Re: [sidr] I-D Action: draft-ietf-sidr-rpki-validation-reconsidered-06.txt

[Stephen Kent <[e-mail]>]

Tim,

I reviewed the -06 version and am attaching a pdf of the MS Word file 
with suggested edits. I can send you the word file itself if you wish.

I have provided text to my co-author, Sean, to include in the 
bgpsec-pki-profile doc to address your concern. I suggested the 
following text at the beginning of section 3 :

    The validation procedure used for BGPsec Router Certificates is
    identical to the validation procedure described in Section 7 of
    [RFC6487](and any RFC that updates this procedure), but using the
    constraints applied come from this specification.

Sean added an implementation considerations section which I suggest will 
say:

    Operators MAY choose to issue separate BGPsec Router Certificates for
    different ASNs. Doing so may prevent a BGPsec Router Certificate from
    becoming invalid if one of the ASNs is removed from any superior CA certificate
    along the path to a trust anchor.


I hope these changes avoid the need to say anything about router certs 
in your doc.

I'm not sure there is a need to change the ROA spec. If we agree that 
all prefixes in the ROA MUST be contained in the EE cert for that ROA, 
then the current text in the ROA spec does not need to change.

Steve