Re: [Sidr] V3 draft of SIDR Charter

On Tue, 29 Nov 2005, Geoff Huston wrote:

> At 11:08 PM 28/11/2005, william(at)elan.net wrote:
>> That is pretty much it. I do not see it clearly spelled out in the
>> charter that we would work on specifying access to (or at least linking 
>> rules for specifying PKI repository) PKI repositories and format of the 
>> data that is to be retrieved. There are actually quite a number of ways
>> to run a repository or certificate verification service that have been 
>> developed (plus add related issues and formats for publication of CRL
>> data as well), these are just a few these:
>>  SCVP (draft-ietf-pkix-scvp-21.txt)
>>  DVCS (RFC3029)
>>  OSCP (RFC2560)
>>  PKIXREP locator (draft-ietf-pkix-pkixrep-04.txt)
>>  HTTP Certificate Store (draft-ietf-pkix-certstore-http-09.txt)
>>  LDAP Certificate server
>>  PGP (HTTP based) key & certificate server
>>  etc.
>> And it may well be that none of the above will work because one of the key
>> issues is that BGP (like DNS) is a base protocol so one can not fully rely 
>> on some "higher" application protocol as part of BGP route establishment
>> (see also SBGP & soBGP and compare how they propose to store cert data).
>> 
>> I think info on considerations and issues involved in setting up and
>> running repositories that would be used for BGP security should be
>> considered and documented as well at least in some way.
>> 
>> Also the format for certificates and any necessary extensions are all in 
>> scope (i.e. if we decide we need extension of RFC3779) and this
>> I also see as publication-related issue.
>
> I am unsure how nmuch of this belongs in a SIDR charter and how much belongs 
> in a security area as a work item and how much is beyond the scope of

As I said before I view SIDR work as something that is more security
centric then routing but like others I personally dont care that much
if its officially under security or under routing area. But in general
IETF usually has security area WGs work on security additions to other 
protocols (when its whole WG rather then one document in WG that is
mostly working on something else).

> standards-related activities. For a charter I'm personally more comfortable 
> with the more general phrase of

> " Document the use of certification objects within this secure routing 
> architecture"
>
> and not specifying the form of repository nor the form of repository access 
> as charter work items at this point in time.

Strongly disagree. You can not attempt global deployment unless you deal 
with repository access issues.

-- 
William Leibzon
Elan Networks
william@elan.net

_______________________________________________
Sidr mailing list
Sidr@ietf.org
https://www1.ietf.org/mailman/listinfo/sidr