a charter I'm personally more 
comfortable with the more general phrase of

" Document the use of certification objects within this secure routing 
architecture"

and not specifying the form of repository nor the form of repository access 
as charter work items at this point in time.

regards,

     Geoff

_______________________________________________
Sidr mailing list
Sidr@ietf.org
https://www1.ietf.org/mailman/listinfo/sidr