Re: [sidr] Last Call: <draft-ietf-sidr-rpsl-sig-10.txt> (Securing RPSL Objects with RPKI Signatures) to Proposed Standard

> On 12 May 2016, at 13:22, Randy Bush <randy@psg.com> wrote:
> 
>>>> I agree that the original text allowing multiple signatures supports
>>>> the case where the components of the primary key of the object (i.e.,
>>>> prefix+ASN) come from different resource holders. I will restore that
>>>> text.
>>> 
>>> this is gonna be really simple; no complications at all i am sure.
>>> 
>>> btw, was this a consensus of the wg?
>> 
>> The original draft supported multiple signature attributes. During WG
>> review (WGLC?, don't recall), several people suggested simplifying the
>> approach by only allowing one signature attribute. Given the route[6]
>> example, we need multiple signatures modulo the proposed text to clarify
>> the handling/generation of those signatures.
> 
> i.e. it was not wg consensus but you think you should do it anyway?

First off: I am sorry for arriving late to this party with my comments.

But regardless of process. For this to be useful for route objects we need two signatures in cases where the AS and prefix are held by different parties.

If the current text can't be modified, my guess is that a bis could be another option.

On another note: I think RPSL signatures on route objects add relatively little value - I would advise people to use ROAs instead. But the ability to sign over import/export in aut-num objects, or contact information/remarks etc in inetnum object to name two examples is useful, and only requires one signature.

> 
> randy
> 
> _______________________________________________
> sidr mailing list
> sidr@ietf.org
> https://www.ietf.org/mailman/listinfo/sidr