[sidr] about a router AS-related certificate

[Sandra Murphy <[e-mail]>]

The wg has just demonstrated a lack of support for adoption of a suggested 
cert profile for routers in draft-turner-sidr-bgpsec-pki-profiles.

Unfortunately, a router certificate is already mentioned in existing wg 
drafts.


The bgpsec-overview draft says:

    BGPSEC extends the RPKI by adding an additional type of certificate,
    referred to as a BGPSEC router certificate, that binds an AS number
    to a public signature verification key, the corresponding private key
    of which is held by one or more BGP speakers within this AS.


The bgpsec-ops drafts says:

    AS/Router Certificates


    A site/operator MAY use a single certificate/key in all their
    routers, one certificate/key per router, or any granularity in
    between.

    A large operator, concerned that a compromise of one router's key
    would make many routers vulnerable, MAY accept a more complex
    certificate/key distribution burden to reduce this exposure.

    On the other extreme, an edge site with one or two routers MAY use a
    single certificate/key.


Is there an alternative router certificate that the wg would like to 
adopt?

If the wg did not realize that the router certificate was needed to 
fulfill existing wg drafts, please speak up.

At any rate, the wg needs to indicate how to proceed here.

--Sandy, speaking as wg chair