Re: [sidr] RPKI and private keys (was RE: Interim Meeting Draft Agenda: 04-30-2012 (April 30, 2012)))

[Jakob Heitz <[e-mail]>]

Might it be possible to create the key pair on the router?
Then you don't have to move the private key to the router,
You move the public key off the router. Much easier.

-- 
Jakob Heitz.

On Friday, May 04, 2012 6:54 PM, Christopher Morrow <> wrote:

> On Fri, May 4, 2012 at 9:37 PM, Osterweil, Eric
> <[e-mail]> wrote: 
>> Hey Chris,
>> 
>> Yeah, I read that. I know there's a tendency for some people to want
>> to talk about bath houses on this list, but I was going to pass on
>> that.  
>> 
>> As for draft-ymbk-bgpsec-rtr-rekeying-00.txt, that draft just points
>> out the inadequacies of either approach and that there is no good
>> solution. My take is that this is indicative of a misalignment
>> between a given architecture and implicit requirements. Sometimes
>> you can't patch the holes in a leaky ship, you need to reassess the
>> requirements. I think the evidence illustrates that this is the case
>> here.      
>> 
> 
> it seems to me that putting key-material on a distant router is done
> today... isn't it? or are you saying that how you do it today leaves
> you feeling icky, and you'd rather another method be devised?
> 
> Could you outline a possible method? (provide a solution, for
> instance) 
> 
>> Eric
>> 
>> 
>> ----- Original Message -----
>> From: Chris Morrow [mailto:[e-mail]]
>> Sent: Friday, May 04, 2012 09:28 PM
>> To: Osterweil, Eric
>> Cc: '[e-mail]' <[e-mail]>;
>> '[e-mail]' <[e-mail]>; '[e-mail]'
>> <[e-mail]>; '[e-mail]' <[e-mail]>;
>> '[e-mail]' <[e-mail]>;
>> '[e-mail]' <[e-mail]>    
>> Subject: Re: [sidr] RPKI and private keys (was RE: Interim Meeting
>> Draft Agenda: 04-30-2012 (April 30, 2012))) 
>> 
>> 
>> 
>> On 05/04/2012 08:59 PM, Osterweil, Eric wrote:
>> 
>>> His point is NOT addressed by any draft in the wg (since you asked).
>> 
>> read randy's mentioned draft?