Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Sean Turner <sean@sn3rd.com>
In-Reply-To: <148353788046.13042.160471261406266.idtracker@ietfa.amsl.com>
Date: Wed, 4 Jan 2017 19:34:48 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <F5E3802E-8FEB-4448-884F-CB6178A1FB6E@sn3rd.com>
References: <148353788046.13042.160471261406266.idtracker@ietfa.amsl.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Archived-At: <https://mailarchive.ietf.org/arch/msg/sidr/hJbo2L2fQCaIfaiqa4Ey-W8ECwY>
Cc: Chris Morrow <morrowc@ops-netman.net>, sidr-chairs@ietf.org,
 The IESG <iesg@ietf.org>, draft-ietf-sidr-bgpsec-pki-profiles@ietf.org,
 sidr@ietf.org
Subject: Re: [sidr] Stephen Farrell's Discuss on
 draft-ietf-sidr-bgpsec-pki-profiles-19: (with DISCUSS and COMMENT)
Precedence: list

> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>=20
>=20
> - section 2: I think this is a bit badly written: "The use
> of BGPsec Router Certificates in no way affects RPKI RPs
> that process Manifests and ROAs because the public key
> found in the BGPsec Router Certificate is used only to
> verify the signature on the BGPsec certificate request
> (only CAs process these) and the signature on a BGPsec
> Update Message [ID.sidr-bgpsec-protocol] (only BGPsec
> routers process these)." Do you mean that there's no way
> that an entity can confuse a Manifest, ROA, CSR or BGPsec
> update so there's no issue with which public keys are used
> to verify the signatures on those data structures?

Gahhhh =E2=80=A6 so that=E2=80=99s a little tortured; it=E2=80=99s a =
continuation of the whole =E2=80=9Cthese certs don=E2=80=99t really =
affect the rest of the RPKI".  How about:

BGPsec Router Certificates are used only to verify the signature on the =
BGPsec certificate request (only CAs process these) and the signature on =
a BGPsec Update Message [ID.sidr-bgpsec-protocol] (only BGPsec routers =
process these); BGPsec Router Certificates are not used to process =
Manifests and ROAs or verify signatures on Certificates or CRLs.

> - section 3: As noted in my comments on the BGPsec
> protocol, it'd be better to call out the SKI here if you
> don't add the direct ref to 6487 to the BGPsec protocol
> draft.

Wait, I thought I wasn=E2=80=99t supposed to duplicate any of the crazy =
stuff from 6487 :)

spt