Re: [sidr] Master thesis - RPKI

[Demian Rosenkranz <[e-mail]>]

Comments below.

Am 15.01.2014 18:22, schrieb Sriram, Kotikalapudi:
>> From: sidr [mailto:[e-mail]] On Behalf Of Demian Rosenkranz
>>
>> Correct, Im talking about really short lifetimes for ROAs (EE certificates). The
>> RP software would be forced to cryptographically checks the objects again
>> and again over short intervals.
>> But long lifetimes for ROAs (EE certificates) mean at least bigger CRLs.
>> This would be one benefit of short lifetimes.
>>
>
> Even if about a few hundred origination-change events occur in a year that require
> ROA-EE-certificate rollover, you are dealing with an increase of merely just that many
> additional entries in the CRL (with the long-lifetime ROAs and revocation approach).
> If instead short lifetimes are used, then 500,000 certs and ROAs would be propagated
> in the RPKI system periodically in each of those short intervals.
> The latter seems to be a much bigger price to pay.
OK, thats right!

> But if you can provide further analysis and insight in your thesis,
> it would be very welcome.
Unfortunately, I'm writing my thesis in German but I would be happy to 
get feedback from the users of this mailing-list. So, I try to keep you 
updated with the most significant results!

>
> We discussed and quantified these types choices and trade-offs earlier
> not in the context of ROA (EE cert) lifetimes, but in the context
> of AS or router key rollover mechanisms to mitigate BGPSEC update replay attacks.
> Please see:
> http://tools.ietf.org/html/draft-sriram-replay-protection-design-discussion-02
> http://www.ietf.org/proceedings/85/slides/slides-85-sidr-4.pdf
> http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-rollover-02
Thank you for this information!

>
> Sriram
>
>
>