Re: [sidr] AD Review of draft-ietf-sidr-rpki-validation-reconsidered-07

[Chris Morrow <[e-mail]>]

At Mon, 13 Mar 2017 10:55:56 +0100,
Tim Bruijnzeels <[e-mail]> wrote:
> 
> Hi,
> 
> So, to me it seems that having new OIDs makes perfect sense as long as
> there is a choice of two validation algorithms. Then having an
> explicit flag set by CAs tells RPs decide which way to go. Because of
> this I also do not see an immediate need to have a time line for all
> CAs to use the new protocol for all its products. It's all explicit.

I was thinking that today code for CA/RP doesn't understand (mostly)
the 'new' way. Tomorrow 'some' of the CA/RP world will shift to being
able to do both ways.

So, until all of the CA/RP software is updated and deployed, CAs can't
make new OID/validation content and expect them to be respected. I
expect a transition to the new validation algorithm (for even a single
CA) will have to wait until this point in time. Once there are new and
old validation algorithm data available a CA probably should flush the
'old' and publish the 'new'. I think Tim's correct that an RP can see:
  "Oh, new OID here, run new algorithm!"

and be perfectly fine... but, having 2 versions of the validation
algorithm and seeing published data for both OID sets for a single
prefix/publication bundle will be very problematic. There's no
proscribed 'prefer new over old' action here, so a CA must only
publish one version of their data.

-chris