Re: [sidr] is a longer announce invalid or not found?

Speaking as regular ol' member

On Sat, 1 Oct 2011, Randy Bush wrote:

>> a (let's assume dual homed) leaf site does not have to do much for
>> bgpsec.  their upstreams validate, so they do not have to.  all they
>> have to do is sign their announcement.  we refer to this as a
>> 'simplex' site, they announce signed but do not accept signed data, do
>> not hold any key or cert other than their own, ...  cool result is
>> that current leaf site hardware could do this, no upgrade.  so, for my
>> simplex lazy customer, yes i gen the bgpsec router key for them, and
>> they or i stuff it in their router.
>
> < side discussion >
>
> cool hack 14.3: the router itself can gen the public/private key pair a
> la ssh, the person configuring can extract the public key and send it to
> the rpki goddesses to be signed by the appropriate cert and put in the
> rpki.  the private key never leaves the router!

I believe that Steve Kent says that usually a certificate request is 
required to present Proof Of Possession (of the private key).  So just 
discovering the public key somehow would not be sufficient to be able to 
request a cert with that public key.

I await correction in quoting Steve.

--Sandy, speaking as regular ol' member

>
> randy
> _______________________________________________
> sidr mailing list
> sidr@ietf.org
> https://www.ietf.org/mailman/listinfo/sidr
>