Re: [Sidr] V3 draft of SIDR Charter

At 10:57 AM 29/11/2005, william(at)elan.net wrote:

>On Tue, 29 Nov 2005, Geoff Huston wrote:
>
>>At 11:08 PM 28/11/2005, william(at)elan.net wrote:
>>>That is pretty much it. I do not see it clearly spelled out in the
>>>charter that we would work on specifying access to (or at least linking 
>>>rules for specifying PKI repository) PKI repositories and format of the 
>>>data that is to be retrieved. There are actually quite a number of ways
>>>to run a repository or certificate verification service that have been 
>>>developed (plus add related issues and formats for publication of CRL
>>>data as well), these are just a few these:
>>>  SCVP (draft-ietf-pkix-scvp-21.txt)
>>>  DVCS (RFC3029)
>>>  OSCP (RFC2560)
>>>  PKIXREP locator (draft-ietf-pkix-pkixrep-04.txt)
>>>  HTTP Certificate Store (draft-ietf-pkix-certstore-http-09.txt)
>>>  LDAP Certificate server
>>>  PGP (HTTP based) key & certificate server
>>>  etc.
>>>And it may well be that none of the above will work because one of the key
>>>issues is that BGP (like DNS) is a base protocol so one can not fully 
>>>rely on some "higher" application protocol as part of BGP route establishment
>>>(see also SBGP & soBGP and compare how they propose to store cert data).
>>>I think info on considerations and issues involved in setting up and
>>>running repositories that would be used for BGP security should be
>>>considered and documented as well at least in some way.
>>>Also the format for certificates and any necessary extensions are all in 
>>>scope (i.e. if we decide we need extension of RFC3779) and this
>>>I also see as publication-related issue.
>>
>>I am unsure how nmuch of this belongs in a SIDR charter and how much 
>>belongs in a security area as a work item and how much is beyond the scope of
>
>As I said before I view SIDR work as something that is more security
>centric then routing but like others I personally dont care that much
>if its officially under security or under routing area. But in general
>IETF usually has security area WGs work on security additions to other 
>protocols (when its whole WG rather then one document in WG that is
>mostly working on something else).
>
>>standards-related activities. For a charter I'm personally more 
>>comfortable with the more general phrase of
>
>>" Document the use of certification objects within this secure routing 
>>architecture"
>>
>>and not specifying the form of repository nor the form of repository 
>>access as charter work items at this point in time.
>
>Strongly disagree. You can not attempt global deployment unless you deal 
>with repository access issues.

This is an effort at creating a set of techology standards, not a specific 
deployment specification for a particular networked environment. Given the 
diversity of potential deployment scenarios across various forms of 
Internet environments I think that some division of the activity is 
entirely appropriate and necessary, and the generation of deployment 
profiles may well be an outcome of such a division of effort - but from the 
point of view of specification of technology standards and the charter for 
such an activity, I believe it to be appropriate to will pass on this draft 
charter to the ADs with the wording as  proposed above.

Geoff

_______________________________________________
Sidr mailing list
Sidr@ietf.org
https://www1.ietf.org/mailman/listinfo/sidr